搜索资源列表
dvKrnlData
- 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the
KernelExec
- 从RING0级下启动RING3级的应用程序源代码-from RING0 activated RING3-level application program source code
ParallelPortSys
- 通过在编写驱动程序现在在ring3级别可以直接返问并口端口，并编写了调用Dll，通过Dll可以很方便的返问底层驱动。-adopted in the preparation of the driver now ring3 levels can be asked directly back to the Parallel port, and the preparation of call Dll, Dll can conveniently back to the bottom driver aske
R3toR0
- 从RING3进入RING0的方法,不需要驱动
IDTGuard
- IDT Hook 检测及恢复 此程序在 Ring3 下打开物理内存对象取得当前内存中的 IDT，再用打开对应的原始内核文件进行比较。带恢复功能。 此程序适用于 XP/2003。采用特征码搜索方式查找。注释详细，代码规范
ExcpHookMonitor_0.0.4
- ExcpHook is an open source (see license.txt) Exception Monitor for Windows made by Gynvael Coldwind (of Team Vexillium). t uses a ring0 driver to hook KiExceptionDispatch procedure to detect the exceptions, and then shows information about the except
CheckHiddenFile
- 使用内核方法检测隐藏文件，包括ring0,ring3的代码。
FileIOMonitor
- SSDT拦截文件读写,提供接口供ring3通讯
CallRing3FormRing0
- 在Ring0层中调用Ring3层的功能 需要安装DDK-in Rign0 layer called Ring3 layer functions need to install DDK
r3_2_r0
- Windows2000 XP 从Ring3层进入Ring0层的一种方法-Windows XP Ring3 layer from the layer into Rign0 a way
Rootkit 内核hook 隐身术
- Rootkit 1。 内核hook 隐身术 ring0中调用ring3程序 其他
Ring3Drive
- Ring3下模拟NtSystemdebugControl实现驱动功能-Ring3 drive functions to achieve simulated NtSystemdebugControl
CheatEngine
- 这是一段游戏修改工具的源代码.ring3功能由dephi开发,驱动是C开发.希望对大家有帮助-This is game modification tools section of the source code. Ring3 features developed by Delphi, the drive is the C development. I hope all of you help
Packet_Analysis
- 基于Passthru的扩展，抓取IP数据包，并在内核中利用队列、系统线程实时将IP数据包解析到磁盘文件中,同时提供用户控制，在RING3使用SDK编写界面。 本程序可以帮助您熟悉驱动编写、windows编程、用户态和内核态交互编程以及网络知识的基础应用。 驱动安装使用snetcfg,已集成到用户界面中。-Based on the expansion of passthru, crawl IP packet, and the use of the kernel queue, the sys
Kehook
- 对于hook，从ring3有很多，ring3到ring0也有很多，根据api调用环节递进的顺序，在每一个环节都有hook的机会，可以有int 2e或者sysenter hook，ssdt hook，inline hook ，irp hook，object hook，idt hook-The hook, from ring3 there are many, ring3 to ring0 there are many, according to api call progressive sequen
delphi_PspTerminateProcess
- delphi版内核调用PspTerminateProcess杀进程源码,在ring3下搜索PspTerminateProcess地址，传给ring0,然后在ring0下调用。-delphi kernel call PspTerminateProcess kill the process, source code, in the next ring3 search PspTerminateProcess address, passed ring0, and then ring0 invoked.
CCRootkit-V0.1
- 一般网上找到的都是需要Ring3传输需要补丁的地址过去... 002就是直接用最标准的方法进行SSDT定位以及修复的 支持多核系统,当然还有003(加入shadow ssdt hook),004(加入inline hook) 基本上是现在最稳定的恢复方式了,大家可以用KMDLoader测试.加载就脱钩.不需要通讯 -Generally find on the Internet are required Ring3 address transmission needs a patc
superhidedll
- 这是一个隐藏进程中DLL的代码，效果还不错的，基本上能过的都过了(ring3断一下Ldr都过一大堆了)-This is a hidden process in the DLL code, the results were good, and basically can ever have passed (ring3 off what had been a lot of the Ldr)
IoControl
- 一个与驱动进行通信的RING3控制台软件，基本流程都有，适合初学者！下载后 只要读懂源码，扩展是非常方便的-Communicate with the driver of a RING3 console software, the basic processes are suitable for beginners! Download as long as the read source code, expansion is very convenient
RING3TORING0
- Ring3通过内核插件动态调用内核函数,有源码，BIN，是个学习驱动的好源码-Ring3 dynamic invocation by kernel plug-in kernel functions, there is source code, BIN, is a good source to learn driving