Location:
Search - ssdt kernel
Search list
Description: 隐藏文件，注册表，端口，内核的ROOTKIT！-hidden documents, the registry, port, the kernel of ROOTKIT!
Platform: |
Size: 36864 |
Author: 于皓 |
Hits:
Description: DELPHI恢复SSDT源码
有搞这方面的人可以学习一下-DELPHI source SSDT has engaged in the restoration of this area can learn about
Platform: |
Size: 439296 |
Author: lianx |
Hits:
Description: 对付ring0 inline hook的基本思路是这样的，自己写一个替换的内核函数，以NtOpenProcess为例，就是 MyNtOpenProcess。然后修改SSDT表，让系统服务进入自己的函数MyNtOpenProcess。而MyNtOpenProcess要做的事就是，实现NtOpenProcess前10字节指令，然后再JMP到原来的NtOpenProcess的十字节后。这样NtOpenProcess 函数头写的JMP都失效了，在ring3直接调用OpenProcess再也毫无影响。-Ring0 inline hook to deal with the basic idea is that the replacement of their own to write a kernel function to NtOpenProcess for example, is MyNtOpenProcess. And then amend the SSDT table, so that system services into its own function MyNtOpenProcess. And MyNtOpenProcess to do is realize NtOpenProcess the first 10-byte instruction, and then JMP to the original NtOpenProcess the Cross Festival. This NtOpenProcess function of the JMP are the first to write a lapse in ring3 no longer directly call OpenProcess no impact.
Platform: |
Size: 3072 |
Author: sdlylz |
Hits:
Description: 再谈内核及进程保护，利用hook掉系统ssdt保护进程的例子。-Return to the kernel and the process of protection, the use of SSDT hook off system to protect the process of example.
Platform: |
Size: 6144 |
Author: 好好的 |
Hits:
Description: 内核级进程监控源码,
1.可以通过指定监控进程名的形式来禁止指定进程的运行.
2.可以实时监控本机哪些进程正在创建,运行等等
程序通过挂载SSDT实现-Kernel-level process monitoring source, 1. Can monitor the process by specifying the form name to prohibit the operation of the specified process. 2. Can be real-time monitoring of the machines which process is the creation, operation procedures and so on through the mount SSDT realize
Platform: |
Size: 123904 |
Author: ViskerWong |
Hits:
Description: 1.恢复shadow ssdt
2.恢复
NtReadVirtualMemory
NtWriteVirtualMemory
NtOpenProcess
NtOpenThread
KiAttachProce-1.恢复shadow ssdt
2.恢复
NtReadVirtualMemory
NtWriteVirtualMemory
NtOpenProcess
NtOpenThread
KiAttachProcess
Platform: |
Size: 300032 |
Author: 傅碧波 |
Hits:
Description: Windows内核态SSDT-hook实现进程隐藏和文件隐藏，代码很规整，学习内核编程的好例子 -a good example of studying kernel programing or driver developing,
SSDT hook
Platform: |
Size: 5120 |
Author: goodone |
Hits:
Description: 创建一个内核驱动，伪造一个ssdt表，使得ssdt钩子失效。-Create a kernel driver, forged a ssdt table, making failure ssdt hook.
Platform: |
Size: 72704 |
Author: john smith |
Hits:
Description: A rootkit detector that allows you to remove the SSDT hooks maden in the OS kernel.
Platform: |
Size: 1481728 |
Author: pedrailla |
Hits:
Description: 本文从难易程度上主要分三块详细介绍：一．用户模式Hook:IAT-hook,Dll-inject 二．内核模式Hook:ssdt-hook,idt-hook,int 2e/sysenter-hook 三．Inline Function Hook -In this paper, Difficulty Level 3 detail the main points: 1. User Mode Hook: IAT-hook, Dll-inject 2. Kernel-mode Hook: ssdt-hook, idt-hook, int 2e/sysenter-hook 3. Inline Function Hook
Platform: |
Size: 14336 |
Author: lee |
Hits:
Description: Writing drivers to perform kernel-level SSDT hooking
Platform: |
Size: 1211392 |
Author: Oleg |
Hits:
Description: 一个类似icesword的东西,驱动级,有显示进程、内核模块、启动组、SSDT、消息钩子、等功能。-A similar icesword things, drive level, showing the process, the kernel module, start the group, SSDT, news hooks, and other functions.
