登录
首页 » Windows核心 » 在Ring0下实现保护进程,通过HOOK SSDT实现保护进程

在Ring0下实现保护进程,通过HOOK SSDT实现保护进程

于 2022-03-16 发布 文件大小:6.44 kB
0 119
下载积分: 2 下载次数: 1

代码说明:

在Ring0下实现保护进程,通过HOOK SSDT实现保护进程-The Ring0 achieve protection process, achieved through the protection process HOOK SSDT

下载说明:请别用迅雷下载,失败请重下,重下不扣分!

发表评论

0 个回复

  • 这篇文档是在Windows NT操作系统下隐藏对象、文件、服务、进程等的技术。这种方法是基于Windows API函数的挂钩。 这篇文章中所描述的技术都是从我写...
    这篇文档是在Windows NT操作系统下隐藏对象、文件、服务、进程等的技术。这种方法是基于Windows API函数的挂钩。 这篇文章中所描述的技术都是从我写rootkit的研究成果,所以它能写rootkit更有效果并且更简单。这里也同样包括了我的实践。 在这篇文档中隐藏对象意味着改变某些用来命名这些对象的系统函数,使它们将忽略这些对象的名字。这样一来我们改动的那些函数的返回值表示这些对象根本就不存在。 最基本的方法(除去少数不同的)是我们用原始的参数调用原始的函数,然后我们改变它们的输出。 在这篇文章里将描述隐藏文件、进程、注册表键和键值、系统服务和驱动、分配的内存还有句柄。-This document is in the Windows NT operating system hidden objects, documents, services, process technology. This method is based on the Windows API function link. This article describes techniques are, I wrote rootkit from the results of research, so it was rootkit more effective and more simple. Here, too, including my practice. In this document hidden object means certain changes to these objects naming system functions so that they will ignore these objects by name. So we change those functions return values, said these objects simply do not exist. The most basic method (excluding a few different) is that we should call the original parameters of the original function, and then we change their
    2022-03-07 17:00:50下载
    积分:1
  • use of the mouse interface hook hidden example in order to facilitate beginners...
    利用鼠标钩子隐藏界面的例子程序,方便初学者学习鼠标钩子用法-use of the mouse interface hook hidden example in order to facilitate beginners learning mouse usage hook
    2022-04-06 21:29:50下载
    积分:1
  • 视频采集卡驱动程序.用vc实现的界面。可以控制。
    视频采集卡驱动程序.用vc实现的界面。可以控制。-Video capture card driver. Realize with vc interface. Can be controlled.
    2023-08-15 19:40:03下载
    积分:1
  • jdk5 API documentation, beginners must, under the official network, oh we
    jdk5 API documentation, beginners must, under the official network, oh we-jdk5 API documentation, beginners must, under the official network, oh well
    2022-06-14 23:30:09下载
    积分:1
  • vc++编程详细代码大全
    vc++编程详细代码大全 -vc++ detailed programming code Guinness
    2022-08-02 11:21:43下载
    积分:1
  • 计算用运算符后缀法表示的表达式的值。后缀表达式也称逆波兰表达式,比中缀表达式计算起来更方便简单些,中缀表达式要计算就存在着括号的匹配问题,所以在计算表达式值时一...
    计算用运算符后缀法表示的表达式的值。后缀表达式也称逆波兰表达式,比中缀表达式计算起来更方便简单些,中缀表达式要计算就存在着括号的匹配问题,所以在计算表达式值时一般都是先转换成后缀表达式,再用后缀法计算表达式的值。如:表达式(a+b*c)/d-e用后缀法表示应为abc*+d/e-。只考虑四则算术运算,且假设输入的操作数均为1位十进制数(0―9),并且输入的后缀形式表达式不含语法错误-calculated Operators suffix France said the value of the expression. Suffix expression also called inverse Poland expression, which is made up of formulas can be more convenient for some simple, ordinary expression to calculate the brackets on the existence of the matching problem, in the calculation of expression values are generally first converted into a suffix expression, reuse suffix calculated the value of the expression. Such as : The expression (a, b* c)/d-e suffix method used to be said for abc* d/e-. Consider only four arithmetic operations and the operation of input assumptions are a few decimal (0-9), and enter the suffix-free form expression syntax errors
    2023-07-12 10:50:03下载
    积分:1
  • window散列值还原工具,防查杀,非常好用的
    window散列值还原工具,防查杀,非常好用的-window hash value reduction tools, anti-De Bruin"s very handy
    2022-03-04 16:19:56下载
    积分:1
  • simple random password generation tools in their own applications using MS Offic...
    简单的随机密码生成工具 在自己的应用程序中使用MS Office功能-simple random password generation tools in their own applications using MS Office features
    2022-02-13 10:41:13下载
    积分:1
  • ae combined realize vb.net query functions in VS2005 achieved ae, 2
    ae结合vb.net实现的查询功能,在vs2005中实现的ae,2-ae combined realize vb.net query functions in VS2005 achieved ae, 2
    2022-03-06 11:54:56下载
    积分:1
  • LibGC is a thread
    Portable thread-based garbage collection library, for C-LibGC is a thread-based garbage-collection library with the following features: thread-based garbage collection. precise collection. uses the mark & sweep algorithm. portable uses no low-level O/S-specific features. no dependencies headers only. weak pointers. garbage-collected strong and weak arrays. customizable garbage collection with user-defined finalize and mark callbacks. wrapper class for non-garbage-collected classes.
    2022-12-23 06:05:03下载
    积分:1
  • 696516资源总数
  • 106405会员总数
  • 10今日下载