Location:
Search - csrss
Search list
Description: 最近整理文档，发现以前写的《如何在NT下获取进程的路径》一文中还有个问题没有解决：原文中的程序无法获取系统进程的路径，如：csrss.exe。记得VCKBASE上有位网友说过一个方法：“给枚举的进程增加SE_DEBUG_NAME权限即可”，于是在网上找了些资料，解决了原文中的问题。-recent collating documents, written in the past found "in the process of obtaining NT Path," a still-unresolved question : from the original procedures do not have access to the trails system processes, such as : Verify. Remember VCKBASE on-one netizen said : "The enumeration process to increase SE_DEBUG_NAME authority can," and so on the Internet to find the information, to solve the original problem.
Platform: |
Size: 4425 |
Author: 刘珍 |
Hits:
Description: 最近整理文档，发现以前写的《如何在NT下获取进程的路径》一文中还有个问题没有解决：原文中的程序无法获取系统进程的路径，如：csrss.exe。记得VCKBASE上有位网友说过一个方法：“给枚举的进程增加SE_DEBUG_NAME权限即可”，于是在网上找了些资料，解决了原文中的问题。这里要特别感谢那位名叫rovershen的网友！
GIF图象是基于颜色列表的（存储的数据是该点的颜色对应于颜色列表的索引值），最多只支持8位（256色）。GIF文件内部分成许多存储块， 用来存储多幅图象或者是决定图象表现行为的控制块， 用以实现动画和交互式应用。GIF文件还通过LZW压缩算法压缩图象数据来减少图象尺寸。
-recent collate documents, found previously wrote "how the acquisition process NT path," he also has a problem that has not been resolved : text of the procedures do not have access to the trails system processes, such as : csrss.exe. Remember that there are spaces VCKBASE said a netizen : "Enumerate to the process can increase SE_DEBUG_NAME competence", so the Internet to find the information, solve the original problem. Special thanks here to rovershen who named the netizens! GIF image is based on the color of the table (data storage is the point corresponding to the color of the color value of the index list), only support a maximum of eight (256 colors). GIF documents into many internal storage block, used to store more images, or images performance is to decide the
Platform: |
Size: 4522 |
Author: 孙乾坤 |
Hits:
Description: ProcessKiller_Ver1
简要介绍：
通过提升当前进程的权限，获得SEDEGUG特权，
然后就可以杀掉当前系统中的高级别进程，
经测试，除：System Idel,System和Csrss三个进程无法杀掉外，
其他进程均可杀掉。
双击列表中的相应进程可以查看进程的所有模块列表。
-ProcessKiller_Ver1 briefed : upgrading the competence of the current process. SEDEGUG access privileges, then we can kill the current system of high-level process, tested, except : System Idel, System 3 and Csrss unable to kill the process, other processes can be executed. Double-click links to the corresponding process can view the process all modules list.
Platform: |
Size: 25272 |
Author: alaplay |
Hits:
Description: 在NT下获取进程的路径
给枚举的进程增加SE_DEBUG_NAME权限,获取系统进程的路径，如：csrss.exe
在WindowsXP + C++Builder6.0开发环境下通过。
Platform: |
Size: 19359 |
Author: 冷云子 |
Hits:
Description: 可以通过提权来结束大多数进程，system 、csrss除外
Platform: |
Size: 2565 |
Author: tyf |
Hits:
Description: 最近整理文档，发现以前写的《如何在NT下获取进程的路径》一文中还有个问题没有解决：原文中的程序无法获取系统进程的路径，如：csrss.exe。记得VCKBASE上有位网友说过一个方法：“给枚举的进程增加SE_DEBUG_NAME权限即可”，于是在网上找了些资料，解决了原文中的问题。-recent collating documents, written in the past found "in the process of obtaining NT Path," a still-unresolved question : from the original procedures do not have access to the trails system processes, such as : Verify. Remember VCKBASE on-one netizen said : "The enumeration process to increase SE_DEBUG_NAME authority can," and so on the Internet to find the information, to solve the original problem.
Platform: |
Size: 18432 |
Author: 刘珍 |
Hits:
Description: 最近整理文档，发现以前写的《如何在NT下获取进程的路径》一文中还有个问题没有解决：原文中的程序无法获取系统进程的路径，如：csrss.exe。记得VCKBASE上有位网友说过一个方法：“给枚举的进程增加SE_DEBUG_NAME权限即可”，于是在网上找了些资料，解决了原文中的问题。这里要特别感谢那位名叫rovershen的网友！
GIF图象是基于颜色列表的（存储的数据是该点的颜色对应于颜色列表的索引值），最多只支持8位（256色）。GIF文件内部分成许多存储块， 用来存储多幅图象或者是决定图象表现行为的控制块， 用以实现动画和交互式应用。GIF文件还通过LZW压缩算法压缩图象数据来减少图象尺寸。
-recent collate documents, found previously wrote "how the acquisition process NT path," he also has a problem that has not been resolved : text of the procedures do not have access to the trails system processes, such as : csrss.exe. Remember that there are spaces VCKBASE said a netizen : "Enumerate to the process can increase SE_DEBUG_NAME competence", so the Internet to find the information, solve the original problem. Special thanks here to rovershen who named the netizens! GIF image is based on the color of the table (data storage is the point corresponding to the color of the color value of the index list), only support a maximum of eight (256 colors). GIF documents into many internal storage block, used to store more images, or images performance is to decide the
Platform: |
Size: 18432 |
Author: 孙乾坤 |
Hits:
Description: ProcessKiller_Ver1
简要介绍：
通过提升当前进程的权限，获得SEDEGUG特权，
然后就可以杀掉当前系统中的高级别进程，
经测试，除：System Idel,System和Csrss三个进程无法杀掉外，
其他进程均可杀掉。
双击列表中的相应进程可以查看进程的所有模块列表。
-ProcessKiller_Ver1 briefed : upgrading the competence of the current process. SEDEGUG access privileges, then we can kill the current system of high-level process, tested, except : System Idel, System 3 and Csrss unable to kill the process, other processes can be executed. Double-click links to the corresponding process can view the process all modules list.
