SSDT Hook的妙用-对抗ring0 inline hook阅读全文>
发表于 @ 2007年04月02日 00:54:00|评论(loading...)|编辑|举报|收藏
内核级HOOK的几种实现与应用
阅读全文>
发表于 @ 2007年04月02日 00:52:00|评论(loading...)|编辑|举报|收藏
安全稳定的实现进线程监控阅读全文>
发表于 @ 2007年04月02日 00:51:00|评论(loading...)|编辑|举报|收藏
First of all, let‘s look at complications, arising from the fact that our spying activity is going to take place in the kernel mode. To begin with, Windows is a protected system, which means user-mode applications have no access to the kernel address space. Therefore, a spying DLL, described in the previous article, cannot work in kernel mode - in order to start spying in kernel mode, we have to write not a DLL but a kernel-mode spying driver.阅读全文>
发表于 @ 2007年04月02日 00:49:00|评论(loading...)|编辑|举报|收藏
This is required because even if you exploit kernel vulnerabilities ,you still cannot load any driver because almost all existing Antivirus solutions hijack the NTOSkrnl API‘s ( which let you write to specific registry locations, load drivers etc).After Windows 2000 start‘s up, It starts loading the special driver win2k.sys.It doesn‘t load in the traditional way (as all other drivers are loaded) by calling the following procedures ZwLoadDriver, NtLoadDriver etc.阅读全文>
发表于 @ 2007年04月02日 00:47:00|评论(loading...)|编辑|举报|收藏