Lilxam

Le blog de lilxam

  • HOME
  • 1. Windows & RE
    • Hidden Dlls
    • Hidden Processes
      • Ring 0
      • Ring 3
    • Hooking
      • Ring 3
        • API Hooking
    • PE
    • Protection logicielle
      • Buffer Overflows Prevention
      • Réalisation d'un packer
    • Ring 0
    • Ring 3
  • 2. Failles
    • Failles applicatives
      • Buffer Overflows
      • Integer Overflows
    • PHP
  • 3. Réseau
  • 4. Crypto & algo
    • Cryptographie
  • 5. Electronique
  • 6. Rlz
    • LPEL
    • SEHOP

Archive for the ‘ Hidden Dlls ’ Category

Hidding Module from the Virtual Address Descriptor Tree

  • March 8th, 2010
  • Posted in 1. Windows & RE . Hidden Dlls . Ring 0

Hi =) Recently I read a post of Ivanlef0u : LdrpHashTable where he was showing how to hide a Dll from this table. So by reading this post we can say that we know 4 techniques to hide a Dll : Unlink from InLoadOrderModuleList. Unlink from InMemoryOrderModuleList. Unlink from InInitializationOrderModuleList. Unlink from LdrpHashTable. Well my purpose is to show you a [ READ MORE ]

  • Français
  • English

Lilxam's

  • Old Blog
  • Repository

Feeds

  • Contact
  • RSS Comments
  • RSS Entries

Translate

    Translate to:

    Powered by Google Translate.

Tags

API Hooking Buffer Overflow BYTE C0000095 Carry Flag CF CreateThread Detect Hidden Processes DWORD Débordement d'entier EMET Entête MZ DOS EPROCESS Hidden Processes Hot Patching IAT IMAGE_DOS_HEADER IMAGE_FILE_HEADER IMAGE_NT_HEADERS IMAGE_OPTIONAL_HEADER implementing SEHOP implémentation SEHOP instruction INTO Int 04h Integer Integer Overflow interruption 04h INTO KeWaitForSingleObject KiWaitListHead LIST_ENTRY OF Optional Header Overflow Overflow Flag PE Ring 0 RtlDispatchException Sections SEHOP signed SizeOfImage Wehntrust Windows 7 Windows Seven

Friends

  • 0vercl0k's Blog
  • Geo's Blog
  • Infond
  • Ivanlef0u's Blog
  • Tuts 4 You
  • Copyright © 2010 Lilxam
  • Theme designed by mono-lab
  • Powerd by WordPress