搜索资源列表
SSDT_hook
- SSDT hook example (hiding processes) correction -SSDT hook example (hiding processes) Corr ection
SSDT
- 通过例子介绍了Windows系统服务调用的基本知识及Hook SSDT的方法-by example on the Windows system service called the basic knowledge and methods Hook SSDT
SSDT
- 挂钩SSDT，通过驱动和hook函数进行进程控制。-Linked to SSDT, through the hook-driven and process control functions.
Hide_Process_Hook_MDL
- SSDT Hook ZwQuerySystemInformation 隐藏进程-SSDT Hook ZwQuerySystemInformation hidden processes
ssdthookinlinehook
- 这是一个SSDT HOOK源代码，希望对大家有点作用-This is a SSDT HOOK source code, I hope we are a bit on the role of
ssdt.
- Delphi开发驱动的一个例子 1.映射ntoskrnl.exe到内存 2.重定位信息... 3.搜索SSDT基址 4.补丁回去-Delphi developed an example-driven 1. Mappings ntoskrnl.exe into memory 2. ... 3, re-positioning information. Search SSDT base address 4. Patch
SSDT_Helper_src
- HOOK SSDT Hook系统服务描述表.查看SSDT.是个好东西-HOOK SSDT that s may be is you need
SSDT
- ssdt查看恢复工具源码，界面程序，具有查看和恢复ssdt功能，可以编译通过-View source ssdt recovery tools, interface procedures ssdt with the view and the restoration of function can be compiled through
SSDT-hook
- Windows内核态SSDT-hook实现进程隐藏和文件隐藏，代码很规整，学习内核编程的好例子 -a good example of studying kernel programing or driver developing, SSDT hook
Kehook
- 对于hook，从ring3有很多，ring3到ring0也有很多，根据api调用环节递进的顺序，在每一个环节都有hook的机会，可以有int 2e或者sysenter hook，ssdt hook，inline hook ，irp hook，object hook，idt hook-The hook, from ring3 there are many, ring3 to ring0 there are many, according
anti-hook-ssdt
- ssdt钩子检测，利用查找ntkrnlpa.exe中导出的ssdt的起始地址和大小，比较实际的ssdt地址表中的内容，找出钩子-ssdt hook detection, the use of export ntkrnlpa.exe Find ssdt the start address and size, a more realistic ssdt address the contents of the table to find ou
antihook_src
- 创建一个内核驱动，伪造一个ssdt表，使得ssdt钩子失效。-Create a kernel driver, forged a ssdt table, making failure ssdt hook.
biostelnet
- 向BIOS中植入模块，HOOK中断向量表,HOOK NTLDR加载过程以及HOOK内核函数，SSDT hook。-Add module into bios,HOOK IVT,HOOK NTLDR loder process and hook knrnel function,just as SSDT HOOK
Miss920
- Miss920程序行为监视器，运用SSDT HOOK技术，可以简单有效的监控程序行为，现在已经实现了进程监控，文件监控，注册表监控，并且可以有效快捷地进行二次开发。-Miss920 monitor program behavior, the use of SSDT HOOK technology, can be simple and effective monitoring of program behavior, the proces
SSTD.ZIP
- SSDT HOOK Source code
Hook
- 本文从难易程度上主要分三块详细介绍：一．用户模式Hook:IAT-hook,Dll-inject 二．内核模式Hook:ssdt-hook,idt-hook,int 2e/sysenter-hook 三．Inline Function Hook -In this paper, Difficulty Level 3 detail the main points: 1. User Mode Hook: IAT-hook, Dll-injec
CCRootkit-V0.1
- 一般网上找到的都是需要Ring3传输需要补丁的地址过去... 002就是直接用最标准的方法进行SSDT定位以及修复的 支持多核系统,当然还有003(加入shadow ssdt hook),004(加入inline hook) 基本上是现在最稳定的恢复方式了,大家可以用KMDLoader测试.加载就脱钩.不需要通讯 -Generally find on the Internet are required Ring3 add
anti-ssdt
- Windows XP是通过sysenter调用KiFastCallEntry将ntdll.dll的调用切换到内核的。KiFastCallEntry的原理是通过在SSDT中查找函数地址跳转。所以只要伪造一张原始SSDT，就可以使得SSDT-HOOK无效了。-Windows XP by calling KiFastCallEntry sysenter ntdll.dll call will switch to the kernel. Ki
SSDT
- 建立新的SSDT表，修改可以绕过，某些游戏保护系统的SSDT HOOK 或 INLINE HOOK-SSDT table to create a new, modified to bypass certain game protection system SSDT HOOK or INLINE HOOK
SSDT-HOOK
- XP下SSDT Hook ZwCreateThread的代码，仅适用于XP，由驱动和用户模式下控制程序组成，是从以前写的另一个程序修改过来的，所以代码中部分结构体的成员的定义是多余的，要写SSDT Hook的可以参考一下-XP, SSDT Hook ZwCreateThread code only applies to XP, drivers and user mode by the control program component