Mon, 23 Jul 2007 13:01:00 GMT苟日新，日日新，又日新~~http://blog.csdn.net/coding_hello/http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163754/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1702756.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1702756.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1702756本系列的最后一章将探索5种不同的rootkit侦测技术用于发现Windows rootkit的分布。另外还会谈到9种为系统管理员设计的工具。<img src ="http://blog.csdn.net/coding_hello/aggbug/1702756.aspx" width = "1" height = "1" />Mon, 23 Jul 2007 21:01:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/07/23/1702756.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/07/23/1702756.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163754/1465557http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163755/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1668464.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1668464.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1668464本文主要是介绍2005年BlackHat大会上提出的Shadow Walker原型的rootkit技术<img src ="http://blog.csdn.net/coding_hello/aggbug/1668464.aspx" width = "1" height = "1" />Wed, 27 Jun 2007 20:24:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/06/27/1668464.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/06/27/1668464.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163755/1465557http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163756/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1652815.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1652815.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1652815本文是Windows rootkits of 2005系列的第1篇，总共3篇，本篇主要介绍rootkit的定义及相关技术<img src ="http://blog.csdn.net/coding_hello/aggbug/1652815.aspx" width = "1" height = "1" />Fri, 15 Jun 2007 04:36:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/06/14/1652815.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/06/14/1652815.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163756/1465557http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163757/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1643083.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1643083.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1643083本文要说的重点就是通过一个Native Api来完成代码的注入。有了它，不需要动态库文件，不需要VirtualAllocEx，不需要WriteProcessMemory! 听起来不错吧~~哈哈~~答案揭晓，它就是~~铛铛铛~~：<img src ="http://blog.csdn.net/coding_hello/aggbug/1643083.aspx" width = "1" height = "1" />Fri, 08 Jun 2007 06:21:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/06/07/1643083.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/06/07/1643083.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163757/1465557http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163758/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1624615.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1624615.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1624615<img src ="http://blog.csdn.net/coding_hello/aggbug/1624615.aspx" width = "1" height = "1" />Fri, 25 May 2007 04:30:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/05/24/1624615.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/05/24/1624615.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163758/1465557http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163759/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1624607.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1624607.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1624607<img src ="http://blog.csdn.net/coding_hello/aggbug/1624607.aspx" width = "1" height = "1" />Fri, 25 May 2007 04:25:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/05/24/1624607.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/05/24/1624607.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163759/1465557http://item.feedsky.com/~csdn.net/coding_hello/~1460332/18163760/1465557/1/item.htmlhttp://blog.csdn.net/coding_hello/comments/1624604.aspx0http://blog.csdn.net/coding_hello/comments/commentRss/1624604.aspxhttp://tb.blog.csdn.net/TrackBack.aspx?PostId=1624604麦英病毒的行为分析及恢复策略<img src ="http://blog.csdn.net/coding_hello/aggbug/1624604.aspx" width = "1" height = "1" />Fri, 25 May 2007 04:20:00 +0800coding_hellohttp://blog.csdn.net/coding_hello/archive/2007/05/24/1624604.aspxcoding_hellohttp://blog.csdn.net/coding_hello/archive/2007/05/24/1624604.aspxhttp://blog.csdn.net/coding_hello/rss.aspxcsdn.net/coding_hello/~1460332/18163760/1465557