<?xml version="1.0" encoding="iso-8859-1"?>
<rss version="2.0">
        <channel>
                <title>rootkit.com replied</title>
                <link>http://www.rootkit.com//xmlrplied.php</link>
                <description>: www.rootkit.com replied :</description>
                <language>en-us</language>
                <lastBuildDate>Wed, 10 Mar 2010 08:04:58 PST</lastBuildDate>
                <generator>edge XML/RSS Feed for www.rootkit.com replied</generator>
 <item>
			 <title><![CDATA[Re: Virtual mouse driver for Windows - posted by : jeffosz]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13778&did=edge0&disp=13778>Virtual mouse driver for Windows]]></link>
			<description><![CDATA[http://en.wikipedia.org/wiki/Microsoft_Active_Accessibility]]></description>
			<category>posts</category>
			<pubDate>Mon, 08 Mar 2010 14:15:09 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: How to modify NDIS packet ? - posted by : sebi]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13772&did=edge0&disp=13772>How to modify NDIS packet ?]]></link>
			<description><![CDATA[Hey

Thanks i didnt knew this post and it help me a lot :p]]></description>
			<category>posts</category>
			<pubDate>Mon, 08 Mar 2010 03:49:57 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[vdm exploit - posted by : NoName123]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13817&did=edge0&disp=13817>vdm exploit]]></link>
			<description><![CDATA[i have a question about recent VDM bug.
ive found disclosure, and trying to write exploit.

assumption 0:
- Assumption 0: Setting up a VDM context requires SeTcbPrivilege. 

...

This restriction can be subverted by requesting the NTVDM subsystem,

well, im on limited user without TcbPrivilege.
when i request ntvdm by executing .com program, ntvdm.exe also doesnt have TcbPrivilege!
run...]]></description>
			<category>posts</category>
			<pubDate>Sun, 07 Mar 2010 13:59:05 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: Error in Building First Rootkit - posted by : ymc]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13779&did=edge0&disp=13779>Erroe in Building First Rootkit]]></link>
			<description><![CDATA[I suggest to down the newest version. You can download the WDK 7.0 in the microsoft site from this URL:
http://www.microsoft.com/whdc/DevTools/WDK/default.mspx

]]></description>
			<category>posts</category>
			<pubDate>Thu, 04 Mar 2010 20:47:32 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: could not unprotect the memory - posted by : NoName123]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13787&did=edge0&disp=13787>could not unprotect the memory]]></link>
			<description><![CDATA[you dont have to VirtualLock pages.
You can access to memory that is paged out, but you must run in irql = PASSIVE_LEVEL. Just dont raise your irql at all, and dont load your driver into nonpaged pool, windows will check this when executing PF.
i dont think memory locking is usefull at all. when you pass poiner to kernel, you have to validate that all data is in userland, and copy it to kernel l...]]></description>
			<category>posts</category>
			<pubDate>Thu, 04 Mar 2010 01:27:13 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: hiding process - posted by : RicVieler]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13791&did=edge0&disp=13791>hiding process]]></link>
			<description><![CDATA[Hi,
that's what i needed.
thanks a lot.]]></description>
			<category>posts</category>
			<pubDate>Mon, 01 Mar 2010 07:51:20 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: User mode .... - posted by : mgkmrkr]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13753&did=multExploiting&disp=13753>User mode ....]]></link>
			<description><![CDATA[Im confused. Computer security works like this: 0-day, patch, 0-day, patch, 0-day, patch, (private research firm finds 0-day), patch... 

"so whats the point of a rootkit if one can't get it on a machine when it gets patched?" 

the point is to use it while it lasts. There is no magic bullet for this kind of stuff, no superKit that will work on all machines and all architectures and all versio...]]></description>
			<category>posts</category>
			<pubDate>Wed, 24 Feb 2010 13:29:28 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: APC injection problems - posted by : tinku]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13744&did=edge0&disp=13744>APC injection problems]]></link>
			<description><![CDATA[
I am also trying to do the same thing in my project, which is trying to run some code in ring3 from the kernel driver. Is it possible for you to share your working source code with me?]]></description>
			<category>posts</category>
			<pubDate>Wed, 24 Feb 2010 07:45:56 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: KeUserModeCallback for another process - posted by : tinku]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13694&did=edge0&disp=13694>KeUserModeCallback for another process]]></link>
			<description><![CDATA[Hi there,

This link is not working. Could you please put the correct link here?]]></description>
			<category>posts</category>
			<pubDate>Wed, 24 Feb 2010 07:44:26 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: hooking interrupt - posted by : j00ru]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13737&did=edge0&disp=13737>hooking interrupt]]></link>
			<description><![CDATA[Hi NoName123!

I have recently came across my friend's blog entry that I believe is somehow related to your problem: http://www.icewall.pl/2009/10/27/vboxvirtual-pcvmware-i-idt-hooking/. Seems like he also had difficulty in setting up an IDT hook correctly under a virtual environment.

