ZhuHuiBeiShaDiaoARK

Similar PChunter ano tools, was written on the play, now do you, process that most of them in the application layer. Not so good, perfect in the future.

Support

Windows7 x64 only

function

1. Process, thread, process, process module, the process window memory information view, kill process, thread, uninstall the module, etc
2. The kernel driver module view, support memory copy of kernel driver modules
3. The SSDT, Shadow SSDT, FSD, KBD, TCPIP, Classpnp, Atapi, Acpi, SCSI, IDT, GDT information view, and can detect and restore SSDT hooks and inline hooks
4. The CreateProcess, CreateThread, LoadImage, CmpCallback, BugCheckCallback, Shutdown, such as the Lego Notify Routine check information, and support for these Notify the deletion of the Routine
5. Port information view
6. Check the news hook
7. The kernel module of iat, eat, inline hooks, patches, detection and recovery
8. Disk, volume, keyboard, network layer, such as filter drivers detection, and support to delete
9. The registry editor
10. Process iat, eat, inline hooks, patches, detection and recovery
11. The file system view, to support the basic file operations
12. Look at startup, service (editor)
13. The ObjectType Hook detection and recovery
14. Detection of DPC timer and delete
15. The MBR Rootkit detection and repair
16. The kernel object hijack detection
17. WorkerThread enumeration
18. Some of Ndis callback information enumeration
19. Detection of debugging of hardware debug registers, relevant API
20. Enumeration/disable SFilter/Fltmgr callback
21. Detection of system user name
22. The process/module/kernel module protection, hide, disguise
23. The dynamic and static abolition of Windows 7 ~ doing DSE arithmetic and PG abolishing win10 PG and DSE arithmetic of dynamic static win10 DSE arithmetic
24. The dynamic open Windows 7 ~ win 10 local kernel debugging support
25. Some small rootkit function

Environment

Vs2015 + wdk10 MFC

This project is still in development