Platform: |
Size: 748544 |
Author: 刘昆 |
Hits:
Description: 驱动层搜索内连HOOK,查看SSDT中的内核函数的开头是否被内连HOOK-Search within driving layer with HOOK, see SSDT in the beginning of the kernel function is to be in with HOOK
Platform: |
Size: 345088 |
Author: 王海 |
Hits:
Description: Windows XP是通过sysenter调用KiFastCallEntry将ntdll.dll的调用切换到内核的。KiFastCallEntry的原理是通过在SSDT中查找函数地址跳转。所以只要伪造一张原始SSDT，就可以使得SSDT-HOOK无效了。-Windows XP by calling KiFastCallEntry sysenter ntdll.dll call will switch to the kernel. KiFastCallEntry SSDT principle is to find the function by address jump. So long as the original forged an SSDT, you can make SSDT-HOOK invalid.
Platform: |
Size: 5120 |
Author: 何耀彬 |
Hits:
Description: 1、息钩子监视：列举系统上的消息钩子。
2、块加载监视：列举系统上加载的所有内核模块
3、SSDT监视：通过得到原始的SSDT地址来得到被恶意程序HOOK的API以及恢复SSDT
4、注册表保护：对一些重要的注册表项进行保护，防止恶意程序对其进行修改。
5、隐藏进程检测：检测出系统中隐藏的进程。
6、隐藏端口检测：检测出系统中隐藏的端口。
7、进程强杀：能够杀死系统中的对自身保护的恶意进程。-1, the interest rate hook monitoring: list of system messages on the hook. 2, block load monitoring: list of all the system loads the kernel modules 3, SSDT Monitor: SSDT get the original address to get the API HOOK malicious program and restore SSDT 4, registry protection: some important registry item for protection against malicious programs modify. 5, the hidden process detection: detection of hidden system process. 6, hidden port detection: the system detected the hidden port. 7, strong kill the process: the system can kill self-protection against malicious processes.
Platform: |
Size: 3553280 |
Author: 虫子 |
Hits:
Description: ZwOpenProcess SSDT Hook test to catch open process information.
Compile it with Meerkat Advanced kernel mode driver GUI for KmdKit4D.
Link: http://www.mediafire.com/?hbhjorv8797k2-ZwOpenProcess SSDT Hook test to catch open process information.
Compile it with Meerkat Advanced kernel mode driver GUI for KmdKit4D.
Link: http://www.mediafire.com/?hbhjorv8797k2ee
Platform: |
Size: 2048 |
Author: STRELiTZIA |
Hits:
Description: 驱动编写SSDT恢复工具，对于研究系统内核有很大帮助。-SSDT restore driver development tools, kernel for the study of great help.
Platform: |
Size: 518144 |
Author: lihui |
Hits:
Description: 这是描述Windows内核的学习资料。讲解SSDT的原理以及使用方法。-This is the description of Windows kernel learning materials. SSDT explain the principle and use it.
Platform: |
Size: 152576 |
Author: |
Hits:
Description: SSDT的全稱是System Services Descriptor Table，系統服務描述符表。這個表就是一個把ring3的Win32 API和ring0的內核API聯繫起來。SSDT並不僅僅只包含一個龐大的位址索引表，它還包含著一些其他有用的資訊，諸如位址索引的基底位址、服務函數個數等。
通過修改此表的函數位址可以對常用windows函數及API進行hook，從而實現對一些關心的系統動作進行過濾、監控的目的。一些HIPS、防毒軟體、系統監控、註冊表監控軟體往往會採用此介面來實現自己的監控模組，
目前極個別病毒確實會採用這種方法來保護自己或者破壞防毒軟體，但在這種病毒進入系統前如果防毒軟體能夠識別並清除它將沒有機會發作.
-SSDT s full name is System Services Descriptor Table, the system service descriptor table. This is a table of the Win32 API and ring0 ring3 kernel API link. SSDT is not only a huge address contains only the index table, it also contains some other useful information, such as the address of the index base address, the number of functions and other services.
Function by modifying the address of this table can be used for windows functions and API hook, in order to achieve the action of some concern to filter systems, surveillance purpose. Some HIPS, antivirus software, system monitoring, registry monitoring software often uses this interface to implement its own monitoring module,
At present very few virus does use this method to protect themselves or to destroy anti-virus software, but if the virus before the antivirus software into the system and clear it will not be able to identify opportunities to attack.
Platform: |
Size: 335872 |
Author: 小明 |
Hits:
Description: 详解系统服务描述符表，即SSDT。作用是把ring3的win32 api和ring0的内核api联系起来-Detailed system service descriptor table, the SSDT. Role is to the win32 api and ring0 ring3 kernel api link
Platform: |
Size: 36864 |
Author: 杨阳 |
Hits: