<![CDATA[a519609598的博客]]>https://blog.youkuaiyun.com/a519609598zh-cnhttps://blog.youkuaiyun.com/<![CDATA[Tssyskit]]>https://blog.youkuaiyun.com/a519609598/article/details/101278303https://blog.youkuaiyun.com/a519609598/article/details/101278303a519609598Sat, 04 Dec 2010 22:15:00 +0800<![CDATA[[note]windbg无故不显示command窗口.]]>https://blog.youkuaiyun.com/a519609598/article/details/101278288https://blog.youkuaiyun.com/a519609598/article/details/101278288a519609598Sun, 14 Nov 2010 15:45:00 +0800<![CDATA[[note]RegMon驱动分析笔记(一)]]>https://blog.youkuaiyun.com/a519609598/article/details/101278301https://blog.youkuaiyun.com/a519609598/article/details/101278301a519609598Fri, 12 Nov 2010 22:37:00 +0800<![CDATA[[note]贴个能获取Csrss.exe PID的函数]]>https://blog.youkuaiyun.com/a519609598/article/details/101278298https://blog.youkuaiyun.com/a519609598/article/details/101278298a519609598Mon, 08 Nov 2010 20:39:00 +0800<![CDATA[[ZZ]转文章一篇~价值观]]>https://blog.youkuaiyun.com/a519609598/article/details/101278286https://blog.youkuaiyun.com/a519609598/article/details/101278286a519609598Mon, 08 Nov 2010 13:44:00 +0800<![CDATA[[1.1]MBR感染]]>https://blog.youkuaiyun.com/a519609598/article/details/101278284https://blog.youkuaiyun.com/a519609598/article/details/101278284a519609598Sat, 30 Oct 2010 16:47:00 +0800<![CDATA[[1.0]剖析MBR]]>https://blog.youkuaiyun.com/a519609598/article/details/101278296https://blog.youkuaiyun.com/a519609598/article/details/101278296a519609598Thu, 28 Oct 2010 16:29:00 +0800<![CDATA[[0.0]Windows启动过程概述]]>https://blog.youkuaiyun.com/a519609598/article/details/101278282https://blog.youkuaiyun.com/a519609598/article/details/101278282a519609598Thu, 28 Oct 2010 11:35:00 +0800<![CDATA[从MBR Rootkit 谈起...]]>https://blog.youkuaiyun.com/a519609598/article/details/101278280https://blog.youkuaiyun.com/a519609598/article/details/101278280a519609598Wed, 27 Oct 2010 19:58:00 +0800<![CDATA[[note]chapter3--系统机制(IDT,GDT,SSDT,shadow SSDT)]]>https://blog.youkuaiyun.com/a519609598/article/details/101278292https://blog.youkuaiyun.com/a519609598/article/details/101278292a519609598Wed, 13 Oct 2010 11:48:00 +0800<![CDATA[[note]chapter2--系统结构]]>https://blog.youkuaiyun.com/a519609598/article/details/101278289https://blog.youkuaiyun.com/a519609598/article/details/101278289a519609598Wed, 13 Oct 2010 11:37:00 +0800<![CDATA[说下最近的自己....]]>https://blog.youkuaiyun.com/a519609598/article/details/101278279https://blog.youkuaiyun.com/a519609598/article/details/101278279a519609598Wed, 13 Oct 2010 10:27:00 +0800<![CDATA[[ZZ]Windows磁盘驱动基础教程]]>https://blog.youkuaiyun.com/a519609598/article/details/101278287https://blog.youkuaiyun.com/a519609598/article/details/101278287a519609598Fri, 08 Oct 2010 21:43:00 +0800<![CDATA[[note]贴一些常用的串指令,方便查阅]]>https://blog.youkuaiyun.com/a519609598/article/details/101278277https://blog.youkuaiyun.com/a519609598/article/details/101278277a519609598Sat, 02 Oct 2010 00:01:00 +0800<![CDATA[[note] 贴一段能实现文件隐藏的Minifilter]]>https://blog.youkuaiyun.com/a519609598/article/details/101278285https://blog.youkuaiyun.com/a519609598/article/details/101278285a519609598Fri, 01 Oct 2010 01:32:00 +0800<![CDATA[[zz]wdk minifilter 自带示例的简要说明]]>https://blog.youkuaiyun.com/a519609598/article/details/101278283https://blog.youkuaiyun.com/a519609598/article/details/101278283a519609598Fri, 24 Sep 2010 23:10:00 +0800<![CDATA[[note]Minifilter框架程序]]>https://blog.youkuaiyun.com/a519609598/article/details/101278281https://blog.youkuaiyun.com/a519609598/article/details/101278281a519609598Fri, 24 Sep 2010 23:08:00 +0800<![CDATA[[note]Windows缓存管理机制分析(一)]]>https://blog.youkuaiyun.com/a519609598/article/details/101278278https://blog.youkuaiyun.com/a519609598/article/details/101278278a519609598Mon, 20 Sep 2010 15:15:00 +0800<![CDATA[[note]枚举进程之二(句柄表分析篇)]]>https://blog.youkuaiyun.com/a519609598/article/details/101278276https://blog.youkuaiyun.com/a519609598/article/details/101278276a519609598Sat, 18 Sep 2010 03:23:00 +0800<![CDATA[[note]枚举进程之一(基础科普篇)]]>https://blog.youkuaiyun.com/a519609598/article/details/101278274https://blog.youkuaiyun.com/a519609598/article/details/101278274a519609598Thu, 16 Sep 2010 22:36:00 +0800