搜索资源列表
IATroot
- IATroot为一款以Hook IAT表中的输入函数为基础的一款RootKit，功能比较完整，其中自带一个Native API的开发库及源代码。-IATroot Hook to one to table the IAT input function-based one RootK it, more functional integrity, which own a Native API development libraries and source code.
SDTrestore
- Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descr iptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behavio
HookNativeApi
- Hook Native API Method
SDTRestore
- Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descr iptor Table (SDT). Such modification ensures that a replacement
inline-hook
- 1． Hook之前的准备工作之一。 在这个软件中，总共hook了15个native api 函数。他们分别是： ZwOpenKey , ZwClose, ZwQueryValueKey, ZwDeleteKey, ZwSetValueKey, ZwCreateKey, ZwDeleteValueKey. ZwEnumerateValueKey,ZwRestoreKey, ZwReplaceKey, ZwTerminateProcess, ZwSetSecurityObject, Zw
XueTr
- 1.进程、线程、进程模块、进程窗口、进程内存信息查看，热键信息查看，杀进程、杀线程、卸载模块等功能 2.内核驱动模块查看，支持内核驱动模块的内存拷贝 3.SSDT、Shadow SSDT、FSD、KBD、TCPIP、IDT信息查看，并能检测和恢复ssdt hook和inline hook 4.CreateProcess、CreateThread、LoadImage、CmpCallback、BugCheckCallback、Shutdown、Lego等Notify Routine信息查
SSDTHookTest
- SSDT Hook 简单示例 Hook Native Api ZwQuerySystemInformation 达到隐藏cmd.exe进程的效果，进程名没有大小写限制。(学习agony RootKit的成果)-The SSDT Hook, Native Api the ZwQuerySystemInformation native API to hide the effects of the cmd.exe process, process name is not a case limit.
HookIAT
- IATroot为一款以Hook IAT表中的输入函数为基础的一款RootKit，功能比较完整，其中自带一个Native API的开发库及源代码。-IATroot Hook to one to table the IAT input function-based one RootK it, more functional integrity, which own a Native API development libraries and source code.