Location:
Search - sdt hook
Search list
Description: 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the driver. access to the kernel and sdt data, the information loop. And the achievement of the hook function to achieve NtQuerySystemInformation implicit process possession of the function
Platform: |
Size: 55181 |
Author: 左手 |
Hits:
Description: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behaviou r of the system by Native Kernel API hooking. Thi 's technique is typically implemented by modify ing the ServiceTable entries in the Service Des criptor Table (SDT). on the hook
Platform: |
Size: 9167 |
Author: wind |
Hits:
Description: 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the driver. access to the kernel and sdt data, the information loop. And the achievement of the hook function to achieve NtQuerySystemInformation implicit process possession of the function
Platform: |
Size: 55296 |
Author: 左手 |
Hits:
Description: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behaviou r of the system by Native Kernel API hooking. Thi 's technique is typically implemented by modify ing the ServiceTable entries in the Service Des criptor Table (SDT). on the hook
Platform: |
Size: 9216 |
Author: wind |
Hits:
Description: Registry backdoor, restore sdt, hook NtEnumerateKey
Platform: |
Size: 203776 |
Author: crim |
Hits:
Description: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). Such modification ensures that a replacement (hook) function installed by a rootkit is called prior to the original native API. The replacement function usually calls the original native API and modifies the output before returning the results to the user-space program. This technique allows kernel rootkits to hide files, processes, and to prevent process termination.
This proof-of-concept tool demonstrates the possibility of defeating such rootkits by removing Kernel Native APIs hooks and restoring the ServiceTable entries back to their original state.
Platform: |
Size: 8192 |
Author: Mimi |
Hits:
Description: 用于检测SDT和恢复SDT的例子代码，可用于ARK中的系统钩子扫描-Example of code that can be used for detection to SDT and recovery of SDT ARK system hook scan
Platform: |
Size: 242688 |
Author: ansnap |
Hits: