通过　HOOK　PsCreateSystemThread　监控线程，入口函数特征码对比来过hs防护软件的保护，asm源码非常不错-HOOK PsCreateSystemThread through the monitoring thread, imported function signature hs been compared to the protection of protective software, asm source code is very good

这是一款可以修改进程内存特征码的程序，非常小巧。-This is a process you can modify the signature of program memory, very small.

基于api hook技术的未知病毒检测工具，可以用来学习。使用api hook工具获取刻意进程的api 序列，以api短序为特征输入svm进行识别。-Api hook technique based on the unknown virus detection tool to learn. Tools for use api hook api deliberate process sequence to a short sequence featuring api import svm for