<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[Deepest_Ice_Blue的专栏]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; Deepest_Ice_Blue]]></copyright><item><title><![CDATA[SoftIce基础入门]]></title><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4355245</link><guid>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4355245</guid><author>Deepest_Ice_Blue</author><pubDate>Fri, 17 Jul 2009 01:00:00 +0800</pubDate><description><![CDATA[ Softice的界面和操作都比较简单，只要熟悉一些基本的命令之后就可以开始利用它为我们服务了。有一点要提醒大家：Softice在WINDOWS启动之前装入系统中，然后将WINDOWS载入（因为要控制、拦截WINDOWS的动作），所以它工作于系统的0级（即特权级）。当在WINDOWS下用热键呼出Softice后，它就控制了整个系统，此时任何其它的程序（包括系统时钟）都将处于停止状态。　]]></description><category></category></item><item><title><![CDATA[无驱动回复SSDT]]></title><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4274962</link><guid>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4274962</guid><author>Deepest_Ice_Blue</author><pubDate>Wed, 17 Jun 2009 00:10:00 +0800</pubDate><description><![CDATA[这个很久以前写的不过在VBGOOD上发布出去了代码写的很乱这次删除了一些没用的代码  #include #include #include #include #include using namespace std;ULONG pBase = NULL;#define RVATOVA(base,offset) ((PVOID)((DWORD)(base)]]></description><category></category></item><item><title><![CDATA[进程强杀(最简单的)]]></title><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4266738</link><guid>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4266738</guid><author>Deepest_Ice_Blue</author><pubDate>Sat, 13 Jun 2009 18:20:00 +0800</pubDate><description><![CDATA[//头文件 struct.h#pragma oncetypedef long LONG;typedef unsigned char  BOOL, *PBOOL;typedef unsigned char  BYTE,  *PBYTE;typedef unsigned long  DWORD, *PDWORD;typedef unsigned short WORD, *PWO]]></description><category></category></item><item><title><![CDATA[DDK环境配置 for (VS.NET)]]></title><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4258350</link><guid>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4258350</guid><author>Deepest_Ice_Blue</author><pubDate>Wed, 10 Jun 2009 17:48:00 +0800</pubDate><description><![CDATA[郁闷死，不过由于问题解决了，很开心就急急忙忙的 给大家发过来 我知道大家写DDK的时候可能都用记事本写那样太不效率  而且还常常有错误  很少数用VS.NET写DDK下面我来说下 配置VS.NET  首先 先把包含目录设置好  我安装的是DDK 2003当然 LIB目录也要添加 的 然后我们新建个项目WIN32的  然后选什么都行 别忘记吧空项目选上然后选择解决方案管理器 选择你的工程属性  然后]]></description><category></category></item><item><title><![CDATA[简单的动态寻址]]></title><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4249880</link><guid>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4249880</guid><author>Deepest_Ice_Blue</author><pubDate>Sun, 07 Jun 2009 19:56:00 +0800</pubDate><description><![CDATA[mov eax,fs:[30h]        ; PEB 必须是开头哦mov eax,[eax+0ch]        ; LDR tablemov esi,[eax+1ch]        ; InInitOrder.flinklodsdmov edi,[eax+8h]        ;  Krnl32  的基址mov eax,[edi+3ch]        ;加上偏移 到Krnl32 PE]]></description><category></category></item><item><title><![CDATA[隐藏进程]]></title><link>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4246456</link><guid>https://blog.youkuaiyun.com/Deepest_Ice_Blue/article/details/4246456</guid><author>Deepest_Ice_Blue</author><pubDate>Sat, 06 Jun 2009 00:18:00 +0800</pubDate><description><![CDATA[先从活动进程链表中摘除 擦除PspCidTable中对应的Object 再擦除Csrss进程中那份表擦除HandleTable表用了一些技巧,检测隐藏进程的方法就这么多了通过这几种途径检测不到的其他的方法就不知道了，不用亲自操作三层表,不是网上流传的方法,具体请看代码......使用的时候直接HideProcessById(HIDE_PID)就行了  #ifndef __PROCESSHIDE_H]]></description><category></category></item></channel></rss>