http://blog.csdn.net/cdrea/我不苟同你的思想，但是我绝对捍卫你思想的自由。zh-CNWed, 16 Aug 2006 20:31:34 GMT60CDreahttp://blog.csdn.net/CDrea/archive/2006/05/30/764022.aspxTue, 30 May 2006 17:43:00 GMThttp://blog.csdn.net/CDrea/archive/2006/05/30/764022.aspxhttp://blog.csdn.net/cdrea/comments/764022.aspxhttp://blog.csdn.net/CDrea/archive/2006/05/30/764022.aspx#Feedback3http://blog.csdn.net/cdrea/comments/commentRss/764022.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=764022利用 TDI HOOK 实现任意端口复用<img src ="http://blog.csdn.net/cdrea/aggbug/764022.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/04/06/652189.aspxThu, 06 Apr 2006 00:19:00 GMThttp://blog.csdn.net/CDrea/archive/2006/04/06/652189.aspxhttp://blog.csdn.net/cdrea/comments/652189.aspxhttp://blog.csdn.net/CDrea/archive/2006/04/06/652189.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/652189.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=652189Recently, Some friend complained to me that their rootkit driver had been killed by anti-virus software like McAfee and Nod32.So I began to find why. http://www.rootkit.com/newsread.php?newsid=101<img src ="http://blog.csdn.net/cdrea/aggbug/652189.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/04/05/652174.aspxWed, 05 Apr 2006 23:54:00 GMThttp://blog.csdn.net/CDrea/archive/2006/04/05/652174.aspxhttp://blog.csdn.net/cdrea/comments/652174.aspxhttp://blog.csdn.net/CDrea/archive/2006/04/05/652174.aspx#Feedback1http://blog.csdn.net/cdrea/comments/commentRss/652174.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=652174As many of you will know, hooking functions not exported by ntoskrnl.exe is a real pain, as you need to hard code their position in KeServiceDescriptorTable, and this will change between windows releases.<img src ="http://blog.csdn.net/cdrea/aggbug/652174.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/04/05/652141.aspxWed, 05 Apr 2006 23:19:00 GMThttp://blog.csdn.net/CDrea/archive/2006/04/05/652141.aspxhttp://blog.csdn.net/cdrea/comments/652141.aspxhttp://blog.csdn.net/CDrea/archive/2006/04/05/652141.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/652141.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=652141This is the second and last article on how to hook into the NDIS and TDI layer. The approach we will use will be slightly different from the NDIS case. However, a neat side effect is that this method can be used to hook into any device chain, for example the keyboard to sniff key strokes. It all boils down to getting a pointer to the device object and replace all major functions with our own dispatch function. <img src ="http://blog.csdn.net/cdrea/aggbug/652141.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/04/05/652138.aspxWed, 05 Apr 2006 23:15:00 GMThttp://blog.csdn.net/CDrea/archive/2006/04/05/652138.aspxhttp://blog.csdn.net/cdrea/comments/652138.aspxhttp://blog.csdn.net/CDrea/archive/2006/04/05/652138.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/652138.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=652138This is the fist part in a series of 2 articles on how to hook into the NDIS and TDI layer. In this first one, we will discuss where and how to hook in to the NDIS layer. <img src ="http://blog.csdn.net/cdrea/aggbug/652138.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/04/05/650999.aspxWed, 05 Apr 2006 04:01:00 GMThttp://blog.csdn.net/CDrea/archive/2006/04/05/650999.aspxhttp://blog.csdn.net/cdrea/comments/650999.aspxhttp://blog.csdn.net/CDrea/archive/2006/04/05/650999.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/650999.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=650999This article was released in the Uninformed Journal Vol 3. It is important to remember that this article displays Proof of Concept (POC) ideas and code. FUTo may result in specific applications crashing when hidden. However in most common tests it works. The code like the original FU is open source, CHAOS and I encourage the community to make modifications.<img src ="http://blog.csdn.net/cdrea/aggbug/650999.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/01/01/567960.aspxSun, 01 Jan 2006 14:10:00 GMThttp://blog.csdn.net/CDrea/archive/2006/01/01/567960.aspxhttp://blog.csdn.net/cdrea/comments/567960.aspxhttp://blog.csdn.net/CDrea/archive/2006/01/01/567960.