一个NT下修改文件的用户属主的程序

c++课程设计源代码，其中的代码无须修改便可以直接编译执行-c++ curriculum design, source code, no need to amend the code of which can be directly translated the implementation of

一个WMI程序(Windows Management Instrumentation)，可以浏览文件系统、查看系统信息、系统进程和服务-a WMI (Windows Management Instrumentation), the file system can browse, view system information, system processes and services

该文帮助 件主要用于学习者对vb的开发带来-The piece is mainly used to help learners bring to the development of vb

windows设备管理器的vc代码，在vc6.0下编译通过-windows Device Manager of vc code, compiled under the vc6.0 through

这个是用来定时关闭计算机的小东西，我个人觉得很实用啊，可以在睡觉的放催眠曲，设定若干分钟后关闭电脑，又不浪费电！-This is a closed computer regularly used the small things, I personally feel very practical ah can sleep in the release Lullaby set number of minutes after the closure of the computer, without wasting electricity!

重命名当前正在使用的文件(如DLL文件)的程序。重启动时才能实现重命名。- The heavy naming presently is using document (for example DLL document) procedure. When heavy start can realize the heavy naming.

之前计划写的沙盘系统，刚写好文件部分，也不算太完善，碰巧有人问起，遂贴上代码大家看去，你可以在此基础上完善之。 代码没什么WS技术，但做文件沙盘还是有不少问题的，需要的朋友可以下-Written before the planned sand table system, just part of the written document, but also not too perfect, someone happened to ask, accordingly paste the code we looked, you can improve on this basis, the. Code no WS technology, but do still have many issues paper sand table, and we need friends can, under

这篇文档是在Windows NT操作系统下隐藏对象、文件、服务、进程等的技术。这种方法是基于Windows API函数的挂钩。 这篇文章中所描述的技术都是从我写rootkit的研究成果，所以它能写rootkit更有效果并且更简单。这里也同样包括了我的实践。 在这篇文档中隐藏对象意味着改变某些用来命名这些对象的系统函数，使它们将忽略这些对象的名字。这样一来我们改动的那些函数的返回值表示这些对象根本就不存在。 最基本的方法(除去少数不同的)是我们用原始的参数调用原始的函数，然后我们改变它们的输出。 在这篇文章里将描述隐藏文件、进程、注册表键和键值、系统服务和驱动、分配的内存还有句柄。-This document is in the Windows NT operating system hidden objects, documents, services, process technology. This method is based on the Windows API function link. This article describes techniques are, I wrote rootkit from the results of research, so it was rootkit more effective and more simple. Here, too, including my practice. In this document hidden object means certain changes to these objects naming system functions so that they will ignore these objects by name. So we change those functions return values, said these objects simply do not exist. The most basic method (excluding a few different) is that we should call the original parameters of the original function, and then we change their

数据库底层函数库接口,采用ANSI-C实现,不支持并发,采用gnu版权发布-underlying database library interface, using ANSI-C achieved, do not support concurrent use gnu copyright release

ALLOC_PRAGMA #ifdef#pragma alloc_text （INIT，驱动入口）#pragma alloc_text SpyFilterUnload 页面）#pragma alloc_text SpyQueryTeardown 页面）#pragma alloc_text SpyConnect 页面）#pragma alloc_text SpyDisconnect 页面）#pragma alloc_text SpyMessage 页面）#endif#define SetFlagInterlocked(_ptrFlags,_flagToSet)（（作废） InterlockedOr （（（挥发性长 *)(_ptrFlags)),_flagToSet))//---------------------------------------------------------------------------例程//---------------------------------------------------------------------------NTSTATUS驱动入口 (俺们 PDRIVER_OBJECT DriverObject俺们 PUNICODE_STRING RegistryPath)/*++常规的描述：驱动程序首次加载时，将调用这个例程。其目的是初始化全局状态，然后注册 FltMgr 开始过滤。参数:DriverObject-指向驱动程序由系统创建的对象的指针代表此驱动程序。RegistryPath-标识在何处的 Unicode 字符串为此参数驱动程序位于在注册表中。返回值：