搜索资源列表
dvKrnlData
- 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the
hookX
- 驱动层Hook系统内核调用的，拦截对进程的操作的源码，提供7步tutorial,步步为营，教学驱动编程的绝好样例-Hook-driven system kernel called the interception of the process of operation of the source. provide seven-step tutorial and step-by-step business, teaching driven programming excellent example
NdisHookDrv
- 一个截取网络包的驱动。它与DDK文档正是NDIS中间驱动不同，是通过HOOK内核NDIS API来实现的。听说诺顿也是使用此方法来实现。-an interception network packet driver. It DDK documentation is NDIS Intermediate Driver, through HOOK kernel NDIS API to achieve. Norton also heard that the use of this method is to
winKernel-byWOWOCOCK
- 天书夜读（试读版），来自驱动开发网的大牛楚狂人与wowocock合写的Windows内核探索教程，主要介绍了对内核进行反汇编的一些基本知识及进行内核DIY如hook系统关键调用的介绍。是内核开发爱好者及黑客们的必备良品。
IDTGuard
- IDT Hook 检测及恢复 此程序在 Ring3 下打开物理内存对象取得当前内存中的 IDT，再用打开对应的原始内核文件进行比较。带恢复功能。 此程序适用于 XP/2003。采用特征码搜索方式查找。注释详细，代码规范
inline hook zwcreatesection
- 原创 天书夜读上 Inline Hook ZwCreateSection 源码
Rootkit 内核hook 隐身术
- Rootkit 1。 内核hook 隐身术 ring0中调用ring3程序 其他
ZWopenprocess.rar
- Hook ZWopenprocess 内核防护指定PID进程,Hook ZWopenprocess
kernel-reload
- 这份是重载内核，知道重载内核能干什么了，基本所有的ssdt和shadow ssdt都能恢复，神马hook之类的弱爆了-This is overloaded kernel know to reload the kernel can do the basic the all ssdt and shadow ssdt, will recover, of Shenma hook like a weak burst
PEHOOK
- 可以实现PE HOOK。这种方法对于拦截、分析其他内核驱动的函数调用来说用的比较多。原理是根据替换 PE 格式导出表中的相应函数来实现的。 -Can achieve PE HOOK. This method for the interception, analysis of other core-driven function call is used more. The principle is based on PE format to export table to replace t
RestoreInlinehook
- 恢复DNF内核inline hook的驱动源代码-Recovery DNF kernel driver source code inline hook
myhook
- 利用SSDT HOOK 巧过 LINK HOOK的驱动源码。。合适新手熟悉内核学习-Clever use of SSDT HOOK LINK HOOK been driven source. . Appropriate learning novice familiar with the kernel
PsVoid_src
- 学习内核的一些资料，里面hook的很多，大家可以 -Some of the information to learn the kernel, which hook a lot, we can look at
InlineHookScan
- 驱动层搜索内连HOOK,查看SSDT中的内核函数的开头是否被内连HOOK-Search within driving layer with HOOK, see SSDT in the beginning of the kernel function is to be in with HOOK
3600safeOpenSource
- 查看进程线程，查看内核对象，ark工具 -3600safeOpenSource,this is a hook programer,sddt,kernel hook
inlinehook
- 驱动内核hook编程inlinehook-Drive the core hook programming inlinehook
KernelTools
- 对内核的控制，对内核的Hook。结束进程，关机，禁止创建进程-Control of the kernel, the kernel Hook.The end of the process, shutdown, prohibit create process
KernelLoader_sys
- hook KiFastCannEntry函数实现重载内核。-The hook KiFastCannEntry function overloaded kernel.
内核重C源码和成品驱动
- 内核重载 过任意游戏驱动保护源码，目前只重载一个内核。掌握此方法重载多个内核文件可以通杀任意游戏驱动保护和软件HOOK等，大神必备技能，目前只让OD或者CE工具走新内核。WIN7 32系统加载驱动后可以打开OD或CE修改游戏数据了(The kernel is overloaded with an arbitrary game driver protection source, and only one kernel is overloaded at the moment. Mastering t
HookSSDT
- 驱动重载 Hook SSDT 绕过钩子 理论上过一切保护(reload-kernel , Hook SSDT)