Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Kernel-Mode Modification<br />
User-Mode<br />
INT 0xNN SYSENTER FAR JMP<br />
Kernel-Mode<br />
KiSystemService()<br />
NtWriteFile()<br />
Hook IDT Hook MSR Inject GDT Entry<br />
KiFastCallEntry()<br />
Hook SSDT Patch System Calls<br />
© <strong>Below</strong> <strong>Gotham</strong> <strong>Labs</strong>, 2009<br />
Object Manager<br />
Object<br />
Object<br />
Object<br />
Alter Kernel<br />
Objects<br />
Ntoskrnl.exe<br />
(Windows Executive)<br />
I/O Manager<br />
Filter Driver<br />
Kernel-Mode Driver<br />
Hook IRP<br />
Install Filter<br />
Driver<br />
11
Change language