kd> dt _TEB 
ntdll!_TEB
 +0x000 NtTib : _NT_TIB
 +0x01c EnvironmentPointer : Ptr32 Void
 +0x020 ClientId : _CLIENT_ID
 +0x028 ActiveRpcHandle : Ptr32 Void
 +0x02c ThreadLocalStoragePointer : Ptr32 Void
 +0x030 ProcessEnvironmentBlock : Ptr32 _PEB
 +0x034 LastErrorValue : Uint4B

kd> dt _PEB
ntdll!_PEB
 +0x000 InheritedAddressSpace : UChar
 +0x001 ReadImageFileExecOptions : UChar
 +0x002 BeingDebugged : UChar
 +0x003 BitField : UChar
 +0x003 ImageUsesLargePages : Pos 0, 1 Bit
 +0x003 IsProtectedProcess : Pos 1, 1 Bit
 +0x003 IsLegacyProcess : Pos 2, 1 Bit
 +0x003 IsImageDynamicallyRelocated : Pos 3, 1 Bit
 +0x003 SkipPatchingUser32Forwarders : Pos 4, 1 Bit
 +0x003 SpareBits : Pos 5, 3 Bits
 +0x004 Mutant : Ptr32 Void
 +0x008 ImageBaseAddress : Ptr32 Void
 +0x00c Ldr : Ptr32 _PEB_LDR_DATA // PEB_LOADER_DATA 進(jìn)程加載信息表

kd > dt _PEB_LDR_DATA
 ntdll!_PEB_LDR_DATA
 + 0x000 Length : Uint4B
 + 0x004 Initialized : UChar
 + 0x008 SsHandle : Ptr32 Void
 + 0x00c InLoadOrderModuleList : _LIST_ENTRY // 模塊加載順序
 + 0x014 InMemoryOrderModuleList : _LIST_ENTRY // 加載后在內(nèi)存中的順序
 + 0x01c InInitializationOrderModuleList : _LIST_ENTRY // 模塊初始化的順序
 + 0x024 EntryInProgress : Ptr32 Void
 + 0x028 ShutdownInProgress : UChar
 + 0x02c ShutdownThreadId : Ptr32 Void

 kd > dt _LDR_DATA_TABLE_ENTRY
 ntdll!_LDR_DATA_TABLE_ENTRY
 + 0x000 InLoadOrderLinks : _LIST_ENTRY 　　
 + 0x008 InMemoryOrderLinks : _LIST_ENTRY
 + 0x010 InInitializationOrderLinks : _LIST_ENTRY
 + 0x018 DllBase : Ptr32 Void　　// 模塊基地址
 + 0x01c EntryPoint : Ptr32 Void　　// 入口函數(shù)(對(duì)于 exe 模塊有效)
 + 0x020 SizeOfImage : Uint4B　　// 模塊大小
 + 0x024 FullDllName : _UNICODE_STRING　　// 完成模塊名稱(帶路徑)
 + 0x02c BaseDllName : _UNICODE_STRING // 模塊名稱
 + 0x034 Flags : Uint4B

// 隱藏模塊.cpp : 此文件包含 "main" 函數(shù)。程序執(zhí)行將在此處開(kāi)始并結(jié)束。
//
#include "pch.h"
#include <iostream>
#include <Windows.h>
/* 所需要的結(jié)構(gòu)體
1. _LDR_DATA_TABLE_ENTRY 鏈表指向數(shù)據(jù)
2. _PEB_LDR_DATA 表示其 PEB0x處指向的數(shù)據(jù)表
3. _LIST_ENTRY 指針指向的鏈表
*/
typedef struct _LSA_UNICODE_STRING {
 USHORT Length;
 USHORT MaximumLength;
 PWSTR Buffer;
}
UNICODE_STRING, *PUNICODE_STRING;
typedef struct _PEB_LDR_DATA
{
 DWORD Length; // +0x00
 bool Initialized; // +0x04
 PVOID SsHandle; // +0x08
 LIST_ENTRY InLoadOrderModuleList; // +0x0c
 LIST_ENTRY InMemoryOrderModuleList; // +0x14
 LIST_ENTRY InInitializationOrderModuleList;// +0x1c
} PEB_LDR_DATA, *PPEB_LDR_DATA; // +0x24
typedef struct _LDR_MODULE
{
 LIST_ENTRY InLoadOrderModuleList;
 LIST_ENTRY InMemoryOrderModuleList;
 LIST_ENTRY InInitializationOrderModuleList;
 void* BaseAddress;
 void* EntryPoint;
 ULONG SizeOfImage;
 UNICODE_STRING FullDllName;
 UNICODE_STRING BaseDllName;
 ULONG Flags;
 SHORT LoadCount;
 SHORT TlsIndex;
 HANDLE SectionHandle;
 ULONG CheckSum;
 ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;
//所謂模塊句柄，即該模塊的入口地址
void hide_module(char* szDllName)
{
 HMODULE hMod = GetModuleHandleA(szDllName);
 PLIST_ENTRY Head, Cur;
 PPEB_LDR_DATA ldr;
 PLDR_MODULE ldm;
 __asm
 {
 mov eax, fs:[0x30]
 mov ecx, [eax + 0x0c] //Ldr 
 mov ldr, ecx
 }
 Head = &(ldr->InLoadOrderModuleList);
 Cur = Head->Flink;
 do
 {
 ldm = CONTAINING_RECORD(Cur, LDR_MODULE, InLoadOrderModuleList);
 if (hMod == ldm->BaseAddress)
 {
 // 三個(gè)鏈表同時(shí)給斷掉
 ldm->InLoadOrderModuleList.Blink->Flink =
 ldm->InLoadOrderModuleList.Flink;
 ldm->InLoadOrderModuleList.Flink->Blink =
 ldm->InLoadOrderModuleList.Blink;
 //
 ldm->InInitializationOrderModuleList.Blink->Flink =
 ldm->InInitializationOrderModuleList.Flink;
 ldm->InInitializationOrderModuleList.Flink->Blink =
 ldm->InInitializationOrderModuleList.Blink;
 //
 ldm->InMemoryOrderModuleList.Blink->Flink =
 ldm->InMemoryOrderModuleList.Flink;
 ldm->InMemoryOrderModuleList.Flink->Blink =
 ldm->InMemoryOrderModuleList.Blink;
 break;
 }
 Cur = Cur->Flink;
 } while (Head != Cur);
}
int main()
{
 // 通過(guò)模塊名，來(lái)獲取模塊句柄
 printf("****按任意鍵隱藏模塊*****");
 getchar();
 hide_module((char*)"kernel32.dll");
 printf("****隱藏模塊完成*****");
 getchar();
 getchar();
}