﻿<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>C++博客-前世今非-随笔分类-C/C++</title><link>http://www.cppblog.com/newcoding/category/11821.html</link><description>前世五百次的回眸，换来今世的一次擦肩而过。</description><language>zh-cn</language><lastBuildDate>Thu, 17 Sep 2009 12:42:11 GMT</lastBuildDate><pubDate>Thu, 17 Sep 2009 12:42:11 GMT</pubDate><ttl>60</ttl><item><title>hook PsCreateSystemThread</title><link>http://www.cppblog.com/newcoding/archive/2009/09/17/96563.html</link><dc:creator>梵天</dc:creator><author>梵天</author><pubDate>Thu, 17 Sep 2009 12:14:00 GMT</pubDate><guid>http://www.cppblog.com/newcoding/archive/2009/09/17/96563.html</guid><wfw:comment>http://www.cppblog.com/newcoding/comments/96563.html</wfw:comment><comments>http://www.cppblog.com/newcoding/archive/2009/09/17/96563.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/newcoding/comments/commentRss/96563.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/newcoding/services/trackbacks/96563.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 很多RootKit在ring0下利用PsCreateSystemThread来创建系统线程做某些WS的事情，我们平时不利用ARK工具的话，是很难发现这些线程，在某些情况下，需要anti一些特定的rootkit，这里给出一个简单的示例：.h:#pragma&nbsp;once#include&nbsp;&lt;ntddk.h&gt;&nbsp;typedef&nbsp;long&nbsp;LON...&nbsp;&nbsp;<a href='http://www.cppblog.com/newcoding/archive/2009/09/17/96563.html'>阅读全文</a><img src ="http://www.cppblog.com/newcoding/aggbug/96563.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/newcoding/" target="_blank">梵天</a> 2009-09-17 20:14 <a href="http://www.cppblog.com/newcoding/archive/2009/09/17/96563.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>