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/567960.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=5679602006年维也纳新年音乐会<img src ="http://blog.csdn.net/cdrea/aggbug/567960.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2006/01/01/567944.aspxSun, 01 Jan 2006 13:50:00 GMThttp://blog.csdn.net/CDrea/archive/2006/01/01/567944.aspxhttp://blog.csdn.net/cdrea/comments/567944.aspxhttp://blog.csdn.net/CDrea/archive/2006/01/01/567944.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/567944.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=567944Kernel mode socket library<img src ="http://blog.csdn.net/cdrea/aggbug/567944.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/08/22/460960.aspxMon, 22 Aug 2005 00:02:00 GMThttp://blog.csdn.net/CDrea/archive/2005/08/22/460960.aspxhttp://blog.csdn.net/cdrea/comments/460960.aspxhttp://blog.csdn.net/CDrea/archive/2005/08/22/460960.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/460960.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=460960Holy_Father的经典文章《挂钩Windows API》<img src ="http://blog.csdn.net/cdrea/aggbug/460960.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/08/17/456296.aspxWed, 17 Aug 2005 05:17:00 GMThttp://blog.csdn.net/CDrea/archive/2005/08/17/456296.aspxhttp://blog.csdn.net/cdrea/comments/456296.aspxhttp://blog.csdn.net/CDrea/archive/2005/08/17/456296.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/456296.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=456296修改导入表载入DLL<img src ="http://blog.csdn.net/cdrea/aggbug/456296.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/08/16/455478.aspxTue, 16 Aug 2005 05:27:00 GMThttp://blog.csdn.net/CDrea/archive/2005/08/16/455478.aspxhttp://blog.csdn.net/cdrea/comments/455478.aspxhttp://blog.csdn.net/CDrea/archive/2005/08/16/455478.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/455478.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=455478原文见:http://www.vckbase.com/document/viewdoc/?id=1128<img src ="http://blog.csdn.net/cdrea/aggbug/455478.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/08/14/453969.aspxSun, 14 Aug 2005 06:08:00 GMThttp://blog.csdn.net/CDrea/archive/2005/08/14/453969.aspxhttp://blog.csdn.net/cdrea/comments/453969.aspxhttp://blog.csdn.net/CDrea/archive/2005/08/14/453969.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/453969.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=453969Apache 1.33与PHP 4.4.0配置手记<img src ="http://blog.csdn.net/cdrea/aggbug/453969.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/08/02/443840.aspxTue, 02 Aug 2005 03:26:00 GMThttp://blog.csdn.net/CDrea/archive/2005/08/02/443840.aspxhttp://blog.csdn.net/cdrea/comments/443840.aspxhttp://blog.csdn.net/CDrea/archive/2005/08/02/443840.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/443840.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=443840原文见:http://blog.joycode.com/gangp/articles/18088.aspx<img src ="http://blog.csdn.net/cdrea/aggbug/443840.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/07/29/438054.aspxFri, 29 Jul 2005 03:25:00 GMThttp://blog.csdn.net/CDrea/archive/2005/07/29/438054.aspxhttp://blog.csdn.net/cdrea/comments/438054.aspxhttp://blog.csdn.net/CDrea/archive/2005/07/29/438054.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/438054.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=438054现在很多程序都支持插件,有利于程序功能的扩展.也方便用户为程序定制一些个性化的功能.<img src ="http://blog.csdn.net/cdrea/aggbug/438054.aspx" width = "1" height = "1" />CDreahttp://blog.csdn.net/CDrea/archive/2005/03/27/331641.aspxSun, 27 Mar 2005 10:33:00 GMThttp://blog.csdn.net/CDrea/archive/2005/03/27/331641.aspxhttp://blog.csdn.net/cdrea/comments/331641.aspxhttp://blog.csdn.net/CDrea/archive/2005/03/27/331641.aspx#Feedback0http://blog.csdn.net/cdrea/comments/commentRss/331641.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=331641在2000年的5、6月间，nmap-hackers邮件列表中发起了最佳安全工具的评选活动，活动取得了成功，最终由1200名Nmap用户评选出了50个最佳安全工具，评选结果发布在insecure.org网站，得到了网友们的普遍认可。时隔三年，nmap-hackers邮件列表中又发起了同样的评选活动，1854个用户参与了此次活动，每个用户最多可以选择8个最佳工具，并且这次评选出的最佳安全工具由50个增加到了75个。 因为是在nmap-hackers邮件列表中做出的评选，因此没有把nmap安全扫描器（http://www.insecure.org/nmap/）评选在内。这次评选出来的75个最佳安全工具在网络安全领域都是一些很有代表性的软件，对于那些在网络安全方面不知从何处开始的新手们来说，这对他们有相当的参考价值。<img src ="http://blog.csdn.net/cdrea/aggbug/331641.aspx" width = "1" height = "1" />