NT Service管理程序

This book describes the work with device interfaces in windows kernel

从.net框架中反编译出的nsafeNativeMethods类，在框架中由于是内部类型无法从外界调用。用此类中的IPersistStreamInit接口可实现从内存流中加载图片等文件到WEBBROWSER控件-From. Net framework decompile out nsafeNativeMethods category, in the framework as a result of an internal type can not be called from the outside world. IPersistStreamInit use of such interface can be realized from the memory stream to load images and other documents to the WebBrowser control

这篇文档是在Windows NT操作系统下隐藏对象、文件、服务、进程等的技术。这种方法是基于Windows API函数的挂钩。 这篇文章中所描述的技术都是从我写rootkit的研究成果，所以它能写rootkit更有效果并且更简单。这里也同样包括了我的实践。 在这篇文档中隐藏对象意味着改变某些用来命名这些对象的系统函数，使它们将忽略这些对象的名字。这样一来我们改动的那些函数的返回值表示这些对象根本就不存在。 最基本的方法(除去少数不同的)是我们用原始的参数调用原始的函数，然后我们改变它们的输出。 在这篇文章里将描述隐藏文件、进程、注册表键和键值、系统服务和驱动、分配的内存还有句柄。-This document is in the Windows NT operating system hidden objects, documents, services, process technology. This method is based on the Windows API function link. This article describes techniques are, I wrote rootkit from the results of research, so it was rootkit more effective and more simple. Here, too, including my practice. In this document hidden object means certain changes to these objects naming system functions so that they will ignore these objects by name. So we change those functions return values, said these objects simply do not exist. The most basic method (excluding a few different) is that we should call the original parameters of the original function, and then we change their

一个浏览windows注册表的程序-a browser windows registry procedures

可以用来禁止usb使用-can be used to prohibit the use usb

这是编辑 GRF 文件然后 dobel 点击的 exe 文件与第一次提取中的应用

使用CRegKey类操作注册表 Microsoft的ATL库中提供了一个CRegKey类，用这个类可以很方便地对注册表进行各种操作。 -The use of the registry operation CRegKey category Microsoft

利用VC来实现S3C2440的JTAG源码，非常棒-VC to realize the use of the JTAG source S3C2440, great

使用Windows2000/XP的API函数，编写一个包含两个线程的进程，一个线程用于模拟内存分配活动，一个线程用于跟踪第一个线程的内存行为，而且要求两个线程之间通过信号量实现同步。模拟内存活动的线程可以从一个文件中读出要进行的内存操作-Windows2000/XP use of the API functions, including the preparation of a two-threaded process, a thread used to simulate memory allocation, a thread used to track a thread of memory, but also between two threads through the synchronized signal volume. Simulation of the threads of memory from a paper read out to the memory operation

获取WINDOWS NT下系统时钟的最高中断频率.-access to Windows NT system clock frequency of the maximum disruption.