https://blog.youkuaiyun.com/Shevacomingzh-cnhttps://blog.youkuaiyun.com/https://blog.youkuaiyun.com/Shevacoming/article/details/19369341https://blog.youkuaiyun.com/Shevacoming/article/details/19369341ShevacomingTue, 18 Feb 2014 00:39:30 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/11518945https://blog.youkuaiyun.com/Shevacoming/article/details/11518945ShevacomingTue, 10 Sep 2013 10:37:03 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/9473837https://blog.youkuaiyun.com/Shevacoming/article/details/9473837ShevacomingThu, 25 Jul 2013 21:56:35 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7992738https://blog.youkuaiyun.com/Shevacoming/article/details/7992738ShevacomingTue, 18 Sep 2012 17:34:34 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7952717https://blog.youkuaiyun.com/Shevacoming/article/details/7952717ShevacomingThu, 06 Sep 2012 21:40:54 +0800PPLookasideList[number].P;这个快查表里面拿一个，如]]>https://blog.youkuaiyun.com/Shevacoming/article/details/7947959https://blog.youkuaiyun.com/Shevacoming/article/details/7947959ShevacomingWed, 05 Sep 2012 19:47:32 +0800MdlAddress的链表  CSHORT Size;  CSHORT MdlFlags;  struct _EPROCESS *Process;                 原内存所]]>https://blog.youkuaiyun.com/Shevacoming/article/details/7826527https://blog.youkuaiyun.com/Shevacoming/article/details/7826527ShevacomingFri, 03 Aug 2012 11:56:32 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7795803https://blog.youkuaiyun.com/Shevacoming/article/details/7795803ShevacomingSat, 28 Jul 2012 06:52:53 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7795790https://blog.youkuaiyun.com/Shevacoming/article/details/7795790ShevacomingSat, 28 Jul 2012 03:57:04 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7787191https://blog.youkuaiyun.com/Shevacoming/article/details/7787191ShevacomingThu, 26 Jul 2012 02:46:45 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7782857https://blog.youkuaiyun.com/Shevacoming/article/details/7782857ShevacomingWed, 25 Jul 2012 01:19:02 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7781763https://blog.youkuaiyun.com/Shevacoming/article/details/7781763ShevacomingTue, 24 Jul 2012 18:55:10 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7777530https://blog.youkuaiyun.com/Shevacoming/article/details/7777530ShevacomingTue, 24 Jul 2012 04:10:57 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7773806https://blog.youkuaiyun.com/Shevacoming/article/details/7773806ShevacomingMon, 23 Jul 2012 16:40:33 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7725812https://blog.youkuaiyun.com/Shevacoming/article/details/7725812ShevacomingSun, 08 Jul 2012 07:30:35 +0800 load fake pcidump.sys dr0 hook AtapiDeviceInternalDispatch，隐藏驱动，伪造系统线程 XT看不到什么东西，PowerTool可以检测到调试函数被钩，强力检测可以检测到mbr被感染。不想和PT去]]>https://blog.youkuaiyun.com/Shevacoming/article/details/7697885https://blog.youkuaiyun.com/Shevacoming/article/details/7697885ShevacomingWed, 27 Jun 2012 23:50:29 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7685199https://blog.youkuaiyun.com/Shevacoming/article/details/7685199ShevacomingFri, 22 Jun 2012 21:25:10 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7640369https://blog.youkuaiyun.com/Shevacoming/article/details/7640369ShevacomingThu, 07 Jun 2012 00:53:27 +0800https://blog.youkuaiyun.com/Shevacoming/article/details/7640349https://blog.youkuaiyun.com/Shevacoming/article/details/7640349ShevacomingThu, 07 Jun 2012 00:52:00 +0800ProductSuite->ProductOptions 1.系统初始化时已经读取了这个值,详见ROS。 CmControlVector是一系列要在系统初始化前期从hive中读取来的值，其中就有   {        L"ProductOptions"]]>https://blog.youkuaiyun.com/Shevacoming/article/details/7640348https://blog.youkuaiyun.com/Shevacoming/article/details/7640348ShevacomingThu, 07 Jun 2012 00:35:49 +0800