Syser is a wonderfull tool but not have a lot of plugins for it. I make one plugin (in a beta stage) that have 2 functions:
- Use "gta" or "getaddr" command in Syser control panel for get a kernel function memory address, ex."gta DbgPrint" and you get the memory entry point. Only works with Kernel exported functions (Kernel and Hal).
- Use "hide" command to hide Syser against NtCreateFile (a lot of programs try find Syser using it)
- Use "unhide" command to unhide Syser against NtCreateFile
It is a POC. Only tested in Windows XP Proffesional SP2/SP3 in VMWare and without VMWare with success
For install put in the %SystemFolder%\drivers\plugin\386i and reboot Syser
发表于 2010-4-1 12:54
|
发表于 2010-4-1 12:54
发表于 2010-4-1 13:11
