Description: 查找进程，目录/文件，注册表等操作系统将最终调用
ZwQueryDirectoryFile，ZwQuerySystemInformation，ZwXXXvalueKey
等函数。要想拦截这些函数达到隐藏目的，需先自己实现以上函数，
并修改系统维护的一个 SYSCALL 表使之指向自己预先定义的函数。
因 SYSCALL 表在用户层不可见，所以要写 DRIVE 在 RING 0 下 才
可修改。-the search process, directories / files, the registry, such as the operating system will eventually call ZwQueryDirectoryFile, ZwQuerySystemInformation, ZwXXXvalueKey functions. To achieve these functions interception hidden purpose, the need to achieve over his first function, and modifying the system to maintain a SYSCALL table to make it at their pre-defined function. SYSCALL table for the user-visible, write DRIVE at RING 0 under any amendment. Platform: |
Size: 4060 |
Author:aaaa |
Hits:
Description: 检测windows下rootkit对文件的隐藏。some usermode overwrites first few bytes
of ZwQueryDirectoryFile and that trick will fail then :( So, you will
probably need a small database of the correct indexes for all Windows
versions-under rootkit detection windows of the hidden documents. Some usermode overwrites first few bytes of ZwQueryDirectoryFile and that trick will fail then : (So, you will probably need a small database of the correct indexes for all Windows versions Platform: |
Size: 16396 |
Author:libo |
Hits:
Description: 查找进程，目录/文件，注册表等操作系统将最终调用
ZwQueryDirectoryFile，ZwQuerySystemInformation，ZwXXXvalueKey
等函数。要想拦截这些函数达到隐藏目的，需先自己实现以上函数，
并修改系统维护的一个 SYSCALL 表使之指向自己预先定义的函数。
因 SYSCALL 表在用户层不可见，所以要写 DRIVE 在 RING 0 下 才
可修改。-the search process, directories/files, the registry, such as the operating system will eventually call ZwQueryDirectoryFile, ZwQuerySystemInformation, ZwXXXvalueKey functions. To achieve these functions interception hidden purpose, the need to achieve over his first function, and modifying the system to maintain a SYSCALL table to make it at their pre-defined function. SYSCALL table for the user-visible, write DRIVE at RING 0 under any amendment. Platform: |
Size: 4096 |
Author:aaaa |
Hits:
Description: 检测windows下rootkit对文件的隐藏。some usermode overwrites first few bytes
of ZwQueryDirectoryFile and that trick will fail then :( So, you will
probably need a small database of the correct indexes for all Windows
versions-under rootkit detection windows of the hidden documents. Some usermode overwrites first few bytes of ZwQueryDirectoryFile and that trick will fail then : (So, you will probably need a small database of the correct indexes for all Windows versions Platform: |
Size: 16384 |
Author:libo |
Hits:
Description: 该文档介绍了用NT驱动程序来拦截NTAPI来实现彻底隐藏文件和目录的目的。NT下有一个文件NTDLL.DLL，大部分NTAPI都是在这个库中封装的。其中实现查找文件和目录的API接口是ZwQueryDirectoryFile，所以我们只要拦截这个API的话，文件和目录就可以完全隐藏了！-This document describes the use of NT driver to intercept NTAPI to achieve completely hidden files and directories purposes. Under the NT has a file NTDLL.DLL, most NTAPI are in this library package. Find files and directories which achieved an API interface is ZwQueryDirectoryFile, so long as we intercept this API, then the files and directories can be completely hidden! Platform: |
Size: 9216 |
Author:yunhaitian |
Hits:
Search - ZwQueryDirectoryFile