hook-kernel-tut-5

Rootkits技术在信息安全领域越来越受到重视，各种Anti-rootkits新技术不断出现。在各种Anti-root- kits工具的围剿下，常规的Rootkits隐藏技术难以遁形。在系统分析和深入研究传统内核级Rootkits隐藏技术的基 础上，提出了一个集驱动模块整体移位、内核线程注入、IRP深度内联Hook 3种技术为一体的Rootkits隐藏技术体 系。(Rootkits technology in the field of information security more and more attention, all kinds of Anti-rootkits new technologies continue to emerge. In a variety of Anti-root-kits Tools of the siege, the conventional Rootkits hide the technology is difficult to hide. In traditional systems analysis and in-depth study of kernel-level Rootkits hiding technique is proposed based on a set of drive module as a whole shift, into the kernel thread, IRP depth inline Hook 3 kinds of technology as one of the Rootkits hide the technical system.)

strawhat_模块 远程HOOK 操作_call地址取机器码操作_jmp地址取机器码(strawhat_ HOOK module remote operation _call address fetch operation _jmp machine code machine code fetch address)

监视注册表写操作的钩子程序,包括写注册表启动程序和注册表钩子两部分.(surveillance registry write hook procedures, including written procedures and start the registry registry hook two parts.)

QQ 盗号模拟， 监视键盘程序。 做的比较粗糙点(QQ simulated ones, monitor keyboard procedures. Rough point of comparison to do)

This is a dosx viral code

一个通过修改DLL文件的IAT表来实现的hook开发包源码(A DLL file by modifying the IAT table to achieve the hook development kit source)

有一种按键，看起来是一幅完整的图片，当鼠标移到按键区域时，图片的一部分凸现，形成一个按键，当鼠标移走时又恢复原来状态。(There is a button looks like a complete picture when the mouse is moved to the key areas, the picture is part of the highlights, the formation of a button when the mouse is moved Shiyou restore the original state.)

地下城盗号收信,绑定信箱收信 帐号密码验证，百分之九十正确(Dungeons hacking receivers, bound-mail recipient account password authentication, ninety percent correct)

钩子的应用程序，读取键盘和鼠标的状态，并且显示出来。(zi dong fan yi bu guan yong )

利用鼠标键盘钩子来截获*号密码程序,劲!(use of a mouse and keyboard to hook intercepted* Password procedures, Jin!)