winapi - Windows Vista/7 Kernel Hooking of Userland -
i'm looking advice on implementing driver under vista , 7 can hook , monitor arbitrary system functions userland process. goal dump arguments system functions called ntdll, kernel32, etc. coming xp, ssdt modification , similar techniques popular. on vista+ there filter drivers , notification routines. either of these meant hooking native functions? driver 32 , 64bit , has play nice patch guard. suggestions welcomed.
obcallback
similar ssdt hooking.
Comments
Post a Comment