×îÐÂÌû×Ó ¾«»ªÇø ÉçÇø·þÎñ »áÔ±Áбí ͳ¼ÆÅÅÐÐ ÅóÓÑȦ


Ö÷Ìâ : żµÄ¼à¿Ø³ÌÐòPRMonitor Ô´´úÂë(ddk+sdk)
x-star ÀëÏß
¼¶±ð: Çý¶¯Ð¡Å£
UID: 170057
¾«»ª: 1
·¢Ìû: 156
ÍþÍû: 654 µã
»ý·Ö: 64 ·Ö
¹±Ï×Öµ: 1 µã
ÔÚÏßʱ¼ä: 47(ʱ)
×¢²áʱ¼ä: 2007-04-26
×îºóµÇ¼: 2009-12-24
Â¥Ö÷  ·¢±íÓÚ: 2007-11-17 21:41

żµÄ¼à¿Ø³ÌÐòPRMonitor Ô´´úÂë(ddk+sdk)

¹ÜÀíÌáÐÑ: (¾) ± (Ì)
  ×î½üºÜ¶àÈ˶Ôʵʱ¼à¿ØµÄ³ÌÐò¸ÐÐËȤ,¶øÇÒzjjmj2002´óÏÀÒ²·ÅÁËÒ»¸ö³öÀ´,ÎÒÒ²°ÑÎҵĴúÂë·Å³öÀ´...
ͨ¹ýssdt hookʵÏÖ ¶Ô½ø³Ì´´½¨,×¢²á±íÐ޸ĺÍÄÚºËÄ£¿é¼ÓÔØµÄ¼à¿Ø...
hook ÁËZwCreateProcess      ÆäʵºÜ¶à·½·¨²»Óõ÷ÓÃZwCreateProcess¶ø´´½¨½ø³Ì  ¸üºÃµÄ°ì·¨ÊÇÔÙhook 
NtCreateSection  ÎÒÀÁµÃ¸ÄÁË ¾ßÌå²Î¿¼codeprojectÉϵÄÎÄÕÂHooking the native API and controlling process creation on a system-wide basis
×¢²á±í¼à¿Ø¾ÍÊÇhookÁËZwSetValueKey ûʲô˵µÄ
ÄÚºË¼à¿Ø½ö½ö hookÁËZwLoadDriver ÆäËü½øÈëring0µÄ·½·¨Ã»ÓÐ¼à¿Ø........
ÏÖÔÚÖ»ÄÜËãÊÇÒ»¸öDemo  Æ­Æ­¹ÛÖÚ°ÕÁË
µÈÓÐʱ¼äÔÙÍêÉÆ

Æäʵ дÕâÀàµÄ³ÌÐò¹Ø¼üÊÇ·âÁ˽øÈëring0µÄ·½·¨  ÊØ×¡ring0Õâ¿é¸ßµØ ÆäËüµÄʲô¶¼²»ÅÂ.......






