瑞星卡卡安全论坛

原帖由 aaccbbdd 于 2008-8-24 10:40:00 发表
咳咳
楼上的
什么乱七八糟的
不想要实习生结业证了

楼主
在开机杀毒软件杀掉刚刚提到的rookits后

把我制定的的规则导......

利用伪造内核文件来绕过IceSword的检测
创建时间：2005-12-20
文章属性：原创
文章提交：backspray (nimaozhi_at_163.com)
作者：倪茂志
邮件：backspray008@gmail.com
完成于：2005.12.20

文章分为八个部分：
                一、为什么需要伪造内核
                二、伪造内核文件
                三、隐藏进程
                四、隐藏内核模块
                五、隐藏服务
                六、隐藏注册表
                七、隐藏文件
                八、关于端口
http://www.xfocus.net/articles/200512/841.html

Create the Unload Routine
The next piece of code we will look at is the unload routine. This is required in order to be able to unload the device driver dynamically. This section will be a bit smaller as there is not much to explain.

VOID Example_Unload(PDRIVER_OBJECT  DriverObject)
{   
   
    UNICODE_STRING usDosDeviceName;
   
    DbgPrint("Example_Unload Called \r\n");
   
    RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\Example");
    IoDeleteSymbolicLink(&usDosDeviceName);

    IoDeleteDevice(DriverObject->DeviceObject);
}
You can do whatever you wish in your unload routine. This unload routine is very simple, it just deletes the symbolic link we created and then deletes the only device that we created which was \Device\Example.

http://www.codeproject.com/KB/system/driverdev.aspx

原帖由 aaccbbdd 于 2008-8-24 11:17:00 发表
兼容模式运行也不行？:default3:

Wsyscheck呢？