<![CDATA[KernelEx的专栏]]>https://blog.youkuaiyun.com/KernelExzh-cnhttps://blog.youkuaiyun.com/<![CDATA[ 仿真WINDOWS PE加载器的程序]]>https://blog.youkuaiyun.com/KernelEx/article/details/4531884https://blog.youkuaiyun.com/KernelEx/article/details/4531884KernelExTue, 08 Sep 2009 14:54:00 +0800<![CDATA[一个内核级的SHELL工具源代码]]>https://blog.youkuaiyun.com/KernelEx/article/details/4528421https://blog.youkuaiyun.com/KernelEx/article/details/4528421KernelExMon, 07 Sep 2009 17:26:00 +0800<![CDATA[windbg 使用 ]]>https://blog.youkuaiyun.com/KernelEx/article/details/4477074https://blog.youkuaiyun.com/KernelEx/article/details/4477074KernelExMon, 24 Aug 2009 10:06:00 +0800<![CDATA[PspCreateProcessNotifyRoutine,PspCreateThreadNotifyRoutine,PspLoadImageNotifyRoutine表全部清空]]>https://blog.youkuaiyun.com/KernelEx/article/details/4465735https://blog.youkuaiyun.com/KernelEx/article/details/4465735KernelExThu, 20 Aug 2009 11:31:00 +0800<![CDATA[SSDT原始地址, 现在地址]]>https://blog.youkuaiyun.com/KernelEx/article/details/4464963https://blog.youkuaiyun.com/KernelEx/article/details/4464963KernelExThu, 20 Aug 2009 08:45:00 +0800<![CDATA[RING3下SSDT原始地址的获取]]>https://blog.youkuaiyun.com/KernelEx/article/details/4463827https://blog.youkuaiyun.com/KernelEx/article/details/4463827KernelExWed, 19 Aug 2009 17:52:00 +0800<![CDATA[ring3 恢复SSDT]]>https://blog.youkuaiyun.com/KernelEx/article/details/4463423https://blog.youkuaiyun.com/KernelEx/article/details/4463423KernelExWed, 19 Aug 2009 16:09:00 +0800<![CDATA[获得DISK的DeviceObject]]>https://blog.youkuaiyun.com/KernelEx/article/details/4463183https://blog.youkuaiyun.com/KernelEx/article/details/4463183KernelExWed, 19 Aug 2009 15:28:00 +0800 !drvobj /driver/diskDriver object (89885a08) is for:/Driver/DiskDriver Extension Lis]]><![CDATA[内核中获取进程路径学习]]>https://blog.youkuaiyun.com/KernelEx/article/details/4463120https://blog.youkuaiyun.com/KernelEx/article/details/4463120KernelExWed, 19 Aug 2009 15:12:00 +0800<![CDATA[PE导出/输入表————文件影射]]>https://blog.youkuaiyun.com/KernelEx/article/details/4462938https://blog.youkuaiyun.com/KernelEx/article/details/4462938KernelExWed, 19 Aug 2009 14:33:00 +0800<![CDATA[寻找原始表，恢复 ssdt 表 RING3]]>https://blog.youkuaiyun.com/KernelEx/article/details/4462053https://blog.youkuaiyun.com/KernelEx/article/details/4462053KernelExWed, 19 Aug 2009 10:52:00 +0800<![CDATA[INLINE HOOK RING0]]>https://blog.youkuaiyun.com/KernelEx/article/details/4461923https://blog.youkuaiyun.com/KernelEx/article/details/4461923KernelExWed, 19 Aug 2009 10:34:00 +0800<![CDATA[IAT HOOK RING3]]>https://blog.youkuaiyun.com/KernelEx/article/details/4461892https://blog.youkuaiyun.com/KernelEx/article/details/4461892KernelExWed, 19 Aug 2009 10:30:00 +0800