[ ´ËÌù±»x-starÔÚ2007-11-18 18:48ÖØÐ±༭ ]
¸½¼þ: PRMonitor.rar (74 K) ÏÂÔØ´ÎÊý:1444
sudami ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 166813
¾«»ª: 0
·¢Ìû: 20
ÍþÍû: 30 µã
»ý·Ö: 4 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 1(ʱ)
×¢²áʱ¼ä: 2007-03-01
×îºóµÇ¼: 2009-07-15
ɳ·¢  ·¢±íÓÚ: 2007-11-17 22:44
ѧϰ~~~
killvxk ÀëÏß
ÎÒÊÇÑý¡«
¼¶±ð: ÂÛ̳°æÖ÷
UID: 120115
¾«»ª: 2
·¢Ìû: 1785
ÍþÍû: 1863 µã
»ý·Ö: 1068 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 10(ʱ)
×¢²áʱ¼ä: 2005-10-03
×îºóµÇ¼: 2009-11-25
°åµÊ  ·¢±íÓÚ: 2007-11-17 22:51
LZ»¹¿ÉÒÔÀ²¡«ÎÒ¶¥Äã¡«
ûÓÐÕ½Õù¾ÍûÓнø²½
X3¹¤×÷×é
ΪÄúÌṩ×îºÃµÄ¾ü»ð
codez ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 108346
¾«»ª: 0
·¢Ìû: 54
ÍþÍû: 73 µã
»ý·Ö: 7 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2005-06-20
×îºóµÇ¼: 2009-12-07
µØ°å  ·¢±íÓÚ: 2007-11-18 11:22
ѧϰ!
ranwei1025 ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 176965
¾«»ª: 0
·¢Ìû: 9
ÍþÍû: 10 µã
»ý·Ö: 3 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2007-08-24
×îºóµÇ¼: 2009-04-09
µØÏÂÊÒ  ·¢±íÓÚ: 2007-11-19 09:33
ѧϰ лл£¡
zjjmj2002 ÀëÏß
¼¶±ð: Çý¶¯Ð¡Å£
UID: 168996
¾«»ª: 1
·¢Ìû: 237
ÍþÍû: 321 µã
»ý·Ö: 15 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 9(ʱ)
×¢²áʱ¼ä: 2007-04-05
×îºóµÇ¼: 2009-11-25
5Â¥  ·¢±íÓÚ: 2007-11-19 09:41
ºÜºÃ£¬ÔÞÒ»¸öÏÈ¡£
symbol ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 58005
¾«»ª: 0
·¢Ìû: 3
ÍþÍû: 3 µã
»ý·Ö: 1 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2003-05-20
×îºóµÇ¼: 2009-07-13
6Â¥  ·¢±íÓÚ: 2007-11-21 00:11
ÌìÀ¶À¶
MorrisZhang ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 89924
¾«»ª: 0
·¢Ìû: 5
ÍþÍû: 5 µã
»ý·Ö: -10 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2004-08-26
×îºóµÇ¼: 2009-11-23
7Â¥  ·¢±íÓÚ: 2007-11-23 11:38
ºÃ¶«Î÷£¬Òª¶¥Ò»Ä¿
yueguo ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 182449
¾«»ª: 0
·¢Ìû: 2
ÍþÍû: 3 µã
»ý·Ö: 0 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2007-11-23
×îºóµÇ¼: 2008-08-24
8Â¥  ·¢±íÓÚ: 2007-11-23 20:16
ѧϰ лл
ÁÉÄþÊ¡ÉòÑôÊÐ ¶¥¶Ë
carlkwan ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 175286
¾«»ª: 0
·¢Ìû: 26
ÍþÍû: 36 µã
»ý·Ö: 5 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 6(ʱ)
×¢²áʱ¼ä: 2007-07-29
×îºóµÇ¼: 2009-12-07
9Â¥  ·¢±íÓÚ: 2007-11-26 10:50
Ö§³Ö£¬²»ÖªµÀvista64Ï£¬ºÃÓò»£¬
µÈÍíÉϻؼҲâÊÔÒ»ÏÂ.
¹þ¶û±õ¹¤Òµ´óѧ ¶¥¶Ë
wangjianfeng ÀëÏß
¼¶±ð: Çý¶¯Ð¡Å£
UID: 83687
¾«»ª: 0
·¢Ìû: 271
ÍþÍû: 262 µã
»ý·Ö: 1002 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2004-05-28
×îºóµÇ¼: 2009-10-23
10Â¥  ·¢±íÓÚ: 2007-11-27 14:44
²»¶¥Ã»Á¼ÐÄ.
wangjianfeng ÀëÏß
¼¶±ð: Çý¶¯Ð¡Å£
UID: 83687
¾«»ª: 0
·¢Ìû: 271
ÍþÍû: 262 µã
»ý·Ö: 1002 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2004-05-28
×îºóµÇ¼: 2009-10-23
11Â¥  ·¢±íÓÚ: 2007-11-27 15:31
//СµÜ²»²Å,ÊÇΪÁ˸øÇý¶¯´«ËÍCreateProcessµÄµØÖ·?

