Fri, 21 Nov 2008 22:16:00 GMThttp://blog.csdn.net/chenhui530/http://blog.csdn.net/chenhui530/archive/2008/11/21/3347843.aspxhttp://blog.csdn.net/chenhui530/comments/3347843.aspx0http://blog.csdn.net/chenhui530/comments/commentRss/3347843.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=3347843VB 驱动加载类(直接使用NtLoadDriver加载方式)<img src ="http://blog.csdn.net/chenhui530/aggbug/3347843.aspx" width = "1" height = "1" />Sat, 22 Nov 2008 06:16:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/11/21/3347843.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/11/21/3347843.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/11/16/3311123.aspxhttp://blog.csdn.net/chenhui530/comments/3311123.aspx2http://blog.csdn.net/chenhui530/comments/commentRss/3311123.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=3311123VB 驱动控制类<img src ="http://blog.csdn.net/chenhui530/aggbug/3311123.aspx" width = "1" height = "1" />Sun, 16 Nov 2008 21:24:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/11/16/3311123.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/11/16/3311123.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/11/15/3307742.aspxhttp://blog.csdn.net/chenhui530/comments/3307742.aspx0http://blog.csdn.net/chenhui530/comments/commentRss/3307742.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=3307742使用ZwQueryVirtualMemory枚举进程模块<img src ="http://blog.csdn.net/chenhui530/aggbug/3307742.aspx" width = "1" height = "1" />Sun, 16 Nov 2008 07:57:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/11/15/3307742.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/11/15/3307742.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/10/21/3119107.aspxhttp://blog.csdn.net/chenhui530/comments/3119107.aspx7http://blog.csdn.net/chenhui530/comments/commentRss/3119107.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=3119107VB 远程注入/卸载/自我删除(RtlCreateUserThread)<img src ="http://blog.csdn.net/chenhui530/aggbug/3119107.aspx" width = "1" height = "1" />Wed, 22 Oct 2008 05:13:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/10/21/3119107.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/10/21/3119107.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/10/10/3053049.aspxhttp://blog.csdn.net/chenhui530/comments/3053049.aspx3http://blog.csdn.net/chenhui530/comments/commentRss/3053049.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=3053049演示了在Ring0下通过FILE_OBJECT获取文件路径<img src ="http://blog.csdn.net/chenhui530/aggbug/3053049.aspx" width = "1" height = "1" />Sat, 11 Oct 2008 05:29:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/10/10/3053049.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/10/10/3053049.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/09/23/2970243.aspxhttp://blog.csdn.net/chenhui530/comments/2970243.aspx33http://blog.csdn.net/chenhui530/comments/commentRss/2970243.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=2970243病毒诊断分析程序（病毒分析师的福音）<img src ="http://blog.csdn.net/chenhui530/aggbug/2970243.aspx" width = "1" height = "1" />Wed, 24 Sep 2008 06:30:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/09/23/2970243.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/09/23/2970243.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/09/05/2887561.aspxhttp://blog.csdn.net/chenhui530/comments/2887561.aspx28http://blog.csdn.net/chenhui530/comments/commentRss/2887561.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=2887561“天琊 V1.0(测试版)”是一款集进程管理，文件管理，注册表管理，SSDT服务表管理，SHADOW服务表管理，内核模块察看，Inline Hook扫描，日志导出，保险箱，主动防御（主要针对保险箱功能）于一身的强大的安全反病毒辅助工具<img src ="http://blog.csdn.net/chenhui530/aggbug/2887561.aspx" width = "1" height = "1" />Sat, 06 Sep 2008 03:30:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/09/05/2887561.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/09/05/2887561.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/08/03/2761987.aspxhttp://blog.csdn.net/chenhui530/comments/2761987.aspx6http://blog.csdn.net/chenhui530/comments/commentRss/2761987.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=2761987进程-端口-IP地址关联演示2<img src ="http://blog.csdn.net/chenhui530/aggbug/2761987.aspx" width = "1" height = "1" />Mon, 04 Aug 2008 04:02:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/08/03/2761987.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/08/03/2761987.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/07/22/2692962.aspxhttp://blog.csdn.net/chenhui530/comments/2692962.aspx1http://blog.csdn.net/chenhui530/comments/commentRss/2692962.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=2692962使用NtQueryDirectoryFile遍历文件/目录<img src ="http://blog.csdn.net/chenhui530/aggbug/2692962.aspx" width = "1" height = "1" />Wed, 23 Jul 2008 06:44:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/07/22/2692962.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/07/22/2692962.aspxchenhui530http://blog.csdn.net/chenhui530/archive/2008/06/01/2500112.aspxhttp://blog.csdn.net/chenhui530/comments/2500112.aspx9http://blog.csdn.net/chenhui530/comments/commentRss/2500112.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=2500112VB变态应用之“移花接木”<img src ="http://blog.csdn.net/chenhui530/aggbug/2500112.aspx" width = "1" height = "1" />Sun, 01 Jun 2008 08:20:00 +0800chenhui530http://blog.csdn.net/chenhui530/archive/2008/06/01/2500112.aspx#Feedbackhttp://blog.csdn.net/chenhui530/archive/2008/06/01/2500112.aspxchenhui530