Search - sdt hook

Search - sdt hook - List

[Driver Develop] dvKrnlData DL : 0: 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the driver. access to the kernel and sdt data, the information loop. And the achievement of the hook function to achieve NtQuerySystemInformation implicit process possession of the function
Date : 2008-10-13 Size : 53.89kb User : 左手
[Hook api] SDTrestore DL : 0: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behaviou r of the system by Native Kernel API hooking. Thi 's technique is typically implemented by modify ing the ServiceTable entries in the Service Des criptor Table (SDT). on the hook
Date : 2008-10-13 Size : 8.95kb User : wind
[Driver Develop] dvKrnlData DL : 0: 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the driver. access to the kernel and sdt data, the information loop. And the achievement of the hook function to achieve NtQuerySystemInformation implicit process possession of the function
Date : 2025-07-12 Size : 54kb User : 左手
[Hook api] SDTrestore DL : 0: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behaviou r of the system by Native Kernel API hooking. Thi 's technique is typically implemented by modify ing the ServiceTable entries in the Service Des criptor Table (SDT). on the hook
Date : 2025-07-12 Size : 9kb User : wind
[OS program] 0x48k-regbd DL : 0: Registry backdoor, restore sdt, hook NtEnumerateKey
Date : 2025-07-12 Size : 199kb User : crim
[SCM] SDTRestore DL : 0: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). Such modification ensures that a replacement (hook) function installed by a rootkit is called prior to the original native API. The replacement function usually calls the original native API and modifies the output before returning the results to the user-space program. This technique allows kernel rootkits to hide files, processes, and to prevent process termination. This proof-of-concept tool demonstrates the possibility of defeating such rootkits by removing Kernel Native APIs hooks and restoring the ServiceTable entries back to their original state.
Date : 2025-07-12 Size : 8kb User : Mimi
[OS program] SDT-Cleaner-v1.0---Stable-Version DL : 0: 用于检测SDT和恢复SDT的例子代码，可用于ARK中的系统钩子扫描-Example of code that can be used for detection to SDT and recovery of SDT ARK system hook scan
Date : 2025-07-12 Size : 237kb User : ansnap