DWORD * addr=(DWORD *)(1+(DWORD)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtCreateProcess"));

//Õâ¸öÊÇÇåÁã
    ZeroMemory(outputbuff,256);

//??СµÜ²»²Å,û¿´¶®Õâ¾äµÄÒâ˼?ÊÇΪÁ˸øÇý¶¯´«ËÍCreateProcessµÄµØÖ·?
//¿´Çý¶¯ÖÐÊǵõ½ÁËCreateProcessExµÄµØÖ·,Õâ¸öÊDz»ÊÇûÓõÄÓï¾ä?

    controlbuff[0]=addr[0];

//ÏÂÃæÕâ¾äÊÇ´Ó4×Ö½ÚºóÉèÖóɹ²ÏíÄÚ´æ²¢·¢¸øÇý¶¯

          controlbuff[1]=xxxx;
zjg1979 ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 159901
¾«»ª: 2
·¢Ìû: 47
ÍþÍû: 70 µã
»ý·Ö: 2 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2006-09-21
×îºóµÇ¼: 2009-09-04
12Â¥  ·¢±íÓÚ: 2007-11-28 11:43
ºÜ°ô,ѧϰÁË
ËÄ´¨Ê¡³É¶¼ÊÐ ¶¥¶Ë
sislcb ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 152249
¾«»ª: 0
·¢Ìû: 23
ÍþÍû: 24 µã
»ý·Ö: 1 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2006-07-09
×îºóµÇ¼: 2008-09-19
13Â¥  ·¢±íÓÚ: 2007-11-29 08:47
ÔÚ½ûÖ¹Á˽ø³ÌÔËÐк󣬻ᵯ³ö¡°²»ÊÇÓÐЧ¾ä±ú¡±µÄ´íÎó£¿ÇëÎÊÔõô°ÑÕâ¸öÏûÏ¢ÆÁ±Îµô?
haoran007 ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 175781
¾«»ª: 0
·¢Ìû: 6
ÍþÍû: 7 µã
»ý·Ö: 2 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2007-08-06
×îºóµÇ¼: 2009-03-02
14Â¥  ·¢±íÓÚ: 2007-12-11 18:36
¹²Í¬Ñ§Ï°
Ò»Æð½ø²½
ºÓÄÏÊ¡ÄÏÑôÊÐ ¶¥¶Ë
cuizhany ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 183703
¾«»ª: 0
·¢Ìû: 1
ÍþÍû: 2 µã
»ý·Ö: 10 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2007-12-19
×îºóµÇ¼: 2007-12-27
15Â¥  ·¢±íÓÚ: 2007-12-19 21:21
ÏÂÀ´¿´¿´Ñ§Ï°Ò»Ï¡£Ð»Ð»
ENJOYKAKA ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 162098
¾«»ª: 0
·¢Ìû: 15
ÍþÍû: 16 µã
»ý·Ö: 140 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2006-10-30
×îºóµÇ¼: 2008-06-25
16Â¥  ·¢±íÓÚ: 2008-01-08 16:45
ºÍ´ó¼ÒÒ»Ñù£¬¶¥ÄãÒ»ÏÂ
taxueliuyun ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 184585
¾«»ª: 0
·¢Ìû: 13
ÍþÍû: 14 µã
»ý·Ö: 0 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2008-01-05
×îºóµÇ¼: 2009-07-23
17Â¥  ·¢±íÓÚ: 2008-01-16 15:17
ѧϰÁË£¬·Ç³£¸Ðл£¡£¡£¡
¸£½¨Ê¡¸£ÖÝÊÐ ¶¥¶Ë
abcd0106 ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 166524
¾«»ª: 0
·¢Ìû: 22
ÍþÍû: 32 µã
»ý·Ö: 211 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2007-02-21
×îºóµÇ¼: 2009-01-05
18Â¥  ·¢±íÓÚ: 2008-02-24 12:14
ÕýÔÚѧϰ£¬Ð»ÁË
µç×ӿƼ¼´óѧ ¶¥¶Ë
xiangfly ÀëÏß
¼¶±ð: Çý¶¯Å£¶¿
UID: 188059
¾«»ª: 0
·¢Ìû: 9
ÍþÍû: 10 µã
»ý·Ö: 10 ·Ö
¹±Ï×Öµ: 0 µã
ÔÚÏßʱ¼ä: 0(ʱ)
×¢²áʱ¼ä: 2008-03-26
×îºóµÇ¼: 2008-06-02
19Â¥  ·¢±íÓÚ: 2008-04-01 10:49
¿ìËٻظ´ ¶¥¶Ë
ÄÚÈÝ
HTML ´úÂë²»¿ÉÓÃ
ʹÓÃÇ©Ãû
Wind Code×Ô¶¯×ª»»

°´"Ctrl+Enter"Ö±½ÓÌá½»