Location:
Search - hook read
Search list
Description: 驱动类 rootkit HOOK注册表读取-driven category rootkit HOOK read registry
Platform: |
Size: 6637 |
Author: ll |
Hits:
Description: serial hoook trace,read and write
Platform: |
Size: 347070 |
Author: kingdjf@gmail.com |
Hits:
Description: 这是我看了一位朋友用c++ builder写的dll部分的代码后,自己用vc++6.0写的完整的窗口化外挂,目的只有一个就是满足渴望学习外挂制作的朋友的愿望,我也是刚开始写外挂,写的不好的地方还请包涵,我们大家多多交流交流. 附件说明: 国人当自强.rar是界面程序,负责启动和hook奇迹. ChinarenMU.rar是dll源程序,-This a friend I have read with c builder wrote dll part of the code after they used vc 6.0 wrote the integrity of the external window, only purpose is to satisfy a desire to learn the production of external friends wish, and I have only just started writing pieces and write bad things also requested tolerance, we interact more exchanges. Annex Note : When people self-improvement. rar procedures interface is responsible for initiating and hook miracle. ChinarenMU.rar is dll source,
Platform: |
Size: 59392 |
Author: 共同不 |
Hits:
Description: 為方便用photoshop時候寫的小工具 ,獲取鼠標任意點的顏色 ,并取得此顏色的RGB / CYMK /HEX 值 , 還有如何實現透明窗體,是做網頁取色的好工具 , 不過取星號密碼的功能我就沒有加入了,看過很多vb文章都不能取得開啟網頁時候的*號密碼(WIN2K) ,只能通過全局hook實現 ,哪位大哥知道 ,幫忙告知 !感激不禁..Email : pcbate.2@gbmgroup.com.cn-used photoshop to facilitate the time to write small tools, access to arbitrary point of the mouse color, this made and the color of RGB/CYMK/HEX value, and how to achieve transparent windows, do Homepage on the Internet is a good tool for color, but from asterisk password function, I would not have joined the have read many articles vb not have time for the opening of the website* Password (WIN2K) only through the realization of the overall situation hook, Which brother know that this help! gratitude can not help .. Email : pcbate.2 @ gbmgroup.com.cn
Platform: |
Size: 19456 |
Author: 曉風 |
Hits:
Description: 驱动类 rootkit HOOK注册表读取-driven category rootkit HOOK read registry
Platform: |
Size: 6144 |
Author: ll |
Hits:
Description: 利用钩子函数截取键盘消息，并读出按下的键对应的字母，是个不错的学习hook的样板程序。-use of the keyboard hook function interception of information, and read out the keys by pressing the corresponding letter. is a good model for studying the hook procedures.
Platform: |
Size: 470016 |
Author: 王维杰 |
Hits:
Description: QQ尾巴的DLL程序，里面实现了HOOK QQ主程序的功能，代码不多，简单易懂-QQ tail of the DLL procedure, which achieved the main program HOOK QQ function, the code small, easy-to-read
Platform: |
Size: 37888 |
Author: paulwang |
Hits:
Description: 开始，运行输入 sigverif
通过检查数字签名就知道是不是ms的了。
主要使用Win32API实现验证应用或驱动程
WinVerifyTrust API。如果该API被Hook有没有其他方法验证应用或驱动程序是否通过微软签名？如果仅仅是被挂钩了IAT，那么可以直接通过函数指针调用。
如果是像Detours那样用jmp改写了函数头，可以通过读取WinTrust.dll中WinVerifyTrust的实现位置，恢复函数头的机器码。
不知道使用CryptoAPI，再使用指定的Microsoft证书
是不是更好一点，不容易被欺骗
怕调api被hook的话，自己将验证的代码写出来，用openssl应该容易点。-Start, Run enter sigverif by checking the digital signature is not on the know of the ms. Win32API realize the main use of the application or driver to verify WinVerifyTrust API. If the API was Hook has no other way to verify whether the application or driver through Microsoft Signed? If merely being linked to the IAT, you can call directly through the function pointer. If it is used as the Detours as to alter the function jmp head, can be read in WinVerifyTrust Wintrust.dll realize the location, the restoration of function of the binary header. Do not know the use of CryptoAPI, and then use the specified certificate is not Microsoft a little better, not easy to be deceived by fear api tune hook, then he would write the code to verify, using openssl should be easy points.
