搜索资源列表
RestoreShadow.rar
- Ring0下恢复SSDT Shadow。,Restore SSDT Shadow.
kernel-reload
- 这份是重载内核，知道重载内核能干什么了，基本所有的ssdt和shadow ssdt都能恢复，神马hook之类的弱爆了-This is overloaded kernel know to reload the kernel can do the basic the all ssdt and shadow ssdt, will recover, of Shenma hook like a weak burst
SSDT-Shadow-Hook
- Hook 了以下函数: NtUserFindWindowEx FindWindow NtUserGetForegroundWindow GetForegroundWindow NtUserQueryWindow GetWindowThreadProcessId NtUserWindowFromPoint WindowFromPoint NtUserBuildHwndList EnumWindows NtUserSetWindowLong SetWindowLong
antiTX
- 1.恢复shadow ssdt 2.恢复 NtReadVirtualMemory NtWriteVirtualMemory NtOpenProcess NtOpenThread KiAttachProce-1.恢复shadow ssdt 2.恢复 NtReadVirtualMemory NtWriteVirtualMemory NtOpenProcess NtOpenThread KiAttachProcess
SafeRun_Up
- Shadow SDT的应用，可以保护被运行的程序的窗口不被关闭。-Shadow SDT applications can be running programs to protect the window from being closed.
Ring0RestoreSSDTShadow
- Ring0下恢复SSDT Shadow,是一个完整的VC工程，可以学习学习。-Ring0 resume SSDT Shadow
sw_remove
- shadow walker remove
CCRootkit-V0.1
- 一般网上找到的都是需要Ring3传输需要补丁的地址过去... 002就是直接用最标准的方法进行SSDT定位以及修复的 支持多核系统,当然还有003(加入shadow ssdt hook),004(加入inline hook) 基本上是现在最稳定的恢复方式了,大家可以用KMDLoader测试.加载就脱钩.不需要通讯 -Generally find on the Internet are required Ring3 address transmission needs a patc
UTM4XP
- 一个简单ARK源码。包括进线程操作，隐藏进程检测，SSDT,SHADOW SSDT hook查看-An anti-rookit tool
HOOK
- SSDT 及 SSDT Shadow HOOK通用框架及保护模块-SSDT and the SSDT Shadow HOOK common framework and protection module
shadow-ssdt
- 遍历shadow ssdt 的代码 会win窗体HOOK 很有帮助-Traverse shadow ssdt code will win form HOOK helpful
omega48-code
- windows 平台下的虚拟打印机驱动程序。-Omega48 is a virtual printer driver for Microsoft Windows which allows you to convert the document to the graphics formats such as EMF, BMP and non formated text file (UNICODE or ANSI). Omega48 allows to save MS Windows Spool (