VBTSTN00

可以实现内核钩子的检测，分为应用层和驱动层，带源码(Can detect the kernel hooks, into the application layer and the driver layer, with source code)

Rootkits技术在信息安全领域越来越受到重视，各种Anti-rootkits新技术不断出现。在各种Anti-root- kits工具的围剿下，常规的Rootkits隐藏技术难以遁形。在系统分析和深入研究传统内核级Rootkits隐藏技术的基 础上，提出了一个集驱动模块整体移位、内核线程注入、IRP深度内联Hook 3种技术为一体的Rootkits隐藏技术体 系。(Rootkits technology in the field of information security more and more attention, all kinds of Anti-rootkits new technologies continue to emerge. In a variety of Anti-root-kits Tools of the siege, the conventional Rootkits hide the technology is difficult to hide. In traditional systems analysis and in-depth study of kernel-level Rootkits hiding technique is proposed based on a set of drive module as a whole shift, into the kernel thread, IRP depth inline Hook 3 kinds of technology as one of the Rootkits hide the technical system.)

实例13-1：动态链接库（Dll）实例。源代码在光盘中“13dlltest ”目录下。 实例13-2：鼠标钩子应用实例。源代码在光盘中“13MouseHook”目录下。 实例13-3：键盘钩子应用实例。源代码在光盘中“13KeyboardHook”目录下。( dlltest MouseHook KeyboardHook)

全局HOOK一个经典例子,再加一些本人的小修改,希望对跟我一样初学者有帮助.(HOOK A classic example of the overall situation, together with some small modifications, I hope, like me have to help beginners.)

先从键盘输入一个文本文件的文件名(约定：字符数≤127字节，可含路径)和一个字符串(约定：字符数≤20字节，其中不含空格、TAB等，后面称之为Str)，再在屏幕上显示该文件的内容。要求显示完内容后，在屏幕上输出文件的行数(行之间以’ ’为分隔、每行的长度不定但均≤200个字节)、字符串Str在文件中第1次出现的行号和最后一次出现的行号(查找时不区分大小写、不跨行查找，若未找到，则行号显示为-1)。 (Start with the keyboard input of a text file name (convention: the number of characters to ≤ 127 bytes, and can contain the path) and a string (convention: the number of characters ≤ 20 bytes, which contain spaces, TAB, followed by call Str), the contents of the file is displayed on the screen. Requests display content on the screen the number of rows of the output file (the line between ' n' separated, each line has a variable length but ≤ 200 bytes) string Str file a (find the line number and the last line number is not case-sensitive, cross-bank does not find, If you do not find the line number is displayed as-1).)

多种WINDOWS控件的组合用法,没有解压密码,希望对大家有帮助(The combination of a variety of WINDOWS controls usage, not unzip password, hope to help everyone)

HOOK服务器源码，程序调用API函数和易语言模块，实现网络的拦截。(HOOK server source code, the program calls the API function and ease of language modules, network interception.)

A 2D map editor for handling static game maps(A 2 d map editor for handling static game maps)

取焦点窗口句柄或者枚举父窗口和子窗口的句柄。(Take the focus window handle or enumerate the parent window and child window handle.)

屏幕录制，远程桌面传输，基于Windows图形驱动的屏幕截图技术,api hook,win32 gdi ,mirrorDriver(Screen recording, remote desktop transmission, based on the Windows graphics driver screenshots technology, api hook, win32 gdi, mirrorDriver)