[kerpow1]

Hi,

Since 8.1 and 10 I am no longer able to to hide kernel module from PsLoadedModulesList, previously on 7,Vista,8.0 this worked fine without tampering with PG at all but seems this has now changed.

I am currently doing;

~removed~

Thanks

[Microwave89]

In Windows 8.1+ they seem to have added a check for loaded module list, see here:
http://www.alex-ionescu.com/?p=290

19 : Loaded module list modification

I'll ask the same question again, why do you need to hide your driver?

Best Regards - Microwave89

[kerpow1]

Some antitools are scanning once they have obtained a signature, so we must hide it.

[china123]

Dear LordTristan,

I don't think this forum exists to aid you in pay-hack development.

LdrList tampering was part of the original patchguard lineup in the x64 XP beta, and integrity for this particular structure was carelessly implemented. Thankfully as of 8.1, it is no longer a trivial task for the average developer.

[kerpow1]

Also isn't possible to remove driver once it's loaded on 8.1,10

[EP_X0FF]

Consider removing this rootkit feature. Did you tried randomizing driver file name and device object to hide from "scan"?

[kerpow1]

Thanks exp, I have now figured the issue. China you have wrong guy sorry.

I will post up solution in blackbone variant revision.