admin管理员组

文章数量:1567740

cardmagic writes: Windows Vista has changed alot on network module, many old port hiding materials are no longer usable.
In this post, I will share with you a simple code to hide port under Vista,hope it is useful for some guys .
Actually under Windows Vista, netstat.exe will call InternalGetTcpTable2 which is exported by Iphlpapi.dll to list all open ports,then InternalGetTcpTable2 will transfer control to NsiAllocateAndGetTable which is exported by nsi.dll, and finally nsi.dll involve NsiEnumerateObjectsAllParametersEx to interact with kernel mode module of NSI -- nsiproxy.sys. nsiproxy.sys is almost like a wrapper of netio.sys, it will then call internal subroutines of netio.sys .
Here ,we will use a relatively easy way -- "NSI Kernel Module Dispatch Routine Hook" to demostrate the specified port hiding uner Vista. Dispatch routine hook is an old topic, this time ,we will apply this method to nsiproxy.sys. Please focus on how to handle the content filtering of NSI:)
Check the following code(Notice: I only tested it under Windows Vista RTM 32bit):

http://www.rootkit/vault/cardmagic/PortHidDemo_Vista.c
 

本文标签： hookModuleNSIHidingvista

版权声明：本文标题：NSI Module Hook : Hiding Port Under Windows Vista 内容由热心网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：https://www.elefans.com/dongtai/1726109572a1055786.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。