IE恢复器.rar

用VC6.0制作控制面板应用程序-with VC6.0 production control panel applications

这篇文档是在Windows NT操作系统下隐藏对象、文件、服务、进程等的技术。这种方法是基于Windows API函数的挂钩。 这篇文章中所描述的技术都是从我写rootkit的研究成果，所以它能写rootkit更有效果并且更简单。这里也同样包括了我的实践。 在这篇文档中隐藏对象意味着改变某些用来命名这些对象的系统函数，使它们将忽略这些对象的名字。这样一来我们改动的那些函数的返回值表示这些对象根本就不存在。 最基本的方法(除去少数不同的)是我们用原始的参数调用原始的函数，然后我们改变它们的输出。 在这篇文章里将描述隐藏文件、进程、注册表键和键值、系统服务和驱动、分配的内存还有句柄。-This document is in the Windows NT operating system hidden objects, documents, services, process technology. This method is based on the Windows API function link. This article describes techniques are, I wrote rootkit from the results of research, so it was rootkit more effective and more simple. Here, too, including my practice. In this document hidden object means certain changes to these objects naming system functions so that they will ignore these objects by name. So we change those functions return values, said these objects simply do not exist. The most basic method (excluding a few different) is that we should call the original parameters of the original function, and then we change their

经典的远程线程插入代码CreateRemoteThread-The classic long-range thread insert code CreateRemoteThread

读写ini文件profile,是一个比较典型的好例子.希望给有需要的人带来帮助.

进程调度算法，利用设置优先级算法来实现。-Process scheduling algorithm, used to set priority algorithm to achieve.

列举系统当前活动的进程-cited the current system of process

取自别处，共同学习，看完删除，尊重原作者的版权，使用时请注明出处。scsi编程举例，masm环境。-from elsewhere, studying together, reading deleted, respect the original author"s copyright, when used with the territory. SCSI Programming For example, can the environment.

helps in memeory management.

该程序是说明如何动态加载驱动程序的一个小例子-the program is how dynamic loading driver of a small example

DELPHI编写的HOOK API实现DLL全局钩子启动记事本的程序-DELPHI prepared HOOK API to achieve the overall hook DLL procedures start Notepad