資源簡介
界面開發(fā)：VS2008 MFC
驅(qū)動開發(fā)：VS2005 ddkwizard
DDK版本：7600.16385.1
調(diào)試工具：Windbg VirtualKD VMware
測試版本：xpsp3 windows7
完成時間：2010.12
軟件作者：kedebug sunweiqq@gmail.com
驅(qū)動開發(fā)：VS2005 ddkwizard
DDK版本：7600.16385.1
調(diào)試工具：Windbg VirtualKD VMware
測試版本：xpsp3 windows7
完成時間：2010.12
軟件作者：kedebug sunweiqq@gmail.com
驅(qū)動包括6大模塊：
1、SSDT/ShadowSSDT檢測與恢復(fù)模塊
2、活動進(jìn)程信息檢測與判別模塊
3、驅(qū)動模塊檢測與判別模塊
4、HookEngine? 模塊（部分代碼逆向自cnnic流氓驅(qū)動）
5、自我保護(hù)模塊（借鑒FUTo rootkit，采用了大量而又骯臟DKOM技術(shù)）
6、文件過濾模塊（基于微軟sfilter庫）（雛形）
代碼片段和文件信息
//?Page1.cpp?:?實(shí)現(xiàn)文件
//
#include?“stdafx.h“
#include?“Page1.h“
#include?“ScDetective.h“
#include?
extern?CDriver?theDriver;
extern?CStatic*?theStatus;
//?CPage1?對話框
IMPLEMENT_DYNAMIC（CPage1?CDialog）
CPage1::CPage1（CWnd*?pParent?/*=NULL*/）
:?CDialog（CPage1::IDD?pParent）
{
????pSsdtName?=?NULL;
????pSsdtNativeAddress?=?NULL;
????NumOfFunName?=?0;
????NumOfNativeAddress?=?0;
????memset（StatusBuffer?0?128?*?2）;
????pSsdtName?=?GetSsdtNativeFunNames（&NumOfFunName）;
????pSsdtNativeAddress?=?GetSsdtNativeFunAddresses（&NumOfNativeAddress）;
}
CPage1::~CPage1（）
{
????if?（pSsdtNativeAddress）??GlobalFree（pSsdtNativeAddress）;
????if?（pSsdtName）??GlobalFree（pSsdtName）;
}
void?CPage1::DoDataExchange（CDataExchange*?pDX）
{
????CDialog::DoDataExchange（pDX）;
????DDX_Control（pDX?IDC_LIS?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\Common\
?????文件????????1778??2014-04-18?07:56??ScDetective-master\Common\DataStruct.h
?????文件????????1930??2014-04-18?07:56??ScDetective-master\Common\IoControlCmd.h
?????文件?????????798??2014-04-18?07:56??ScDetective-master\Common\MajorFunctionName.h
?????文件???????23021??2014-04-18?07:56??ScDetective-master\Common\VistaShadowSSDT.h
?????文件???????19177??2014-04-18?07:56??ScDetective-master\Common\W2K3ShadowSSDT.h
?????文件???????34052??2014-04-18?07:56??ScDetective-master\Common\W2KShadowSSDT.h
?????文件???????24969??2014-04-18?07:56??ScDetective-master\Common\Win7ShadowSSDT.h
?????文件???????19203??2014-04-18?07:56??ScDetective-master\Common\XPShadowSSDT.h
?????文件?????????491??2014-04-18?07:56??ScDetective-master\Common\ring3common.h
?????文件????????1878??2014-04-18?07:56??ScDetective-master\README.md
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\
?????文件?????????879??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective.sln
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\Driver\
?????文件????????5301??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\Driver\Driver.cpp
?????文件????????1262??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\Driver\Driver.h
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\File\
?????文件????????4621??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\File\File.cpp
?????文件?????????524??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\File\File.h
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\OS\
?????文件????????4861??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\OS\OS.cpp
?????文件?????????462??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\OS\OS.h
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\PE\
?????文件????????3668??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\PE\PE.cpp
?????文件?????????443??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\PE\PE.h
?????目錄???????????0??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\module\
?????文件????????6312??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\module\Module.cpp
?????文件?????????579??2014-04-18?07:56??ScDetective-master\ScDetective\ScDetective\Function\module\Module.h
............此處省略105個文件信息
- 上一篇：c++ 滴滴打車 業(yè)務(wù)
- 下一篇：c++自定義對話框
評論
共有 條評論