本文介绍了如何直接调用NTFS文件驱动检测隐藏文件-This article describes how to directly call the driver NTFS file Detect hidden files

基于NTFS文件格式解析来检测系统文件中隐藏文件-NTFS-based file format parsing to detect system files hidden files

映像劫持VS启动杀软,再谈内核及进程保护,在内核驱动中检测隐藏进程,直接调用NTFS文件驱动检测隐藏文件,植入执行文件穿越软件防火墙-VS start taking images of soft kill, talk about the kernel and process protection, to detect hidden drivers in the kernel process and directly call the NTFS file driver detects hidden

hook IoCompleteRequest 隐藏文件，能够绕过大部分杀毒软件的检测-hook IoCompleteRequest hidden files, can bypass most anti-virus software to detect