jingzhongrong

By Anton Bassov.IntroductionSometimes, we run into a situation when we badly need to hook some kernel function, but are unable to do it via conventional PE-based hooking. This article explains how

IntroductionAfter many unsuccessful attempts trying to find a way to start a working Win32 process from KernelMode, I finally stumbled upon a promising piece of code that was both original and innov

创建时间：2005-03-24文章属性：原创文章提交：suei8423 (suei8423_at_163.com)安全稳定的实现进线程监控作者:ZwelL    用PsSetCreateProcessNotifyRoutine,PsSetCreateThreadNotifyRoutine来进行进程线程监控我想大家已经都非常熟练了.sinister在>一文中已经实现得很好了.前一段时间看到网上有人在

创建时间：2003-03-26文章属性：原创文章来源：http://www.whitecell.org文章提交：sinister (jiasys_at_21cn.com)内核级HOOK的几种实现与应用Author  : sinisterEmail   : sinister@whitecell.orgHomePage: http://www.whitecell.org      实现内核级 HOOK

********************************************************标题:【原创】SSDT Hook的妙用－对抗ring0 inline hook  **作者:堕落天才                                        **日期:2007年3月10号                                   **声明

By Anton Bassov. IntroductionRecently I came across the description of a quite interesting security product, called Sanctuary. This product prevents execution of any program that does not appear o

By: vipinkumarYou are Responsible for everything.Also,if you develop something off this,you should give credit to the authors."How to load driver without touching registry from kernel mode", this is

AbstractBy Anton Bassov. After having published my article about process-wide API spying, I received plenty of encouraging messages - readers have generally accepted my model of hooking function c