<?xml version="1.0" encoding="iso-8859-1"?>
<rss version="2.0">
        <channel>
                <title>rootkit.com replied</title>
                <link>http://www.rootkit.com//xmlrplied.php</link>
                <description>: www.rootkit.com replied :</description>
                <language>en-us</language>
                <lastBuildDate>Sat, 31 Jul 2010 08:35:35 PDT</lastBuildDate>
                <generator>edge XML/RSS Feed for www.rootkit.com replied</generator>
 <item>
			 <title><![CDATA[Re: x64 SSDT hook - posted by : vrtulex]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14022&did=edge0&disp=14022>x64 SSDT hook]]></link>
			<description><![CDATA[The size of the entry in the KiServiceTable is the same as on x86. The meaning is different. On x86, it contained address of certain system service, on x64, it contains offset (which must be aligned down to 16 byte, If I rememeber correctly) relative to KiServiceTable itself.

I think that the best you can do is to examine the x64 SSDT in WinDbg. There one can see how it really works.]]></description>
			<category>posts</category>
			<pubDate>Tue, 27 Jul 2010 14:34:21 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: unload driver from itself - posted by : EreTIk]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14046&did=edge0&disp=14046>unload driver from itself]]></link>
			<description><![CDATA[Sorry, of course: ZwUnloadDriver

You can set user-mode APC for any user process, which unload your driver:  call ZwUnloadDriver(...)]]></description>
			<category>posts</category>
			<pubDate>Tue, 27 Jul 2010 06:03:21 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Hiding Tcp Port - posted by : _MAX_]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14050&did=edge0&disp=14050>Hiding Tcp Port]]></link>
			<description><![CDATA[Hello,
im reading about Kernel Objects from Rootkit Subverting book and i have some Unanswered questions
for example:
I want to know how to hide a tcp port via kernel objects.

How to find which object keep this information(For example EPROCESS keep Process information) ?

Is there any list about possible Kernel Object ?

Thanks all
]]></description>
			<category>posts</category>
			<pubDate>Tue, 27 Jul 2010 03:15:56 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: BIOS Rootkit - posted by : rossettoecioccolato]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13961&did=edge0&disp=13961>BIOS Rootkit]]></link>
			<description><![CDATA[I don't think that this question can be answered in the abstract.  It depends on the device.  Some devices have the ability to boot from firmware loaded into SRAM (or VRAM for a GPU).  Basically, you write the firmware to the proper location and do a soft reboot of the device.  Some Broadcom NIC's work that way.  This allows the manufacturer to fix errata; it is also useful during development when...]]></description>
			<category>posts</category>
			<pubDate>Sun, 25 Jul 2010 08:05:42 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: about this forum - posted by : DiabloNova]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13956&did=edge0&disp=13956>about this forum]]></link>
			<description><![CDATA[It's because people like you guys (heavy brain damaged trolls) killed this place :)]]></description>
			<category>posts</category>
			<pubDate>Thu, 22 Jul 2010 00:35:44 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[APC Delivery on X64 system (the right one) - posted by : aall87]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14027&did=edge0&disp=14027>APC Delivery on X64 system (the right one)]]></link>
			<description><![CDATA[Hi all!
I'm an italian developer.
I wrote a Kernel driver that queues an user apc to a process with the objective to map a dll in a user process... Everything work fine: the user mode mapped APC code is this:

APCLoadLibraryFunc PROC
; void APCLoadLibraryFunc(PVOID NormalContext, PVOID  SystemArgument1, PVOID SystemArgument2);
; RCX = NormalContext
; RDX = SystemArgument1
; R8 = SystemArgu...]]></description>
			<category>posts</category>
			<pubDate>Wed, 21 Jul 2010 05:10:34 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[password reset link - posted by : markedu9]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14020&did=edge0&disp=14020>password reset link]]></link>
			<description><![CDATA[Hi, where is the password reset link of this site? I had to create new login, couldn't find a way to reset pw on my orginal accnt. ]]></description>
			<category>posts</category>
			<pubDate>Mon, 19 Jul 2010 11:05:50 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: UNC PATH And NTQueryDirectoryFile - posted by : pain_abator]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14011&did=edge0&disp=14011>UNC PATH And NTQueryDirectoryFile]]></link>
			<description><![CDATA[Thanks for your suggestion
i think i missed  FileIdGlobalTxDirectoryInformation
 from your list

will be trying later]]></description>
			<category>posts</category>
			<pubDate>Sun, 18 Jul 2010 18:48:38 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: How to hide the process cmd.exe - posted by : vrtulex]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14012&did=edge0&disp=14012>How to hide the process cmd.exe]]></link>
			<description><![CDATA[There is another quite easy approach which is more stealth.

Every process is represented by EPROCESS structure and these structures are linked together to form several lists. NtQuerySystemInformation uses ActiveProcessLInks member of the EPROCESS structure to walk all the running processes. So, if you wish to hide from NtQuerySytemInformation, just unlink the process from the list.

However, ...]]></description>
			<category>posts</category>
			<pubDate>Fri, 16 Jul 2010 03:45:43 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: CALL in naked function - posted by : _MAX_]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=14003&did=edge0&disp=14003>CALL in naked function]]></link>
			<description><![CDATA[Thanks alote your helps solve the problem :-)]]></description>
			<category>posts</category>
			<pubDate>Fri, 16 Jul 2010 01:41:56 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: Hide process by path? - posted by : vrtulex]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13981&did=edge0&disp=13981>Hide process by path?]]></link>
			<description><![CDATA[It is possible to get the full name of the process executable from several places:

+ PEB
+ ZwQueryInformationProcess (available from XP)
+ Controlarea member of the EPROCESS structure

I think that the third one is the most reliable. However, you must find the Control Area structure. Try tu use dt nt!_CONTROL* command or something similar to get the name of the symbol representing the struc...]]></description>
			<category>posts</category>
			<pubDate>Sat, 10 Jul 2010 02:04:25 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Conflict between WinDBG with Memory Dump - posted by : _MAX_]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13996&did=edge0&disp=13996>Conflict between WinDBG with Memory Dump]]></link>
			<description><![CDATA[Hi All im doing some Detour patch on NtSetValueKey() i have try Win XP Sp2 with WinDbg+Symbol the Disassemble for this function look like this:
80617292 6a5c            push    5Ch
80617294 68e8fd4d80      push    offset nt!`string'+0x64 (804dfde8)
80617299 e842fef1ff      call    nt!_SEH_prolog (805370e0)
8061729e 33f6            xor     esi,esi
....
but when i try my own Code to Dump memor...]]></description>
			<category>posts</category>
			<pubDate>Thu, 08 Jul 2010 03:00:25 PDT</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: Making device name random - posted by : blackd0t]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13993&did=edge0&disp=13993>Making device name random]]></link>
			<description><![CDATA[Thank you very much! I haven't thought about that.
I can get the name from DriverObject->DriverName in DriverEntry.]]></description>
			<category>posts</category>
			<pubDate>Wed, 07 Jul 2010 05:20:00 PDT</pubDate>
		</item>
		</channel></rss>