Platform: |
Size: 200704 |
Author: 齐欢乐 |
Hits:
Description: 钩子与API截获,usb端口监听根据需要对U盘进行读写-Hooks and API interception, usb port monitor in accordance with the need for disk read and write U
Platform: |
Size: 519168 |
Author: yangj |
Hits:
Description: 修改过的filespy驱动
移植了tooflat部分代码到filespy中,hook 了write 和read ,加密标记还没有处理好.
-Revised filespy drive transplant tooflat part of the code to filespy in, hook the write and read, encryption tags yet a good deal.
Platform: |
Size: 406528 |
Author: sdf |
Hits:
Description: 实现键盘钩子算法，可以屏蔽任意键，CTRL+ATL+DEL、开机启动、关机程序等功能，具体请看源代码，这是个动态库。-Algorithm realize the keyboard hook, you can shield any key, CTRL+ ATL+ DEL, start-up, shutdown procedures, and other features, details, please read the source code, this is a dynamic library.
Platform: |
Size: 11264 |
Author: 冯柯 |
Hits:
Description: 内存空间不能跨进程访问的原因主要在于不同进程都有自己的页目录和页表。进程切换的很大一块也就是切换掉页目录。
Windows自己的ReadProcessMemory最终也是通过KeStackAttachProcess附加到目标进程空间执行拷贝的。但是中间的N个内核函数调用现在被很多保护系统Hook掉并保护起来了，所以要通过这层层关卡读到东西还是不那么简单的。-Inter-process memory space should not visit the main reason is because a different process has its own page directory and page table. The process of switching is a big switch off pages directory. Windows own ReadProcessMemory ultimately KeStackAttachProcess attached to the target through the process of implementation of copy space. However, N Central core function call is now a lot of protection systems and protect up Hook off, so going to pass this, each having something to read or not as simple as that.
Platform: |
Size: 2048 |
Author: sdlylz |
Hits:
Description: 一个简单的键盘Hook，简单易懂，非常实用。
-A simple keyboard Hook, easy-to-read, very practical.
Platform: |
Size: 2048 |
Author: STRENGS |
Hits:
Description: 这是我写的一个魔兽私服登陆器源码，我相信看了里面的代码你一定可以写出自己的私服登陆器-This is what I wrote a Warcraft私服landers source, I believe that you have read the code inside will be able to write their own私服landers
Platform: |
Size: 8616960 |
Author: 王法 |
Hits:
Description: C#hook一个实例，简单易懂，由此可以开始练习使用HOOK-An example of C# hook, easy-to-read, it can begin to practice using the HOOK
Platform: |
Size: 4096 |
Author: wj |
Hits:
Description: hookLIBRARY Hook
EXPORTS
SetHook @2
SEGMENTS
MySec READ WRITE SHARED
-LIBRARY Hook
EXPORTS
SetHook @2
SEGMENTS
MySec READ WRITE SHARED
Platform: |
Size: 14336 |
Author: 灵川 |
Hits:
Description: hook read/write process memory
本程序可以监视一些进程外的内存操作行为。可以用来分析某些内存修改器，内存补丁的动作。
附上VC6源代码，hookapi核心部分用的使用detours库，不懂可以baidu一下
作者：毕飞-hook read/write process memory of the program can monitor the operation of some process of memory behavior. Can be used to analyze changes in some memory devices, memory patch action. Attached VC6 source code, hookapi the use of detours with the core library, do not know what could be baidu Authors: Fei Bi
Platform: |
Size: 93184 |
Author: 123 |
Hits:
Description: 本人自写 Hook Terminate 函数
也不能算是Hook 看了你就知道
-Since I write Hook Terminate function can not be regarded Hook read you know
Platform: |
Size: 7168 |
Author: 自行车 |
Hits:
Description: delphi hook内存读写,可以拦截其他程序的读写操作以及读写数据,比如有些外挂可以用此工具找出他对游戏的具体操作,从而自己可以写一个功能和他一样的外挂出来-delphi hook memory read and write, can intercept and read and write operations of other programs to read and write data, for example, some plug-in can use this tool to find out his specific operation of the game, so they can write a function like him out of the plug-in
Platform: |
Size: 48128 |
Author: wangyong |
Hits:
Description: 文件过滤驱动，File filter driver intercepts file functions include copy, move, Read, Write, and get the file information, and so on. -File system driver.-File filter driver intercepts file functions include copy, move, Read, Write, and get the file information, and so on.-File system driver.
Platform: |
Size: 459776 |
Author: 老孙 |
Hits: