Description: The hook, from ring3 there are many, ring3 to ring0 there are many, according to api call progressive sequence of links, each link in the opportunity to have a hook, you can have int 2e or sysenter hook, ssdt hook, inline hook, irp hook, object hook, idt hook, etc.
File list (Check if you may need any files):
| Filename | Size | Date |
|---|
| 2）ssdt hook |
| ............\2）ssdt hook.doc |
| ............\SSDT Hook的妙用－对抗ring0 inline hook .doc |
| ............\swk0207.rar |
| 3）inline-hook |
| ..............\360SuperKill学习之--恢复FSD的IRP处理函数.doc |
| ..............\3）inline-hook.doc |
| ..............\cnnic.rar |
| ..............\ExpLookupHandleTableEntry.rar |
| ..............\ExpLookupHandleTableEntry2.rar |
| ..............\kill_SecuritySoftware.rar |
| ..............\PsLookupProcessByProcessId执行流程学习笔记.doc |
| ..............\句柄啊，3层表啊，ExpLookupHandleTableEntry啊.doc |
| ..............\干掉KV 2008 | Rising等大部分杀软.doc |
| ..............\搜索未导出的函数地址.doc |
| 4）idt hook |
| ...........\bhwin_keysniff.rar |
| ...........\IDT Hook .doc |
Download