﻿<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>C++博客-elva-随笔分类-rootkit</title><link>http://www.cppblog.com/elva/category/4335.html</link><description /><language>zh-cn</language><lastBuildDate>Mon, 19 May 2008 22:22:58 GMT</lastBuildDate><pubDate>Mon, 19 May 2008 22:22:58 GMT</pubDate><ttl>60</ttl><item><title>The KLOG Rootkit:A Walk-through</title><link>http://www.cppblog.com/elva/archive/2008/05/14/49815.html</link><dc:creator>叶子</dc:creator><author>叶子</author><pubDate>Wed, 14 May 2008 05:45:00 GMT</pubDate><guid>http://www.cppblog.com/elva/archive/2008/05/14/49815.html</guid><wfw:comment>http://www.cppblog.com/elva/comments/49815.html</wfw:comment><comments>http://www.cppblog.com/elva/archive/2008/05/14/49815.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/elva/comments/commentRss/49815.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/elva/services/trackbacks/49815.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 我们的叫做KLOG的键盘监视例子，是Clandestiny所写的并在在www.rootkit.com上发表了。下面我们来浏览分析一下她的代码。ps:一个比较流行的键盘分层过滤驱动可以在www.sysinternals.com上找到。名字为ctrl2cap。KLOG就是在它的基础上完成的。ROOTKIT.COM这个程序的介绍能在下面找到:www.rootkit.com/newsread.ph...&nbsp;&nbsp;<a href='http://www.cppblog.com/elva/archive/2008/05/14/49815.html'>阅读全文</a><img src ="http://www.cppblog.com/elva/aggbug/49815.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/elva/" target="_blank">叶子</a> 2008-05-14 13:45 <a href="http://www.cppblog.com/elva/archive/2008/05/14/49815.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>awd BIOS rk ,'universal' tst</title><link>http://www.cppblog.com/elva/archive/2007/06/01/25230.html</link><dc:creator>叶子</dc:creator><author>叶子</author><pubDate>Thu, 31 May 2007 17:02:00 GMT</pubDate><guid>http://www.cppblog.com/elva/archive/2007/06/01/25230.html</guid><wfw:comment>http://www.cppblog.com/elva/comments/25230.html</wfw:comment><comments>http://www.cppblog.com/elva/archive/2007/06/01/25230.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/elva/comments/commentRss/25230.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/elva/services/trackbacks/25230.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: &nbsp;&nbsp;<a href='http://www.cppblog.com/elva/archive/2007/06/01/25230.html'>阅读全文</a><img src ="http://www.cppblog.com/elva/aggbug/25230.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/elva/" target="_blank">叶子</a> 2007-06-01 01:02 <a href="http://www.cppblog.com/elva/archive/2007/06/01/25230.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>FU</title><link>http://www.cppblog.com/elva/archive/2007/05/24/24755.html</link><dc:creator>叶子</dc:creator><author>叶子</author><pubDate>Thu, 24 May 2007 06:10:00 GMT</pubDate><guid>http://www.cppblog.com/elva/archive/2007/05/24/24755.html</guid><wfw:comment>http://www.cppblog.com/elva/comments/24755.html</wfw:comment><comments>http://www.cppblog.com/elva/archive/2007/05/24/24755.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/elva/comments/commentRss/24755.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/elva/services/trackbacks/24755.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: &nbsp;&nbsp;<a href='http://www.cppblog.com/elva/archive/2007/05/24/24755.html'>阅读全文</a><img src ="http://www.cppblog.com/elva/aggbug/24755.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/elva/" target="_blank">叶子</a> 2007-05-24 14:10 <a href="http://www.cppblog.com/elva/archive/2007/05/24/24755.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>