Posted: Thu Dec 11, 2008 4:19 pm Post subject: NtCreateFileHook
A few people wanted to see a kernel mode hook, here it is.
Just says when NtCreateFile is called and by what process and on what file/object
If NtCreateFile is already hooked, the program will not try to put it's hook in place as this causes a BSOD. McAfee and other AV's usually hook NTCF. It is impossible to hook over it as they will detect a virus and then just rehook.
The Extension 'rar' was deactivated by an board admin, therefore this Attachment is not displayed.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum