A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #30798  by EP_X0FF
 Wed Aug 30, 2017 8:19 am
Offtopic removed. If you have something useful to complain/ask about -> elaborate yourself. Posts with content looking like "I don't like this because I don't like this" or "I don't like it coz it is in language I don't understand" will be removed.
 #30826  by fl4shc0d3r
 Fri Sep 08, 2017 12:39 am
mr.exodia wrote:Here is an example driver that shows SSDT hooking on x64, might be useful for people learning. https://github.com/mrexodia/TitanHide
I'm searching by Shadow SSDT unhook x64 (complete example). This pack have, but is incomplete, nothing useful.
The author of this topic have a private example that seems good, but this other example is stored on own his forum in this link (http://www.m5home.com/bbs/forum.php?mod ... d&tid=6964).

I already have registered, but not was accepted, why? i don't know.
But if he unlock my account, i could buy.
 #30827  by Vrtule
 Fri Sep 08, 2017 8:07 am
I already have registered, but not was accepted, why? i don't know.
But if he unlock my account, i could buy
Well, since probably nobody of us has enough talents in divination, we do not know the answer. You should ask him directly (which, I suppose, you already did). It may be so that he allows only people known to him (in some way) to have an account on his forums.

Sample code tends to be incomplete since it is a sample code.
 #30828  by Brock
 Fri Sep 08, 2017 10:58 am
EP_X0FF has already answered your question, kernelmode.info is not affiliated with other forums or websites so we (members here) have no knowledge of another forum's rules and regulations, registration procedures etc. That would be like asking Microsoft for your forgotten Yahoo email password, they won't know and have nothing to do with each other's rendered services. Private Message (PM) m5home on this forum and ask him directly. You've been told more than once
 #30829  by fsdhook
 Fri Sep 08, 2017 12:19 pm
fl4shc0d3r wrote:I already have registered, but not was accepted, why? i don't know.
But if he unlock my account, i could buy.
Are you a mental defective? You have complain about this matter more than two weeks like a pussy.
Why others have to give you the code or satisfy your request?
I think you come to this forum just for create disturbances.
 #30830  by fl4shc0d3r
 Fri Sep 08, 2017 4:02 pm
fsdhook wrote:
fl4shc0d3r wrote:I already have registered, but not was accepted, why? i don't know.
But if he unlock my account, i could buy.
Are you a mental defective? You have complain about this matter more than two weeks like a pussy.
Why others have to give you the code or satisfy your request?
I think you come to this forum just for create disturbances.
I only commented the happened, i'm not requesting nothing to no one. You understood wrong.
 #30885  by myid
 Tue Oct 03, 2017 3:52 pm
Code of enumerate create process notification is outdated, could you update your code?
Could you tell me how to enumerate the process notifications created by PsSetCreateProcessNotifyRoutineEx2?
 #30966  by m5home
 Sun Nov 05, 2017 2:50 am
myid wrote:Code of enumerate create process notification is outdated, could you update your code?
Could you tell me how to enumerate the process notifications created by PsSetCreateProcessNotifyRoutineEx2?
It is not so different between all systems. All process notifications are in the same array.
 #31039  by myid
 Sun Nov 26, 2017 4:47 am
m5home wrote:
myid wrote:Code of enumerate create process notification is outdated, could you update your code?
Could you tell me how to enumerate the process notifications created by PsSetCreateProcessNotifyRoutineEx2?
It is not so different between all systems. All process notifications are in the same array.
Thanks for answer, I have solved this problem now.