91av视频/亚洲h视频/操亚洲美女/外国一级黄色毛片 - 国产三级三级三级三级

資源簡介

基于minifilter框架下的透明加解密源碼。 1 手工加載時自動增加system,explorer.exe,notepad.exe為監控進程 2 添加了異或加密算法 3 取消了不對c分區監控的限制,因為很多虛擬機里只有C分區 安裝和加載說明 1 把engine.inf,engine.sys拷貝到虛擬機里 2 右擊engine.inf,點安裝 3 手工加載進cmd, 輸入 sc start engine 4 手工停止進cmd,輸入 sc stop engine 5 測試時請關閉殺毒軟件,代碼與諾頓殺毒軟件的沖突是由于刷緩存引起的,是能解決的,不過初學者不必關心這個

資源截圖

代碼片段和文件信息

#include?“cache.h“
#include?“file.h“

void?Cc_ClearFileCache(PFILE_object?Fileobject?BOOLEAN?bIsFlushCache?PLARGE_INTEGER?FileOffset?ULONG?Length)
{
BOOLEAN?PurgeRes?;
BOOLEAN?ResourceAcquired?=?FALSE?;
BOOLEAN?PagingIoResourceAcquired?=?FALSE?;
PFSRTL_COMMON_FCB_HEADER?Fcb?=?NULL?;
LARGE_INTEGER?Delay50Milliseconds?=?{(ULONG)(-50?*?1000?*?10)?-1};
IO_STATUS_BLOCK?IoStatus?=?{0}?;

if?((Fileobject?==?NULL))
{
return?;
}

???????Fcb?=?(PFSRTL_COMMON_FCB_HEADER)Fileobject->FsContext?;
if?(Fcb?==?NULL)
{
return?;
}

Acquire:
FsRtlEnterFileSystem()?;

if?(Fcb->Resource)
ResourceAcquired?=?ExAcquireResourceExclusiveLite(Fcb->Resource?TRUE)?;
if?(Fcb->PagingIoResource)
PagingIoResourceAcquired?=?ExAcquireResourceExclusive(Fcb->PagingIoResourceFALSE);
else
PagingIoResourceAcquired?=?TRUE?;
if?(!PagingIoResourceAcquired)
{
if?(Fcb->Resource)??ExReleaseResource(Fcb->Resource);
FsRtlExitFileSystem();
KeDelayExecutionThread(KernelModeFALSE&Delay50Milliseconds);
goto?Acquire;
}

if(Fileobject->SectionobjectPointer)
{
IoSetTopLevelIrp(?(PIRP)FSRTL_FSP_TOP_LEVEL_IRP?);

if?(bIsFlushCache)
{
CcFlushCache(?Fileobject->SectionobjectPointer?FileOffset?Length?&IoStatus?);
}

if(Fileobject->SectionobjectPointer->ImageSectionobject)
{
MmFlushImageSection(
Fileobject->SectionobjectPointer
MmFlushForWrite
)?;
}

if(Fileobject->SectionobjectPointer->DataSectionobject)
{?
PurgeRes?=?CcPurgeCacheSection(?Fileobject->SectionobjectPointer
NULL
0
FALSE?);????????????????????????????????????????????????????
}
??????????????????????????????????????
IoSetTopLevelIrp(NULL);???????????????????????????????????
}

if?(Fcb->PagingIoResource)
ExReleaseResourceLite(Fcb->PagingIoResource?);???????????????????????????????????????
if?(Fcb->Resource)
ExReleaseResourceLite(Fcb->Resource?);?????????????????????

FsRtlExitFileSystem()?;
}

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件?????????13??2010-01-18?14:39??engine\Build.txt

?????文件?????????66??2010-11-17?13:53??engine\engine\buildfre_wxp_x86.err

?????文件???????8271??2010-11-17?13:53??engine\engine\buildfre_wxp_x86.log

?????文件???????2259??2010-11-17?13:53??engine\engine\buildfre_wxp_x86.wrn

?????文件???????2018??2010-10-10?18:56??engine\engine\cache.c

?????文件????????222??2010-01-18?10:36??engine\engine\cache.h

?????文件???????3504??2010-10-10?18:38??engine\engine\common.h

?????文件???????5801??2010-10-10?18:18??engine\engine\ctx.c

?????文件???????1194??2010-10-10?15:37??engine\engine\ctx.h

?????文件???????2481??2010-01-18?11:55??engine\engine\engine.inf

?????文件????????266??2009-08-19?09:48??engine\engine\engine.rc

?????文件??????15016??2010-10-13?09:54??engine\engine\file.c

?????文件???????3744??2010-01-18?10:38??engine\engine\file.h

?????文件?????121786??2008-01-19?13:16??engine\engine\fltKernel.h

?????文件???????1975??2010-01-18?14:35??engine\engine\key.c

?????文件????????528??2010-01-18?14:06??engine\engine\key.h

?????文件???????1230??2010-11-17?13:49??engine\engine\lib.c

?????文件????????977??2010-11-16?20:22??engine\engine\lib.h

?????文件??????75619??2010-11-17?13:52??engine\engine\main.c

?????文件???????9178??2010-11-16?19:09??engine\engine\main.h

?????文件????????399??2009-10-11?09:40??engine\engine\makefile

?????文件???????4882??2010-01-18?14:10??engine\engine\message.c

?????文件????????861??2010-01-18?10:56??engine\engine\message.h

?????文件??????18292??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\cache.obj

?????文件??????22030??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\ctx.obj

?????文件???????4645??2010-11-16?18:33??engine\engine\objfre_wxp_x86\i386\ctx.obj.oacr.root.x86fre.pft.xml

?????文件?????347136??2010-11-17?13:53??engine\engine\objfre_wxp_x86\i386\engine.pdb

?????文件????????992??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\engine.res

?????文件??????26112??2010-11-17?13:53??engine\engine\objfre_wxp_x86\i386\engine.sys

?????文件??????33698??2010-11-16?18:28??engine\engine\objfre_wxp_x86\i386\file.obj

............此處省略35個文件信息

評論

共有 條評論