搜索资源列表
FU_Rootkit
- hide processes, elevate process privileges, fake out the Windows Event Viewer so that forensics is impossible, and even hide device drivers (NEW!) All this without any hooking.
hookN
- 国外收集的多个hook代码 Let s talk about kernel and drivers --- --- --- --- --- ----- Author: Holy_Father <holy_father@phreaker.net> / When you see the shadow, think about the light that causes it / Version: 1.0 english Birthday:
NtOpenProcess[InlineHook]
- r0 inline hook sample.
SSDT-HOOK
- XP下SSDT Hook ZwCreateThread的代码，仅适用于XP，由驱动和用户模式下控制程序组成，是从以前写的另一个程序修改过来的，所以代码中部分结构体的成员的定义是多余的，要写SSDT Hook的可以参考一下-XP, SSDT Hook ZwCreateThread code only applies to XP, drivers and user mode by the control program component is written in another program
Professional_Rootkits
- Professional rootkit Table of Contents Professional Rootkits Credits Introduction Chapter 1 - Tools Chapter 2 - A Basic Rootkit Chapter 3 - Kernel Hooks Chapter 4 - User Hooks Chapter 5 - I/O Processing Chapter 6
vice
- 能够找出给种类型的系统Hook,包括IAT表，SSDT表等相关的钩子-VICE is a tool to find hooks. Features include: 1. Looks for people hooking IAT s. 2. Looks for people hooking functions in-line aka detouring. 3. Looks for hooks in the System Call Table. Thanks to Tan perh
Uk362src
- Unikey is one of the most popular Vietnamese keyboard drivers. It supports several input types and Vietnamese character sets.
hook
- 驱动HOOK也不知道是不是 驱动HOOK也不知道是不是 -Drivers do not know whether HOOK
DriverTutorial
- Writing drivers to perform kernel-level SSDT hooking
DrvFltIp
- 防火墙过滤驱动，1) 一个创建设备的驱动程序入口，为通讯创建符号连接和处理IRPs(分派，加载，卸载，创建...)的标准例程。 2)在标准例程里管理IRPs.在我们的代码中，我们实现了四个IOCTL代码：START_IP_HOOK(注册过滤函数),STOP_IP_HOOK(注销过滤函数), ADD_FILTER(安装新的过滤规则),CLEAR_FILTER(清除所有规则). 3)对于我们的驱动，我们实现多个用于过滤的函数。 -Firewall filter dri
shielded-keyboard-and-mouse-
- 这是一个屏蔽键盘鼠标方法与实现技术简介： （1）全局键盘/鼠标钩子，对键盘和鼠标的消息进行屏蔽 （2）通过设备的GUID号来禁用设备 （3）通过禁用鼠标键盘的服务禁用鼠标键盘 （4）加载键盘鼠标驱动来控制键盘和鼠标，并禁用 -About shielded keyboard and mouse methods and implementation techniques Descr iption: (1) global keyboard/mouse hook, the keyboar
hide-files-by-drivers
- 隐藏文件的驱动程序，能较完整的展现过程，对学习hook技术有好处-hide files
blackreleaver-release
- BlackReleaver is a ring 0 rootkit that can hide files, processes, drivers, registry keys, and more. It uses an inline hook on many ring 0 functions.
FSFilter
- minfilter driver for testing other types of filter drivers for kernel level mods