hostzhen / sysark
Sysark全称system anti-rootkit，是我学习内核写的工具（2013年的代码，后续不会再更新），里面基本上所有的功能都是用内核实现的。这里只是实现了反rootkit部分功能，作为工具的话，本人觉得还欠完善，但作为学习，或有人需要。目前针对的是XP SP2，对于其它版本的系统或者BSOD的问题，需要的人DIY一下。目前实现的功能： 进程/线程/模块、 驱动模块、 SSDT、 Shadow SSDT、 注册表——解析hive文件、 文件、 启动项、 服务
☆27Updated 7 years ago
Alternatives and similar repositories for sysark:
Users that are interested in sysark are comparing it to the libraries listed below
- x64 Kernel Hooks Detection☆24Updated 8 years ago
- 管道监视器,类似于spyxx之类的东西,一般用于监视目标进程的系统调用.关键词:detours+piep☆23Updated 11 years ago
- ☆30Updated 6 years ago
- ☆40Updated 5 years ago
- Map memory to user space and manipulate user memory, using capmon☆23Updated 6 years ago
- Demo List cm/ps/ob/minifilter callback And Patch/Bypass it☆28Updated 7 years ago
- ☆27Updated 6 years ago
- You don't need install any wdk for development kernel driver☆24Updated 6 years ago
- An ark tool's driver☆40Updated 7 years ago
- Basic Injector running on x64 machines that is able to load into x64 AND x86 processes☆21Updated 5 years ago
- copy of tdifw lib☆10Updated 7 years ago
- windows inlinehook R3 R0☆11Updated 7 years ago
- windows kernel File redirection☆20Updated 10 years ago
- Windows NDIS 6.3 Protocol Driver that provides usermode access to an IsoSwitch or CrowdSwitch☆10Updated 6 years ago
- ☆23Updated 7 years ago
- map driver to memory☆25Updated 6 years ago
- A collection of Windows Administrator tools☆17Updated 11 years ago
- WIP - Play with Intel VM Extensions☆21Updated 7 years ago
- ☆14Updated 9 years ago
- ☆33Updated 4 years ago
- just an lite AntiRootkit for interesting☆23Updated 9 years ago
- network filter driver that control network send speed, based on windows tdi framework.☆31Updated last year
- 粗暴地枚举管理内核的WFP对象。 Manage kernel WFPs in a brutal way.☆26Updated 7 years ago
- profiling tool for analysising the games, get all the characteristic by hook d3d☆17Updated 10 years ago
- enable libemu run pe file and add some good modify☆14Updated 6 years ago
- x64HOOK库☆18Updated 5 years ago
- 逆的或者收集的别人家的代码☆27Updated 2 months ago
- 进程保护、进程过滤的小工程、主要亮点是在内核中对操作系统中的用户进行管理☆15Updated 10 years ago
- 常用代码类☆13Updated 10 years ago
- by others☆38Updated 7 years ago