Hi guys, we have made anti-rootkit tools these days, and there is the most important place for RK, so we'd like you guys to look at it, and give us some advises :)
In these tools, we use some new tech called mirror system (pretty cool, we hope it worth the name ;p). We mirrored the kernel file, file system driver file, and it can do more. We think the effect is that there will be no more hook(code hook, not include data hook, like NDIS or registry hive hook, for now).
Maybe hook is end of the road. RUK is powerful, but we dont't need to restore the hooked code and the FSD filter also is not a problem, that may lower the risk. We think it's a more stable method, all the system call from the tools through an privacy copy of kernel, of cource the runtime kernel data still the same :>
We don't want to let a good idea just go away, so we made these tools. It's not final, we will improve them all the time and make it really good tools. We'd like to make friends and share thoughts, if you have good ideas, we'd like you to join us and implement it together. See how far it can go, and let it go :)
http://www.rootkit.com/vault/uty/NIAPAntiRootkitTools.rar
In these tools, we use some new tech called mirror system (pretty cool, we hope it worth the name ;p). We mirrored the kernel file, file system driver file, and it can do more. We think the effect is that there will be no more hook(code hook, not include data hook, like NDIS or registry hive hook, for now).
Maybe hook is end of the road. RUK is powerful, but we dont't need to restore the hooked code and the FSD filter also is not a problem, that may lower the risk. We think it's a more stable method, all the system call from the tools through an privacy copy of kernel, of cource the runtime kernel data still the same :>
We don't want to let a good idea just go away, so we made these tools. It's not final, we will improve them all the time and make it really good tools. We'd like to make friends and share thoughts, if you have good ideas, we'd like you to join us and implement it together. See how far it can go, and let it go :)
http://www.rootkit.com/vault/uty/NIAPAntiRootkitTools.rar
Komentar