Even though the post is written in polish, you can find a tiny table at the very bottom, describing the VMs t...]]></description>
			<category>posts</category>
			<pubDate>Tue, 23 Feb 2010 02:22:32 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: can somebody share ntoskrnl.exe for all windows version ? - posted by : j00ru]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13765&did=edge0&disp=13765>can somebody share ntoskrnl.exe for all windows version ?]]></link>
			<description><![CDATA[Hi,

I hope you are aware of the fact that you can find much more structures (Windows XP SP3, Windows Vista SP2, Windows 7 RTM) on the aforementioned site: http://msdn.msuiche.net/.

Additionally, I dumped the structures you're interested in from my Windows XP SP2 box: http://j00ru.vexillium.org/dump/winxp_sp2_structures.txt

Hope this helps somehow ;)]]></description>
			<category>posts</category>
			<pubDate>Tue, 23 Feb 2010 01:57:30 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Trying to hook HidPenyending , showing page fault - posted by : cowtail]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13769&did=edge0&disp=13769>Trying to hook HidPenyending , showing page fault]]></link>
			<description><![CDATA[I've been trying to modify the professianl rootkit book kit.

I've replaced HOOK( ZwMapViewOfSection, NewZwMapViewOfSection, OldZwMapViewOfSection );
 with HOOK( HidPendingRequest,NewHidPendingRequest,OldHidPendingRequest);

At the moment the newHid just calls the oldHid, mirroring ZwMapViewOfSection.

I though with the error message, it meant that HidPendin
function got paged out.

Any ...]]></description>
			<category>posts</category>
			<pubDate>Sun, 21 Feb 2010 21:40:24 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[hook a static function? - posted by : r2d3]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13768&did=edge0&disp=13768>hook a static function?]]></link>
			<description><![CDATA[hello every1,
I need your suggestion about static declaration function overriding.
It should works if I would do pointer to this funcion?
IOW, malloc_hook should working properly?
or I'll accept any other suggestions about overriding local binding static function.]]></description>
			<category>posts</category>
			<pubDate>Fri, 19 Feb 2010 20:01:05 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Correction of pasted source - posted by : AcceToken]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13760&did=edge0&disp=13760>Hooking Service Shadow table]]></link>
			<description><![CDATA[Correction: Here is the source again
static void EndPart()			\
{
   _asm{
	mov eax, (Return Param)			This Stuff will be copied
	ret (Fixup)				into free non paged kernel memory
   }
}					/


NTAPI NewNtUserFunction( (Params...) )
{
  (Do here rootkit stuff)  
   _asm{
	Mov  eax, (1.Param)
	Push eax
	(...)
	Mov  eax, (Last Param)
   	Push eax
        
	Push (start address of co...]]></description>
			<category>posts</category>
			<pubDate>Fri, 12 Feb 2010 07:08:42 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[WDF vs WDM - posted by : stumble]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13759&did=edge0&disp=13759>WDF vs WDM]]></link>
			<description><![CDATA[Hey there!
First of all let me say that I apprciate your open approach on this matter.
I'm studying computersience at college and I'm in my 1st semester.
Since springbreak is coming around, I thought I get to know 
driverprogramming and Rootkits.
For driverprogramming I thought about learning how to use WDF.

The thing which tips me of is the book advertised on the homepage of this forum.
...]]></description>
			<category>posts</category>
			<pubDate>Fri, 12 Feb 2010 04:50:38 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: xchg ax,ax or nop - posted by : shellc0de]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13746&did=edge0&disp=13746>xchg ax,ax or nop]]></link>
			<description><![CDATA[I believe you are right, it does xchg ax with itself, because it must go through a whole cycle to simulate the time it would take to do any other operation.]]></description>
			<category>posts</category>
			<pubDate>Tue, 09 Feb 2010 19:11:54 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[unreal mode problem - posted by : NoName123]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13735&did=edge0&disp=13735>unreal mode problem]]></link>
			<description><![CDATA[i read about unreal mode and tried it.
it works fine, but whats the purpose of unreal mode, if i can access full memory even without switching to protected mode?


this code works, it skips part when segment cache is replaced, and it still works!


i use virtualbox, is it possible its the reason why i habe full access to its memory?
i cant rewrite my 'real' bootsector to test it, so i coun...]]></description>
			<category>posts</category>
			<pubDate>Thu, 28 Jan 2010 08:58:48 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: How can I revive a dead rootkit.com account? - posted by : neocrackr]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13702&did=edge0&disp=13702>How can I revive a dead rootkit.com account?]]></link>
			<description><![CDATA[ask from jussi

https://www.rootkit.com/user.php?name=jussi

i think he can help you !

good luck ,]]></description>
			<category>posts</category>
			<pubDate>Mon, 25 Jan 2010 10:32:14 PST</pubDate>
		</item>
		 <item>
			 <title><![CDATA[Re: page protection - posted by : NoName123]]></title>
			<link><![CDATA[http://www.rootkit.com//board.php?thread=13705&did=edge0&disp=13705>page protection]]></link>
			<description><![CDATA[ok this suck, too high level information i dont care about.
ive read about 20% and im bored, learned nothing, things i dont know about are skipped.

maybe it will get better later, but i doubt it ;/
i dont recommend this to anyone, waste of time.]]></description>
			<category>posts</category>
			<pubDate>Fri, 22 Jan 2010 10:43:34 PST</pubDate>
		</item>
		</channel></rss>