Obtaining KeServiceDescriptorTableShadow address
InWindowsNTbasedoperatingsystemeverysystemcalloriginatedinusermodewhichistobeprocessedbythesystem抯kernelmustgothroughthegatetothekernelitselfwhereitwouldbedispatchedandexecuted.ThisgateisaninterruptINT2Eh.Whileontheusersidelibraryntdll.dllhandlesasy
发表于 2010/8/19 下午8:42:20
阅读（32095）
IRP hooking and Device Chains
发表于 2010/8/16 上午12:00:06
阅读（4245）
- 1
