KProcCheck-0.1.zip提交时间：2004-09-09 提交用户：eyas 工具分类：入侵检测 运行平台：Windows 工具大小：26171 Bytes 文件MD5 ：1710e011e9c1492221f5895ced0c1dee 工具来源：http://www.security.org.sg/code/kproccheck.html Win32 Kernel Rootkits hide running processes from users using techniques like Kernel Native API Hooking, or by directly unlinking the process's EPROCESS entry from ActiveProcessLinks. Such techniques are very effective in hiding processes, and are very difficult to detect with user-mode tools. This proof-of-concept tool demonstrates how hidden processes can be detected by directly traversing both the Kernel's ActiveProcessList and the Kernel scheduler's ETHREAD lists. This tool can also traverse the Kernel's PsLoadedModuleList to detect kernel modules/drivers that are hidden by hooking the ZwQuerySystemInformation native API. >> 下载 << |
