Including lots of samples of technics the rootkit use. DKOM HOOK




File list:
HT1_202_Code
...........\krnl
...........\....\bin
...........\....\inc
...........\....\...\drvcomm.h
...........\....\Src
...........\....\...\HideProc
...........\....\...\........\HideProc.cpp
...........\....\...\........\MAKEFILE
...........\....\...\........\proclist.cpp
...........\....\...\........\proclistint.h
...........\....\...\........\SOURCES
...........\....\...\........\targets.cpp
...........\....\...\........\targets.h
...........\....\...\HookSSDT
...........\....\...\........\HookSSDT.cpp
...........\....\...\........\MAKEFILE
...........\....\...\........\SOURCES
...........\....\...\scan
...........\....\...\....\caps.cpp
...........\....\...\....\caps.h
...........\....\...\....\debug.h
...........\....\...\....\IATScan.cpp
...........\....\...\....\IATScan.h
...........\....\...\....\makefile
...........\....\...\....\proclist.cpp
...........\....\...\....\proclistint.h
...........\....\...\....\scan.cpp
...........\....\...\....\sources
...........\....\...\....\ssdt.cpp
...........\....\...\....\ssdt.h
...........\....\...\....\sysinf.cpp
...........\....\...\....\sysinf.h
...........\....\...\....\targets.cpp
...........\....\...\....\targets.h
...........\....\...\dirs
...........\....\ddkbuild.bat
...........\....\dirs
...........\....\krnl.vcproj
...........\usr
...........\...\DKOM
...........\...\....\dkom
...........\...\....\....\dkom.cpp
...........\...\....\....\dkom.vcproj
...........\...\....\....\stdafx.cpp
...........\...\....\....\stdafx.h
...........\...\....\....\targetver.h
...........\...\IAT
...........\...\...\IATHookDll
...........\...\...\..........\IATHookDll.cpp
...........\...\...\..........\IATHookDll.vcproj
...........\...\...\..........\stdafx.cpp
...........\...\...\..........\stdafx.h
...........\...\...\SelfInject
...........\...\...\..........\SelfInject.cpp
...........\...\...\..........\SelfInject.vcproj
...........\...\...\..........\stdafx.cpp
...........\...\...\..........\stdafx.h
...........\...\pinject
...........\...\.......\pinject.cpp
...........\...\.......\pinject.vcproj
...........\...\.......\stdafx.cpp
...........\...\.......\stdafx.h
...........\...\res
...........\...\...\rktools.rc
...........\...\...\scan.sys
...........\...\rktoolslib
...........\...\..........\IATInfo.cpp
...........\...\..........\IATInfo.h
...........\...\..........\ProcessInfo.cpp
...........\...\..........\ProcessInfo.h
...........\...\..........\RkException.cpp
...........\...\..........\RkException.h
...........\...\..........\rktools.h
...........\...\..........\rktoolslib.vcproj
...........\...\..........\ScannerModule.cpp
...........\...\..........\ScannerModule.h
...........\...\..........\SSDTEntry.cpp
...........\...\..........\SSDTEntry.h
...........\...\..........\stdafx.cpp
...........\...\..........\stdafx.h
...........\...\..........\VistaOrdinals.h
...........\...\..........\Win2KSP4Ordinals.h
...........\...\..........\Win32Scanner.cpp
...........\...\..........\Win32Scanner.h
...........\...\..........\WinXpOrdinals.h
...........\...\scan
...........\...\....\resource.h
...........\...\....\scan.cpp
...........\...\....\scan.rc
...........\...\....\scan.vcproj
...........\...\....\stdafx.cpp
...........\...\....\stdafx.h
...........\...\SSDT
...........\...\....\ssdthook
...........\...\....\........\ssdthook.cpp
...........\...\....\........\ssdthook.vcproj
...........\...\....\........\stdafx.cpp
...........\...\....\........\stdafx.h
...........\...\....\........\targetver.h
...........\Demo.sln