| View previous topic :: View next topic |
| Author |
Message |
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
 Posted: Tue Sep 09, 2008 7:37 pm Post subject: |
 |
|
Even if DKOM isn't the best way to hide a process I would still like to know it. So can you explain this code? Because I really don't get what the point of it is or what it does:
| Code: |
pIoStackIrp = IoGetCurrentIrpStackLocation(Irp);//provides us with our IO_STACK_LOCATION
if(pIoStackIrp && Irp->MdlAddress)
{
target = (var *)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
if(target)
{
if(pIoStackIrp->Parameters.Write.Length == sizeof(var))
{
|
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
 |
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Wed Sep 10, 2008 9:42 am Post subject: |
|
|
pIoStackIrp = IoGetCurrentIrpStackLocation(Irp);//provides us with our IO_STACK_LOCATION
if(pIoStackIrp && Irp->MdlAddress)// if pIoStackIrp != 0 and Irp->MdlAddress != 0) continue
{
target = (var *)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);//DDK Docs states 'The MmGetSystemAddressForMdlSafe is a macro that returns a nonpaged system-space virtual address for the buffer described by the MDL. '
if(target)//if Target != 0
{
if(pIoStackIrp->Parameters.Write.Length == sizeof(var))//check Write length
{
beyond here iono...
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Wed Sep 10, 2008 12:04 pm Post subject: |
|
|
| UnLmtD wrote: | Oh wow! damn, it's still here. Well, at the time I was just starting out, so don't flame me for the bad coded code. I would suggest you to look into FU/FUTo source codes.
omg I used WriteFile 
BTW, hiding an object with DKOM is easily detected without modifying/hooking any other stuff. |
That code was a shameless copy and paste from Rohitab and you know it. I have been quiet up until know but I figure since the topic came up, I should tell people.
http://www.rohitab.com/discuss/index.php?showtopic=23880
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Sep 10, 2008 4:32 pm Post subject: |
|
|
I already knew it was a copy of Rohitab. In fact seeing as that's the first thing that comes up if you search DKOM on google I'm sure most people do.
@BanMe
Why exactly do you need that code though?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
the_undead
Expert Cheater
 Reputation: 1
Joined: 12 Nov 2006
Posts: 235
Location: Johannesburg, South Africa
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