Platform: |
Size: 79872 |
Author: alaplay |
Hits:
Description: 在NT下获取进程的路径
给枚举的进程增加SE_DEBUG_NAME权限,获取系统进程的路径，如：csrss.exe
在WindowsXP + C++Builder6.0开发环境下通过。-In the NT under the access path to the enumeration process, the process of increasing SE_DEBUG_NAME permissions, the process of acquisition system path, such as: csrss.exe in WindowsXP+ C++ Builder6.0 adopted under development environment.
Platform: |
Size: 19456 |
Author: 冷云子 |
Hits:
Description: 可以通过提权来结束大多数进程，system 、csrss除外-By mentioning the right to end the majority of the process, system, csrss except
Platform: |
Size: 2048 |
Author: tyf |
Hits:
Description: 详细的笔记。记截着如何注入到没有权限的CSRSS进程,但是注意一般不要注入到CSRSS要不然会蓝屏-Detailed notes. Remember how to cut into without permission CSRSS process, but generally do not pay attention or else will be injected into the blue screen CSRSS
Platform: |
Size: 217088 |
Author: kissjetg |
Hits:
Description: 三类2000系统进程总列表
最基本的系统进程（也就是说，这些进程是系统运行的基本条件，有了这些进程，系统就能正常运行）
smss.exe Session Manager
csrss.exe 子系统服务器进程 -The process of the three types of 2000 the total list of the most basic system processes (that is, these processes are the basic conditions for the system, with these processes, the normal operation of the system will) smss.exe Session Manager csrss.exe subsystem server process
Platform: |
Size: 2048 |
Author: |
Hits:
Description: 在Csrss.exe中，保存着所有Win32子系统进程的进程信息，这些信息以链表的形式保存。
正常情况下，每一个新创建的进程都会通知Csrss.exe，Csrss.exe接收这些信息然后保存起来，所以遍历这个链表就可以得到所有Win32子系统进程的信息。首先就是找链表头了，链表头为CsrssRootProcess，在CSRSRV.DLL导出的函数中有对CsrssRootProcess的操作，因此可以通过CSRSRV.DLL的导出函数找到CsrssRootProcess。
通过遍历这个链表就能取得进程信息-using csrss as rootkit detector, full source code included
Platform: |
Size: 36864 |
Author: Charles Lee |
Hits:
Description: 基于csrss进程信息的内核结构体的进程查看软件不同于一般方法-CsrssWalker
Platform: |
Size: 2022400 |
Author: 李伟 |
Hits:
Description: 发现以前写的《如何在NT下获取进程的路径》一文中还有个问题没有解决：原文中的程序无法获取系统进程的路径，如：csrss.exe。记得VCKBASE上有位网友说过一个方法：“给枚举的进程增加SE_DEBUG_NAME权限即可”，于是在网上找了些资料，解决了原文中的问题。-Found in previous book, " How to get the process under the NT path" article still does not solve the problem: the original program can not access the system in the path of the process, such as: csrss.exe. There are places I remember VCKBASE users a way to say: " to enumerate the process can increase the SE_DEBUG_NAME rights" , the Internet is some information to solve the text in question.
Platform: |
Size: 19456 |
Author: 陈程 |
Hits:
Description: 通过CSRSS进程 来枚举现有进程. 由易语言编写 希望你们喜欢-CSRSS process to enumerate through the existing process. By the Yi language I hope you like
Platform: |
Size: 3072 |
Author: 164894 |
Hits:
Description: Hook SSDT shadow 示例，首先找到csrss进程然后attach，最后修改ssdt shadow table-Hook SSDT shadow sample, first find the csrss process then attach, last modified ssdt shadow table
Platform: |
Size: 17408 |
Author: 顺口溜 |
Hits:
Description: 驱动级的隐藏进程---通过断链，PspCidTable,Csrss这几张表来实现进程的隐藏，源码可以直接编译！-HideProcess by driver ...
Platform: |
Size: 91136 |
Author: 魏林 |
Hits:
Description: csrss备份 可以用于csr备份可以用于csr 可以用于csrs备份 可(Csrss backup can be used for CSR backup, can be used for CSR, can be used for CSRs backup)
Platform: |
Size: 2737152 |
Author: dsass
|
Hits:
Description: x64注入csrss，破读写。内核级。。。。。。。。。。。。(X64 injection csrss, Podu writing. Kernel level)
Platform: |
Size: 8192 |
Author: xiaonianxi
|
Hits: