Results 1 to 15 of 15

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Registered User
    Join Date: Feb:2011
    Location:
    Posts: 7

    The Governor.


  2. #2
    Registered Weasel imweasel's Avatar
    Join Date: Jan:2007
    Location:
    Posts: 3,063
    " " , Process Explorer Microsoft :
    http://technet.microsoft.com/en-us/s...rnals/bb896653

  3. #3
    Registered User
    Join Date: Feb:2011
    Location:
    Posts: 7
    , karnel32.dll dll-. , , , . The Governor. , , . The Governor rootkit dll . - .
    , The Governor.

  4. #4
    rootless wolfshark's Avatar
    Join Date: Dec:2005
    Location:
    Posts: 5,768
    , . imweasel . .
    Crashing is NOT normal. It is accepted as normal because of Windows.
    Ah the Geforce 440 MX...all the power of the Geforce 2MX, without nearly a damn being changed...

  5. #5
    Registered User
    Join Date: Oct:2003
    Location:
    Posts: 4,317
    . Process Explorer, Process Monitor . , , , - , - .

  6. #6
    Bombera's Avatar
    Join Date: Jul:2001
    Location: 4EVA
    Posts: 13,833
    , API .
    EVGA X299 FTW K|i9-7960X@4.7|4x8 Patriot Viper Steel 4000|GTX 1660 Ti|970 EVO 1 TB|Seasonic Focus GX-1000|Xigmatek Elysium|
    Rampage IV Extreme BE|E5-1680v2@4.7|4x4 HyperX 1866|Cougar Aqua 240|GTX 1050 Ti|970 EVO 1/4 TB|CM 850 SilentPro|HAF-X|

  7. #7
    Registered User
    Join Date: Feb:2011
    Location:
    Posts: 7
    Quote Originally Posted by Bombera View Post
    , API .
    . , , The Governor rootkit, , " " . , dll- - . , "download & use", , .

  8. #8
    Bombera's Avatar
    Join Date: Jul:2001
    Location: 4EVA
    Posts: 13,833
    , Vista Seven , Address Space Layout Randomization? , DLL-, . DLL-, API- NVIDIA(nvapi.dll) , . - .
    XP x64 , system service table, rootkit-. .
    - . , user mode , , .
    , .
    EVGA X299 FTW K|i9-7960X@4.7|4x8 Patriot Viper Steel 4000|GTX 1660 Ti|970 EVO 1 TB|Seasonic Focus GX-1000|Xigmatek Elysium|
    Rampage IV Extreme BE|E5-1680v2@4.7|4x4 HyperX 1866|Cougar Aqua 240|GTX 1050 Ti|970 EVO 1/4 TB|CM 850 SilentPro|HAF-X|

  9. #9
    Registered User
    Join Date: Feb:2011
    Location:
    Posts: 7
    XP x32. , , ASM ( ), . IDA, load- dll, IDA , DLL- "DLL loaded ()" . Windows, , dll-, . "Log" , . , , OpenProccess , .

  10. #10
    Bombera's Avatar
    Join Date: Jul:2001
    Location: 4EVA
    Posts: 13,833
    ReadProcessMemory

    , .
    IDA?
    DLL, . , . , . DLL(. ), , .
    , , ( , ).
    EVGA X299 FTW K|i9-7960X@4.7|4x8 Patriot Viper Steel 4000|GTX 1660 Ti|970 EVO 1 TB|Seasonic Focus GX-1000|Xigmatek Elysium|
    Rampage IV Extreme BE|E5-1680v2@4.7|4x4 HyperX 1866|Cougar Aqua 240|GTX 1050 Ti|970 EVO 1/4 TB|CM 850 SilentPro|HAF-X|

  11. #11
    Registered User
    Join Date: Oct:2003
    Location:
    Posts: 4,317
    , IDA - http://www.hex-rays.com/idapro/ . - Windows ( , ). , , .

  12. #12
    Bombera's Avatar
    Join Date: Jul:2001
    Location: 4EVA
    Posts: 13,833
    .
    EVGA X299 FTW K|i9-7960X@4.7|4x8 Patriot Viper Steel 4000|GTX 1660 Ti|970 EVO 1 TB|Seasonic Focus GX-1000|Xigmatek Elysium|
    Rampage IV Extreme BE|E5-1680v2@4.7|4x4 HyperX 1866|Cougar Aqua 240|GTX 1050 Ti|970 EVO 1/4 TB|CM 850 SilentPro|HAF-X|

  13. #13
    Registered User
    Join Date: Feb:2011
    Location:
    Posts: 7
    C/C++, , ( ), .

  14. #14
    Bombera's Avatar
    Join Date: Jul:2001
    Location: 4EVA
    Posts: 13,833
    , .
    DLL - . , , . / . , .
    , , . , - , .
    , , - - -, .
    API , , , , , , . - , .
    Last edited by Bombera; 16th February 2011 at 21:56.
    EVGA X299 FTW K|i9-7960X@4.7|4x8 Patriot Viper Steel 4000|GTX 1660 Ti|970 EVO 1 TB|Seasonic Focus GX-1000|Xigmatek Elysium|
    Rampage IV Extreme BE|E5-1680v2@4.7|4x4 HyperX 1866|Cougar Aqua 240|GTX 1050 Ti|970 EVO 1/4 TB|CM 850 SilentPro|HAF-X|

  15. #15
    Registered User
    Join Date: Feb:2011
    Location:
    Posts: 7
    - . .
    , .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Copyright © 1999-2011 . .
iskamPC.com | mobility.BG | Bloody's Techblog | | 3D Vision Blog |