資 源 簡 介

檢測windows下rootkit對文件的隱藏。some usermode overwrites first few bytes of ZwQueryDirectoryFile and that trick will fail then :( So, you will probably need a small database of the correct indexes for all Windows versions

您 可 能 感 興 趣 的