搜索资源列表
dvKrnlData
- 该代码为我学习winnt内核时所写，主要功能是在ring3下通过DeviceIoControl与驱动进行通信，获取内核的数据以及sdt，idt信息等。并实现了hook NtQuerySystemInformation函数来实现进程隐藏的功能-The code for the kernel, I am learning winnt wrote, Its main function is in ring3 through DeviceIoControl communication with the
hookX
- 驱动层Hook系统内核调用的，拦截对进程的操作的源码，提供7步tutorial,步步为营，教学驱动编程的绝好样例-Hook-driven system kernel called the interception of the process of operation of the source. provide seven-step tutorial and step-by-step business, teaching driven programming excellent example
NdisHookDrv
- 一个截取网络包的驱动。它与DDK文档正是NDIS中间驱动不同，是通过HOOK内核NDIS API来实现的。听说诺顿也是使用此方法来实现。-an interception network packet driver. It DDK documentation is NDIS Intermediate Driver, through HOOK kernel NDIS API to achieve. Norton also heard that the use of this method is to
kernel-reload
- 这份是重载内核，知道重载内核能干什么了，基本所有的ssdt和shadow ssdt都能恢复，神马hook之类的弱爆了-This is overloaded kernel know to reload the kernel can do the basic the all ssdt and shadow ssdt, will recover, of Shenma hook like a weak burst
RestoreInlinehook
- 恢复DNF内核inline hook的驱动源代码-Recovery DNF kernel driver source code inline hook
myhook
- 利用SSDT HOOK 巧过 LINK HOOK的驱动源码。。合适新手熟悉内核学习-Clever use of SSDT HOOK LINK HOOK been driven source. . Appropriate learning novice familiar with the kernel
antiTX
- 1.恢复shadow ssdt 2.恢复 NtReadVirtualMemory NtWriteVirtualMemory NtOpenProcess NtOpenThread KiAttachProce-1.恢复shadow ssdt 2.恢复 NtReadVirtualMemory NtWriteVirtualMemory NtOpenProcess NtOpenThread KiAttachProcess
DiskMon
- DiskMon运行在NT4上才加载驱动，在W2k以上平台其使用kernel event tracing实现磁盘活动的监视， 但其驱动可以跑在W2k/XP/2K3/Vista上 该驱动Hook了disk的driver dispatch例程，不仅可以监视磁盘活动，稍微改下还能拦截、修改上层对磁盘的读写， 很容易就可以搞个什么 基于Disk的 -DiskMon only run on NT4 load on the drive, more than W2k platform in i
inlinehook
- 驱动下inline hook 模板，驱动下inline hook -the inline hook in kernel
PsVoid_src
- 学习内核的一些资料，里面hook的很多，大家可以 -Some of the information to learn the kernel, which hook a lot, we can look at
InlineHookScan
- 驱动层搜索内连HOOK,查看SSDT中的内核函数的开头是否被内连HOOK-Search within driving layer with HOOK, see SSDT in the beginning of the kernel function is to be in with HOOK
3600safeOpenSource
- 查看进程线程，查看内核对象，ark工具 -3600safeOpenSource,this is a hook programer,sddt,kernel hook
Overloaded-kernel-file-to-bypass-the-SSDT
- Hook KiFastCallEntry
NTIllusion
- Kernel NT驱动，windows api hook程序-API HOOK，windows api hook
KernelTools
- 对内核的控制，对内核的Hook。结束进程，关机，禁止创建进程-Control of the kernel, the kernel Hook.The end of the process, shutdown, prohibit create process
KernelLoader_sys
- hook KiFastCannEntry函数实现重载内核。-The hook KiFastCannEntry function overloaded kernel.
Hook_SSDT_NtOpenProcess
- Hook SSDT NtOpenProcess,驱动实现Hook内核函数。- Hook SSDT NtOpenProcess, drive to achieve Hook kernel function.
HookDemo_SSDT
- SSDT hook 内核api，实现进程隐藏和进程保护功能的源码，备份资料，仅供参考。-SSDT hook kernel api, hidden process and process protection function of the source, the backup data is for reference only.
rent
- 一半抄A盾，一半抄GalaxyAP，扣了A盾的内核重载，抄了GalaxyAP(游戏反调试框架)的自实现异常 vs2010+wdk7600编译通过 思路：内核重载就不说鸟，GalaxyAP自实现异常就是从PDB获取未导出函数 然后重写异常函数，inline hook到自己写的函数里面 debugport的判断再hook一把到自己的判断函数里面。 断断续续抄了很久，实在写不下去了，发上来希望对还在过游戏驱动里的娃 有所帮助，也算是这份代码的一点点贡献。属于半路出家
HookSSDT
- 驱动重载 Hook SSDT 绕过钩子 理论上过一切保护(reload-kernel , Hook SSDT)