kd> dt _driver_object
ntdll!_DRIVER_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Int2B
   +0x004 DeviceObject     : Ptr32 _DEVICE_OBJECT
   +0x008 Flags            : Uint4B
   +0x00c DriverStart      : Ptr32 Void
   +0x010 DriverSize       : Uint4B
   +0x014 DriverSection    : Ptr32 Void
   +0x018 DriverExtension  : Ptr32 _DRIVER_EXTENSION
   +0x01c DriverName       : _UNICODE_STRING
   +0x024 HardwareDatabase : Ptr32 _UNICODE_STRING
   +0x028 FastIoDispatch   : Ptr32 _FAST_IO_DISPATCH
   +0x02c DriverInit       : Ptr32     long 
   +0x030 DriverStartIo    : Ptr32     void 
   +0x034 DriverUnload     : Ptr32     void 
   +0x038 MajorFunction    : [28] Ptr32     long 
+0x014 DriverSection    : Ptr32 Void
类似3环peb

list module

#include <ntifs.h>
//0x78 bytes (sizeof)
typedef struct _KLDR_DATA_TABLE_ENTRY32 {
    LIST_ENTRY32 InLoadOrderLinks;
    ULONG __Undefined1;
    ULONG __Undefined2;
    ULONG __Undefined3;
    ULONG NonPagedDebugInfo;
    ULONG DllBase;
    ULONG EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING32 FullDllName;
    UNICODE_STRING32 BaseDllName;
    ULONG Flags;
    USHORT LoadCount;
    USHORT __Undefined5;
    ULONG  __Undefined6;
    ULONG  CheckSum;
    ULONG  TimeDateStamp;
    //
    // NOTE : Do not grow this structure at the dump files used a packed
    // array of these structures.
    //
} KLDR_DATA_TABLE_ENTRY32, * PKLDR_DATA_TABLE_ENTRY32;
VOID Unload(PDRIVER_OBJECT DriverObject) {
    KdPrint(("driver unloaded\r\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegisteryPath) {
    NTSTATUS status;
    DriverObject->DriverUnload = Unload;
    DbgBreakPoint();
    PKLDR_DATA_TABLE_ENTRY32 ldr = (PKLDR_DATA_TABLE_ENTRY32)DriverObject->DriverSection;
    PKLDR_DATA_TABLE_ENTRY32 pre = (PKLDR_DATA_TABLE_ENTRY32)ldr->InLoadOrderLinks.Flink;
    PKLDR_DATA_TABLE_ENTRY32 next = (PKLDR_DATA_TABLE_ENTRY32)pre->InLoadOrderLinks.Flink;
    int count = 0;
    while(next!=pre)
    {
        DbgPrintEx(77, 0, "[db]:%d driver name = %wZ\r\n", count++, &next->FullDllName);
        next = (PKLDR_DATA_TABLE_ENTRY32)next->InLoadOrderLinks.Flink;
    }
    DbgBreakPoint();
    return STATUS_SUCCESS;
}

hide

#include <ntifs.h>
//0x78 bytes (sizeof)
typedef struct _KLDR_DATA_TABLE_ENTRY {
    LIST_ENTRY InLoadOrderLinks;
    ULONG __Undefined1;
    ULONG __Undefined2;
    ULONG __Undefined3;
    ULONG NonPagedDebugInfo;
    ULONG DllBase;
    ULONG EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING FullDllName;
    UNICODE_STRING BaseDllName;
    ULONG Flags;
    USHORT LoadCount;
    USHORT __Undefined5;
    ULONG  __Undefined6;
    ULONG  CheckSum;
    ULONG  TimeDateStamp;
    //
    // NOTE : Do not grow this structure at the dump files used a packed
    // array of these structures.
    //
} KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY;
NTKERNELAPI
NTSTATUS
ObReferenceObjectByName(
    __in PUNICODE_STRING ObjectName,
    __in ULONG Attributes,
    __in_opt PACCESS_STATE AccessState,
    __in_opt ACCESS_MASK DesiredAccess,
    __in POBJECT_TYPE ObjectType,
    __in KPROCESSOR_MODE AccessMode,
    __inout_opt PVOID ParseContext,
    __out PVOID* Object
);
VOID Unload(PDRIVER_OBJECT DriverObject) {
    KdPrint(("driver unloaded\r\n"));
}
extern POBJECT_TYPE * IoDriverObjectType;
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegisteryPath) {
    NTSTATUS status;
    DriverObject->DriverUnload = Unload;
    DbgBreakPoint();
    PKLDR_DATA_TABLE_ENTRY ldr = (PKLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection;
    PKLDR_DATA_TABLE_ENTRY pre = (PKLDR_DATA_TABLE_ENTRY)ldr->InLoadOrderLinks.Flink;
    PKLDR_DATA_TABLE_ENTRY next = (PKLDR_DATA_TABLE_ENTRY)pre->InLoadOrderLinks.Flink;
    int count = 0;
    UNICODE_STRING driverName1 = RTL_CONSTANT_STRING(L"helloDriver.sys");
    UNICODE_STRING driverName = RTL_CONSTANT_STRING(L"\\driver\\helloDriver.sys");
    while(next!=pre)
    {
        DbgPrintEx(77, 0, "[db]:%d driver name = %wZ\r\n", count++, &next->FullDllName);
        if (RtlEqualUnicodeString(&next->BaseDllName,&driverName,TRUE))
        {
            DbgPrintEx(77, 0, "driver remove %wZ\r\n", &next->FullDllName);
            PDRIVER_OBJECT pDriver = NULL;
            status = ObReferenceObjectByName(&driverName1, FILE_ALL_ACCESS, 0, 0, *IoDriverObjectType, KernelMode, NULL, &pDriver);
            pDriver->DriverSection = ldr->InLoadOrderLinks.Flink;
            RemoveEntryList(&next->InLoadOrderLinks);
            if (NT_SUCCESS(status))
            {
                pDriver->DriverInit = NULL;
                pDriver->Type = 0;
            }
            ObDereferenceObject(pDriver);
            break;
        }
        next = (PKLDR_DATA_TABLE_ENTRY)next->InLoadOrderLinks.Flink;
    }
    DbgBreakPoint();
    return STATUS_SUCCESS;
}