Search - address memory

Search - address memory - List

[Driver Develop] turboc2 DL : 0: 一个通过PC104访问内存的一个小程序，上位机的程序，里面通过地址，指针实现访问。这个做为内存的调试程序比较理想。-PC104 memory of a visit to a small procedures, the procedures for PC, which through the address pointer to achieve access. This as a memory debugger ideal.
Date : 2026-01-11 Size : 141kb User : 周胜
[Driver Develop] ssdt. DL : 0: Delphi开发驱动的一个例子 1.映射ntoskrnl.exe到内存 2.重定位信息... 3.搜索SSDT基址 4.补丁回去-Delphi developed an example-driven 1. Mappings ntoskrnl.exe into memory 2. ... 3, re-positioning information. Search SSDT base address 4. Patch back
Date : 2026-01-11 Size : 14kb User : fanghui
[Driver Develop] Detect_EAT_HOOK DL : 0: 检查内核中是否存在EAT挂钩。在应用层通过VB获得内核模块的导出函数名及真实地址，然后与内存地址相比较。若不同，则恢复。-EAT check whether there is linked to the kernel. VB obtained at the application layer through the kernel module exported function names and real addresses, and then compared with the memory address. If different, then restored.
Date : 2026-01-11 Size : 103kb User : 王波
[Driver Develop] wsss DL : 0: 本软件使用VC++6.0设计，分为三个标签页显示基本信息、硬件信息、U盘信息。用户可以通过本软件获取用户名计算机名信息、产品ID号、CPU信息、当前屏幕信息、本机IP地址、本机MAC地址、本机活动端口信息、本机进程信息、系统BIOS信息、显卡声卡网卡信息、内存信息、磁盘信息、U盘使用信息。本软件信息部分来自注册表中，所以在使用本软件时需要允许本软件访问注册表。 -The software uses VC++6.0 design, is divided into three tabs display basic information, hardware information, U disk information. You can use this software to obtain the user name computer name information, product ID number, CPU information, the current screen information, the local IP address, MAC address of the machine, the machine active port information, the machine process information, the system BIOS information, graphics card card information, memory information, disk information, U disk usage information. The software comes in part from information in the registry, so the use of this software needed to allow the software to access the registry.
Date : 2026-01-11 Size : 8.15mb User : dd
[Driver Develop] SDT_UnHook_Code DL : 0: 通过读取ntoskrnl.exe文件的导出函数API相对虚拟地址，找到ntoskrnl.exe在内存中的基地址，计算各个API真正的起始地址，比较SSDT表中对应的API地址，不同则去掉SSDT钩子的驱动代码-First,the driver code acquires the RVA of APIs the export table of ntoskrnl.exe.Second,program acquires the base address of ntoskrnl.exe loaded into memory to compute the real memory addresses of APIs. Third, program gets rid of hooks by comparing real addresses with items in SSDT table.
Date : 2026-01-11 Size : 652kb User : 王冠