My first SSDT hook driver

[Nytro]

[h=1]My first SSDT hook driver[/h]by zwclose7

Hello, this is my first SSDT hook driver. My driver will hook NtTerminateProcess, NtLoadDriver, NtOpenProcess and NtDeleteValueKey.

NtTerminateProcess hook

This hook will protect any process named calc.exe from being terminated.

NtLoadDriver hook

This hook will display the driver name in the debugger/DebugView.

NtOpenProcess hook

This hook will deny access to any process named cmd.exe, and will return STATUS_ACCESS_DENIED if the process name match.

NtDeleteValueKey hook

This hook will protect any values named abcdef from being deleted.

To load the driver, run the loader.exe in the release folder. This program will install the driver to the system, and then load it. All functions will be unhooked when the driver unloads. [h=4]Attached Files[/h]

• SSDTHook.zip 287.99K 39 downloads
  

Sursa: My first SSDT hook driver - rohitab.com - Forums

zwclose7

[m@mb@]

Din aceeasi categorie