CheckKernelEATHook | ||
GetKernel32Addressx64 | ||
HideProcess | ||
HookDeviceIocontrlFile | ||
Inject | ||
LoadImageCallBack | ||
ProcessManager | ||
ProtectFilex64 | ||
ProtectFilex86 | ||
ProtectProcessx64 | ||
ReloadKernel-XP | ||
SSDT-SSSDT-Manager | ||
ZwQueryVirtualMemory | ||
.gitattributes | ||
.gitignore | ||
README.md |
Windows-Rootkits
CheckKernelEATHook
Reference 3600safeOpenSource
GetKernel32Addressx64
x64 use asm
HideProcess
HideProcess by Remove ProcessList in EPROCESS struct.
HookDeviceIocontrlFile
Reference IOCTL Fuzzer v1.2
Inject
CreateRemoteThread to Inject
Process-Hollowing
ReflectiveDLLInjection
SetThreadContext to Inject support x64 and x86
SetWindowsHookEx to Inject
UserApcInject
LoadImageCallBack
Scan PE's IAT in PsSetLoadImageNotifyRoutine's callback
ProcessManager
Enum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable
Hdie Process By Process Active List/PspCidTable
Monitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx
ProtectFilex64
Protect File in Windows 7 by ObRegisterCallbacks
ProtectFilex86
Hook NtSetInformationFile to change target file
Hook NtWriteFile to write the target file
Hook NtDeleteFile to delete the target file
bind keyboard Filter Driver to avoid "ctrl+c" copy the content
ProtectProcessx64
Protect Process in Windows 7 by ObRegisterCallbacks
ReloadKernel-XP
Reference 3600safeOpenSource
SSDT-SSSDT-Manager
Check SSDT/ShadowSSDT Hook/InlineHook
Resume SSDT/ShadowSSDT Hook/InlineHook
ZwQueryVirtualMemory
Enum Module By NtQueryVirtualMemory