搜索资源列表
Hooking_the_kernel_directly
- 直接内核钩子。教你如何用C写内核函数钩子。文件里面包含了详细文档和代码。-direct kernel hook. Teach you how to write C kernel function hook. File includes detailed documentation and code.
SystemModulesSee
- 获得所有windows加载的内核模块信息。 一个不错的学习windows驱动程序和windows内核的代码。-access to all windows kernel module loading information. A good learning windows driver and windows kernel code.
hookN
- 国外收集的多个hook代码 Let s talk about kernel and drivers --- --- --- --- --- ----- Author: Holy_Father <holy_father@phreaker.net> / When you see the shadow, think about the light that causes it / Version: 1.0 english Birthday:
SDTrestore
- Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descr iptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behavio
hHooksZwQuerySystemInformation
- hHook 内核ntoskrnl sZwQuerySystemInformation隐藏任务管理器进程名-hHook kernel ntoskrnl sZwQuerySystemInforma tion task management device hidden from the process
startnt_Service
- Hooking the kernel directly
ProcessManager
- Process Manager [DKOM(Direct Kernel Object Manipulation) windows service pack 2
ObjectHook.code
- 内核OBJECT HOOK代码-大家可以-OBJECT HOOK kernel code- everyone can see
SSDT-hook
- Windows内核态SSDT-hook实现进程隐藏和文件隐藏，代码很规整，学习内核编程的好例子 -a good example of studying kernel programing or driver developing, SSDT hook
Professional_Rootkits
- Professional rootkit Table of Contents Professional Rootkits Credits Introduction Chapter 1 - Tools Chapter 2 - A Basic Rootkit Chapter 3 - Kernel Hooks Chapter 4 - User Hooks Chapter 5 - I/O Processing Chapter 6
anti-ssdt
- Windows XP是通过sysenter调用KiFastCallEntry将ntdll.dll的调用切换到内核的。KiFastCallEntry的原理是通过在SSDT中查找函数地址跳转。所以只要伪造一张原始SSDT，就可以使得SSDT-HOOK无效了。-Windows XP by calling KiFastCallEntry sysenter ntdll.dll call will switch to the kernel. KiFastCallEntry SSDT principle i
antihook_src
- 创建一个内核驱动，伪造一个ssdt表，使得ssdt钩子失效。-Create a kernel driver, forged a ssdt table, making failure ssdt hook.
kernel-Inline-Hook-word-doc
- kernel Inline Hook word doc 详谈内核三步走Inline Hook实现-kernel Inline Hook word doc go into the details to achieve core three-step Inline Hook
VB-Del-Kernel-Hook
- VB恢复内核钩子的一个示例工程文件。可以调试。-VB restore a core sample project file hook. For debugging.
reload-kernel
- 重载内核实现绕过一切钩子,内附源码，可编译，可测试-Reloading the kernel to realize all around hooks
hook-kernel-tut-1
- hook kernel tut 1, code in c++, build with wdk
hook-kernel-tut-2
- hook kernel tut 2, code in c++, build with wdk
hook-kernel-tut-4
- hook kernel tut 4, code in c++, build with wdk
hook-kernel-tut-5
- hook kernel tut 5, code in c++, build with wdk
hook-kernel-tut-3
- hook kernel tut 3, code in c++, build with wdk