(The micro-point automatic protection software is a relatively powerful main defense program, which uses a lot of very humble, leading and high-end technologies. It has been developed in 2005, but not many people pay attention to it, but it is not known to prevent viruses. The Trojan's talent is indeed very powerful. In November 2008, I roughly looked at the 13 drivers it included, reversed part of it, and learned some common sense from it, but it was only the tip of the iceberg. Later, for various reasons, I didn't touch it again. .Provide some of the effects that have been reversed for reference! From this capital guess, you may get some of the following skills: 1. Encryption and decryption functions 2. IATHOOK/EATHOOK/Deep CallHook/InlineHook/(Shadow)SSDTHook and its messy Management 3. Some undisclosed structures in win32k.sys and their micro-points are used to cite/manage exposed functions in ShadowSSDT (for example, to determine the validity of the form, and to score suspiciousness) 4. The stack traceback is all-purpose Extremely extreme play/stack kidnapping and rolling back and forth the harmful behavior of Trojan horses Blocking points and their principles
.....too many files .....)
收藏
