1 / 11

Intercessor

/* First Release BY CSK & Messiah */. Intercessor. Code Name {. //Super Task Manager. }. // 任务完成情况. P. 基本部分. 拓展部分. P. 显示进程模块. P. CPU 使用率统计. *. 内核进程描述. P. 内核态下实现进程的监控. 禁止系统运行某个可执行文件. P. 进程创建或者退出自动刷新进程列表. P. 强制进程结束. P. 防止自身非法关闭或调试. P. 搜索隐藏进程. //That’s It!.

vilmaris-nellis
Download Presentation

Intercessor

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. /* First Release BY CSK & Messiah */ Intercessor Code Name { //Super Task Manager }

  2. //任务完成情况 P 基本部分 拓展部分 P 显示进程模块 P CPU使用率统计 * 内核进程描述 P 内核态下实现进程的监控 禁止系统运行某个可执行文件 P 进程创建或者退出自动刷新进程列表 P 强制进程结束 P 防止自身非法关闭或调试 P 搜索隐藏进程

  3. //That’s It!

  4. //Very short introduction… FEATURES

  5. //Very short introduction…: @Features +列举当前进程 +内核级别进程搜索 +采用直接内存搜索获取EPROCESS +不借助API，直接从EPROCESS获取进程信息 +可以探测多种*隐藏进程 +内核级别进程创建/销毁监控 +获取EPROCESS地址 +获取父亲PID, 登陆用户帐户, 内存/虚拟内存使用, 进程权限

  6. //Very short introduction…: @Features +进程详细信息 +显示程序版本 +显示程序描述 +程序加载模块

  7. //Very short introduction…: @Features +进程操作 +关闭与强制杀死进程 +设置进程优先级 +调试进程 +运行进程

  8. //Very short introduction… architecture

  9. //Very short introduction…: @Architecture OpenSection(); Change ACL Table Read/Set EPROCESS CALLGATE? KernelHacker? Physical Memory IoDeviceControl(); Direct Eprocess Finding SSDT HOOK CreateProcessRoutineHook

  10. Q&A

  11. Thank you

More Related