版权所有：
软件版本：
文件大小：25.56 K
操作系统：win9x/NT/2000/XP
下载说明： 工具来源：http://www.security.org.sg/code/kproccheck.html Win32 Kernel Rootkits hide running processes from users using techniques like Kernel Native API Hooking, or by directly unlinking the process's EPROCESS entry from ActiveProcessLinks. Such techniques are very effective in hiding processes, and are very difficult to detect with user-mode tools. This proof-of-concept tool demonstrates how hidden processes can be detected by directly traversing both the Kernel's ActiveProcessList and the Kernel scheduler's ETHREAD lists. This tool can also traverse the Kernel's PsLoadedModuleList to detect kernel modules/drivers that are hidden by hooking the ZwQuerySystemInformation native API.

【立即下载】
下载的书籍需要相应的阅读器才能查看，请到如果你的机器上没有相应的阅读器，请到 图书阅读工具 栏目中下载相关的工具。