一不小心从某软件里看到一个强大的dll与强大的sys，直接上图看dll的导出函数：
看到了吗，可以直接调一下就隐藏进程。
由于这个软件的使用范围还非常的广，所有这两个文件基本已被杀软白名单放过，上传到virustotal上看看：
sys文件: 结果: 1/41 (2.44%)
...
日历
文章归档
- 2010 August (4)
- 2010 July (1)
- 2010 May (4)
- 2010 March (9)
- 2010 February (1)
- 2010 January (1)
- 2009 December (1)
- 2009 November (3)
- 2009 October (1)
- 2009 August (3)
- 2009 July (5)
- 2009 June (1)
- 2009 May (1)
- 2009 March (2)
- 2009 February (2)
- 2009 January (1)
- 2008 December (2)
- 2008 November (2)
- 2008 October (3)
- 2008 September (5)
- 2008 August (2)
- 2008 June (1)
- 2008 April (1)
- 2008 March (2)
- 2008 February (1)
- 2008 January (1)
- 2007 December (1)
- 2007 November (2)
- 2007 October (4)
- 2007 September (4)
- 2007 August (3)
- 2007 July (3)
- 2007 June (2)
- 2007 April (3)
- 2007 March (3)
- 2007 February (11)
Tags
- 编程 (20)
- 日记 (15)
- 驱动 (15)
- 杀毒软件、防火墙 (12)
- 溢出 (7)
- IE卫士 (7)
- 0day (7)
- 脚本注入 (6)
- 算法 (6)
- 漏洞 (6)
- BUG (6)
- 后门、远程控制 (5)
- 木马 (5)
- 电脑技术 (4)
- rootkit (3)
- 跨站 (3)
- x64 (3)
- widbg (3)
- Shellcode (3)
- 数据库 (2)
- ISAPI (2)
- IIS (2)
- 傲游 (2)
- XSS (2)
- 自启动 (2)
- windows7 (2)
- 隐藏 (2)
- ida (2)
- OD (2)
- 盗号器 (1)
- 密码相关 (1)
- MFC (1)
- CSS (1)
- 心理测试 (1)
- 北京 (1)
- 南京大屠杀 (1)
- 长城 (1)
- 经典 (1)
- 捆绑 (1)
- WEP (1)
- 生活成本 上海 (1)
- 数字电视 (1)
- IceSword (1)
- 江大 (1)
- 内存 (1)
- 冲突 (1)
- DLL (1)
- 异常; (1)
- 文件格式分析 (0)
- 解答 (0)