Mirrors
/
Windows-Rootkits
mirror of https://github.com/ciyze0101/Windows-Rootkits
6
0
Fork 0
Code Issues Projects Releases Wiki Activity

ReadMe 

ReadMe
This commit is contained in:
LycorisGuard 2018-08-14 01:25:51 +08:00
parent 0e112ed033
commit 895c86c51a
3 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
HideProcess/ReadMe.txt
View File

@ -1 +1,2 @@
规范代码, 未测试
HideProcess by Remove ProcessList in EPROCESS struct.
Support Windows xp and windows 7 OS, you can add other os's offset of ProcessList in EPROCESS to support more.

8
HideProcess/objfre_win7_amd64/amd64/hideprocess.obj.oacr.root.amd64fre.pft.xml
View File

@ -1,8 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<DEFECTS>
<OACRDEFECTCOUNT>3</OACRDEFECTCOUNT>
<OACRERRORCOUNT>0</OACRERRORCOUNT>
<DEFECT _seq="1"><SFA><LINE>11</LINE><COLUMN>0</COLUMN><FILENAME>hideprocess.c</FILENAME><FILEPATH>c:\users\administrator\documents\github\windows-rootkits\hideprocess\</FILEPATH></SFA><DEFECTCODE>28101</DEFECTCODE><DESCRIPTION>The Drivers module has inferred that the current function is a DRIVER_INITIALIZE function: This is informational only. No problem has been detected.</DESCRIPTION><FUNCTION>DriverEntry</FUNCTION><FUNCLINE>11</FUNCLINE><PATH/></DEFECT>
<DEFECT _seq="2"><SFA><LINE>15</LINE><COLUMN>28</COLUMN><FILENAME>hideprocess.c</FILENAME><FILEPATH>c:\users\administrator\documents\github\windows-rootkits\hideprocess\</FILEPATH></SFA><DEFECTCODE>28155</DEFECTCODE><DESCRIPTION>The function being assigned or passed should be a DRIVER_UNLOAD function: Add the declaration 'DRIVER_UNLOAD UnloadDriver;' before the current first declaration of UnloadDriver.</DESCRIPTION><FUNCTION>DriverEntry</FUNCTION><FUNCLINE>11</FUNCLINE><PATH/></DEFECT>
<DEFECT _seq="3"><SFA><LINE>98</LINE><COLUMN>14</COLUMN><FILENAME>hideprocess.c</FILENAME><FILEPATH>c:\users\administrator\documents\github\windows-rootkits\hideprocess\</FILEPATH></SFA><DEFECTCODE>28159</DEFECTCODE><DESCRIPTION>Consider using 'RtlGetVersion' instead of 'PsGetVersion'. Reason: Obsolete.</DESCRIPTION><FUNCTION>GetWindowsVersion</FUNCTION><FUNCLINE>83</FUNCLINE><PATH/></DEFECT>
</DEFECTS>

3
HideProcess/readme.txt
View File

@ -1 +1,2 @@
规范代码, 未测试
HideProcess by Remove ProcessList in EPROCESS struct.
Support Windows xp and windows 7 OS, you can add other os's offset of ProcessList in EPROCESS to support more.