Location:
Search - SDTrestore
Search list
Description: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behaviou r of the system by Native Kernel API hooking. Thi 's technique is typically implemented by modify ing the ServiceTable entries in the Service Des criptor Table (SDT). on the hook
Platform: |
Size: 9167 |
Author: wind |
Hits:
Description: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). 有关钩子-Win32 Kernel Rootkits modify the behaviou r of the system by Native Kernel API hooking. Thi 's technique is typically implemented by modify ing the ServiceTable entries in the Service Des criptor Table (SDT). on the hook
Platform: |
Size: 9216 |
Author: wind |
Hits:
Description: SSDT 恢复代码 SSDT 恢复代码-SSDT code to restore to restore SSDT code
Platform: |
Size: 29696 |
Author: sadf |
Hits:
Description: Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). Such modification ensures that a replacement (hook) function installed by a rootkit is called prior to the original native API. The replacement function usually calls the original native API and modifies the output before returning the results to the user-space program. This technique allows kernel rootkits to hide files, processes, and to prevent process termination.
This proof-of-concept tool demonstrates the possibility of defeating such rootkits by removing Kernel Native APIs hooks and restoring the ServiceTable entries back to their original state.
Platform: |
Size: 8192 |
Author: Mimi |
Hits: