【专题四】Rootkit的学习与研究

[{"title":"（ 96 个子文件 5.8MB ） 【专题四】Rootkit的学习与研究","children":[{"title":"【专题四】Rootkit的学习与研究","children":[{"title":"Read me.txt <span style='color:#111;'> 2.34KB </span>","children":null,"spread":false},{"title":"Rootkit","children":[{"title":"6. 隐身术","children":[{"title":"1）文件隐藏","children":[{"title":"1）文件隐藏.doc <span style='color:#111;'> 45.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"2）进程隐藏","children":[{"title":"2）进程隐藏.doc <span style='color:#111;'> 48.00KB </span>","children":null,"spread":false}],"spread":true},{"title":"3）注册表键值隐藏","children":[{"title":"BypassRegMon_src.rar <span style='color:#111;'> 52.54KB </span>","children":null,"spread":false},{"title":"HIVE格式解析.doc <span style='color:#111;'> 48.00KB </span>","children":null,"spread":false},{"title":"HIVE文件读写.rar <span style='color:#111;'> 155.66KB </span>","children":null,"spread":false},{"title":"drv.rar <span style='color:#111;'> 35.25KB </span>","children":null,"spread":false},{"title":"BypassRegMon2[1].idb.rar <span style='color:#111;'> 54.62KB </span>","children":null,"spread":false},{"title":"HIVE格式.rar <span style='color:#111;'> 8.01KB </span>","children":null,"spread":false},{"title":"注册表监控弱点演示程序 v0.2 逆向ASM源码及相关资料.doc <span style='color:#111;'> 116.50KB </span>","children":null,"spread":false},{"title":"3）注册表键值隐藏.doc <span style='color:#111;'> 189.50KB </span>","children":null,"spread":false},{"title":"BypassRegMon.rar <span style='color:#111;'> 14.23KB </span>","children":null,"spread":false}],"spread":true},{"title":"4）驱动隐藏","children":[{"title":"4）驱动隐藏.doc <span style='color:#111;'> 10.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"6）更绝的隐藏进程中的dll模块，绕过IceSword的检测","children":[{"title":"6）更绝的隐藏进程中的dll模块，绕过IceSword的检测.doc <span style='color:#111;'> 231.00KB </span>","children":null,"spread":false}],"spread":true},{"title":"5）进程中dll模块隐藏","children":[{"title":"5）进程中dll模块隐藏.doc <span style='color:#111;'> 31.00KB </span>","children":null,"spread":false}],"spread":true},{"title":"7）端口隐藏","children":[{"title":"7）端口隐藏.doc <span style='color:#111;'> 10.50KB </span>","children":null,"spread":false}],"spread":true}],"spread":true},{"title":"8。进程线程监控","children":[{"title":"1）监控进程创建","children":[{"title":"1）监控进程创建.doc <span style='color:#111;'> 30.50KB </span>","children":null,"spread":false},{"title":"protect.rar <span style='color:#111;'> 16.22KB </span>","children":null,"spread":false}],"spread":true},{"title":"2）杀线程","children":[{"title":"2）杀线程.doc <span style='color:#111;'> 23.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"3）保护进程和屏蔽文件执行","children":[{"title":"sysnap.rar <span style='color:#111;'> 2.92KB </span>","children":null,"spread":false},{"title":"3）保护进程和屏蔽文件执行 .doc <span style='color:#111;'> 132.00KB </span>","children":null,"spread":false}],"spread":true}],"spread":true},{"title":"1。 内核hook","children":[{"title":"7）IAT HOOK","children":[{"title":"HybridHook.rar <span style='color:#111;'> 88.50KB </span>","children":null,"spread":false},{"title":"7）IAT HOOK.doc <span style='color:#111;'> 50.00KB </span>","children":null,"spread":false},{"title":"testtest.rar <span style='color:#111;'> 13.42KB </span>","children":null,"spread":false}],"spread":true},{"title":"5）IRP hook","children":[{"title":"5）IRP hook.doc <span style='color:#111;'> 68.00KB </span>","children":null,"spread":false},{"title":"irphook2.rar <span style='color:#111;'> 83.03KB </span>","children":null,"spread":false},{"title":"irphook3.rar <span style='color:#111;'> 506.81KB </span>","children":null,"spread":false},{"title":"irphook1.rar <span style='color:#111;'> 33.43KB </span>","children":null,"spread":false}],"spread":true},{"title":"6）SYSENTER hook","children":[{"title":"6）SYSENTER hook.doc <span style='color:#111;'> 62.00KB </span>","children":null,"spread":false},{"title":"SysEnterHook.rar <span style='color:#111;'> 973B </span>","children":null,"spread":false}],"spread":true},{"title":"1）object hook","children":[{"title":"1）object hook.doc <span style='color:#111;'> 62.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"2）ssdt hook","children":[{"title":"2）ssdt hook.doc <span style='color:#111;'> 51.00KB </span>","children":null,"spread":false},{"title":"SSDT Hook的妙用－对抗ring0 inline hook .doc <span style='color:#111;'> 33.00KB </span>","children":null,"spread":false},{"title":"swk0207.rar <span style='color:#111;'> 5.21KB </span>","children":null,"spread":false}],"spread":true},{"title":"4）idt hook","children":[{"title":"bhwin_keysniff.rar <span style='color:#111;'> 2.90KB </span>","children":null,"spread":false},{"title":"IDT Hook .doc <span style='color:#111;'> 218.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"3）inline-hook","children":[{"title":"cnnic.rar <span style='color:#111;'> 505.84KB </span>","children":null,"spread":false},{"title":"PsLookupProcessByProcessId执行流程学习笔记.doc <span style='color:#111;'> 122.00KB </span>","children":null,"spread":false},{"title":"干掉KV 2008, Rising等大部分杀软.doc <span style='color:#111;'> 93.50KB </span>","children":null,"spread":false},{"title":"句柄啊，3层表啊，ExpLookupHandleTableEntry啊.doc <span style='color:#111;'> 58.00KB </span>","children":null,"spread":false},{"title":"ExpLookupHandleTableEntry.rar <span style='color:#111;'> 400.50KB </span>","children":null,"spread":false},{"title":"搜索未导出的函数地址.doc <span style='color:#111;'> 117.00KB </span>","children":null,"spread":false},{"title":"3）inline-hook.doc <span style='color:#111;'> 36.00KB </span>","children":null,"spread":false},{"title":"ExpLookupHandleTableEntry2.rar <span style='color:#111;'> 400.50KB </span>","children":null,"spread":false},{"title":"360SuperKill学习之--恢复FSD的IRP处理函数.doc <span style='color:#111;'> 62.50KB </span>","children":null,"spread":false},{"title":"kill_SecuritySoftware.rar <span style='color:#111;'> 80.23KB </span>","children":null,"spread":false}],"spread":true},{"title":"8）EAT HOOK","children":[{"title":"利用导出表来禁止一些驱动程序的加载.doc <span style='color:#111;'> 57.50KB </span>","children":null,"spread":false},{"title":"8）EAT HOOK.doc <span style='color:#111;'> 113.50KB </span>","children":null,"spread":false},{"title":"导出表钩子.rar <span style='color:#111;'> 157.88KB </span>","children":null,"spread":false}],"spread":true}],"spread":true},{"title":"2。保护模式篇章第一部分： ring3进ring0之门","children":[{"title":"1)通过调用门访问内核","children":[{"title":"1)通过调用门访问内核.doc <span style='color:#111;'> 74.00KB </span>","children":null,"spread":false},{"title":"test.rar <span style='color:#111;'> 4.58KB </span>","children":null,"spread":false},{"title":"myCallGate.rar <span style='color:#111;'> 3.30KB </span>","children":null,"spread":false}],"spread":true},{"title":"3)通过任务门访问内核","children":[{"title":"MyTaskGate.rar <span style='color:#111;'> 3.59KB </span>","children":null,"spread":false},{"title":"3)通过任务门访问内核.doc <span style='color:#111;'> 191.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"4)通过陷阱门访问内核","children":[{"title":"exe.rar <span style='color:#111;'> 6.31KB </span>","children":null,"spread":false},{"title":"4)通过陷阱门访问内核.doc <span style='color:#111;'> 86.00KB </span>","children":null,"spread":false},{"title":"src.rar <span style='color:#111;'> 6.49KB </span>","children":null,"spread":false}],"spread":true},{"title":"2)通过中断门访问内核","children":[{"title":"2)通过中断门访问内核.doc <span style='color:#111;'> 90.50KB </span>","children":null,"spread":false},{"title":"myIntGate.rar <span style='color:#111;'> 11.29KB </span>","children":null,"spread":false}],"spread":true}],"spread":true},{"title":"4。保护模式篇章第三部分：直接访问硬件","children":[{"title":"2）追加tss默认IO许可位图区域","children":[{"title":"2）追加tss默认IO许可位图区域.doc <span style='color:#111;'> 32.00KB </span>","children":null,"spread":false},{"title":"drv.rar <span style='color:#111;'> 1.85KB </span>","children":null,"spread":false}],"spread":true},{"title":"3）更改tss IO许可位图指向","children":[{"title":"3）更改tss IO许可位图指向.doc <span style='color:#111;'> 50.00KB </span>","children":null,"spread":false},{"title":"porttalk.rar <span style='color:#111;'> 24.79KB </span>","children":null,"spread":false},{"title":"modifyiopmbase.rar <span style='color:#111;'> 10.53KB </span>","children":null,"spread":false}],"spread":true},{"title":"1）修改iopl，ring3直接访问硬件","children":[{"title":"exe.rar <span style='color:#111;'> 6.70KB </span>","children":null,"spread":false},{"title":"1）修改iopl，ring3直接访问硬件.doc <span style='color:#111;'> 54.50KB </span>","children":null,"spread":false},{"title":"drv.rar <span style='color:#111;'> 1.49KB </span>","children":null,"spread":false}],"spread":true}],"spread":true},{"title":"7。ring0中调用ring3程序","children":[{"title":"1) apc方式","children":[{"title":"1) apc方式 .doc <span style='color:#111;'> 36.00KB </span>","children":null,"spread":false},{"title":"KernelExec.rar <span style='color:#111;'> 48.55KB </span>","children":null,"spread":false}],"spread":true},{"title":"2) deviceiocontrol 方式","children":null,"spread":false}],"spread":true},{"title":"3。保护模式篇章第二部分：windows分页机制","children":[{"title":"1）windows分页机制.doc <span style='color:#111;'> 367.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"5。detour 修改函数执行路径，可用于对函数的控制流程进行重定路径。","children":[{"title":"1）detour补丁","children":[{"title":"1）detour补丁.doc <span style='color:#111;'> 61.00KB </span>","children":null,"spread":false},{"title":"Inline HOOK SeSinglePrivilegeCheck.rar <span style='color:#111;'> 17.32KB </span>","children":null,"spread":false}],"spread":true}],"spread":true},{"title":"9。其他","children":[{"title":"1）获取ntoskrnl.exe模块地址的几种办法","children":[{"title":"1）获取ntoskrnl.exe模块地址的几种办法.doc <span style='color:#111;'> 62.00KB </span>","children":null,"spread":false}],"spread":true},{"title":"6）运行期修改可执行文件的路径和Command Line","children":[{"title":"ImgPathChanger.rar <span style='color:#111;'> 335.54KB </span>","children":null,"spread":false},{"title":"6）运行期修改可执行文件的路径和Command Line.doc <span style='color:#111;'> 25.50KB </span>","children":null,"spread":false}],"spread":true},{"title":"11）完整驱动感染代码","children":[{"title":"驱动感染成功[1].V 1.0.080528_sudami.rar <span style='color:#111;'> 200.19KB </span>","children":null,"spread":false},{"title":"11）完整驱动感染代码.doc <span style='color:#111;'> 45.50KB </span>","children":null,"spread":false}],"spread":false},{"title":"7）查找隐藏驱动","children":[{"title":"7）查找隐藏驱动.doc <span style='color:#111;'> 53.00KB </span>","children":null,"spread":false}],"spread":false},{"title":"3）shadow ssdt学习笔记","children":[{"title":"3）shadow ssdt学习笔记.doc <span style='color:#111;'> 39.00KB </span>","children":null,"spread":false}],"spread":false},{"title":"4）高手进阶windows内核定时器之一","children":[{"title":"WorkItem.rar <span style='color:#111;'> 1.73KB </span>","children":null,"spread":false},{"title":"4）高手进阶windows内核定时器之一.doc <span style='color:#111;'> 63.50KB </span>","children":null,"spread":false}],"spread":false},{"title":"2）驱动感染技术扫盲","children":[{"title":"2）驱动感染技术扫盲.doc <span style='color:#111;'> 36.00KB </span>","children":null,"spread":false},{"title":"InfectDriver.rar <span style='color:#111;'> 13.12KB </span>","children":null,"spread":false}],"spread":false},{"title":"10）另一种读写进程内存空间的方法","children":[{"title":"10）另一种读写进程内存空间的方法.doc <span style='color:#111;'> 33.00KB </span>","children":null,"spread":false}],"spread":false},{"title":"5）高手进阶windows内核定时器之二","children":[{"title":"TimerWorks.rar <span style='color:#111;'> 2.27KB </span>","children":null,"spread":false},{"title":"5）高手进阶windows内核定时器之二.doc <span style='color:#111;'> 56.00KB </span>","children":null,"spread":false}],"spread":false},{"title":"9）内核中注入dll的一种流氓方法","children":[{"title":"Apc.rar <span style='color:#111;'> 4.90KB </span>","children":null,"spread":false},{"title":"9）内核中注入dll的一种流氓方法.doc <span style='color:#111;'> 25.00KB </span>","children":null,"spread":false}],"spread":false},{"title":"13）ring0检测隐藏进程","children":[{"title":"13）ring0检测隐藏进程.doc <span style='color:#111;'> 28.00KB </span>","children":null,"spread":false},{"title":"Ring0下搜索内存枚举隐藏进程.doc <span style='color:#111;'> 25.50KB </span>","children":null,"spread":false}],"spread":false},{"title":"12）Hook Shadow SSDT","children":[{"title":"12）Hook Shadow SSDT.doc <span style='color:#111;'> 114.00KB </span>","children":null,"spread":false},{"title":"HookShadowSSDT.rar <span style='color:#111;'> 466.20KB </span>","children":null,"spread":false}],"spread":false},{"title":"8）装载驱动的几种办法","children":[{"title":"8内核模式下装载驱动和原生态应用程序.pdf <span style='color:#111;'> 136.71KB </span>","children":null,"spread":false},{"title":"Loading drivers and Native applications from kernel mode, without touching registry.rar <span style='color:#111;'> 111.37KB </span>","children":null,"spread":false},{"title":"8）装载驱动的几种办法.doc <span style='color:#111;'> 219.00KB </span>","children":null,"spread":false}],"spread":false}],"spread":false}],"spread":true},{"title":"目录里面的文件.txt <span style='color:#111;'> 5.92KB </span>","children":null,"spread":false}],"spread":true}],"spread":true}]