REGISTER
desert eagle
main menu

home

forums
    Show me new threads!

bookmarks

view blogs

vault

you must be level 2 to upload files to your vault

downloads

you must be logged on, and level 1, to access downloads

Rootkit Collection

File Contributer Link
Hacker Def... hfn/a
HE4Hook adminn/a
BASIC CLAS... hoglundn/a
Vanquish xshadown/a
NT Rootkit hoglundn/a
FU fuzen_opn/a
WinlogonHi... JeFFOsZn/a
klister joannan/a
Patchfinde... joannan/a
MyNetwork hoglundn/a
MTDWin hoglundn/a
NTFSHider hoglundn/a
VideoCardK... hoglundn/a
VICE fuzen_opn/a
Klog Clandestin...n/a
NtIllusion Kdmn/a
AFX Rootki... TheRealAph...n/a
SInAR vulndevn/a
Shadow Wal... Clandestin...n/a
BootRootki... dereksoede...n/a
CHAZ - Nim... neocrackrn/a
Clandestin... merlvingia...n/a
FUTo petersilbe...n/a
Windows Me... alcapone66...n/a
RAIDE petersilbe...n/a
BOOT KIT vipinkumarn/a
BluePill Joanna and...n/a
DEFRAG blume1975n/a
Keyboard H... chpien/a
CheatEngin... DarkByten/a

search the site

www.rootkit.com : message board

post a message

Show all posts in this forum

view options: unpacked threads | collapsed threads | old style view

how many threads to display:

search board (text+titles):

Posted by pain_abator (Untrusted stranger) [ip info hidden] - Jul 15 2010, 02:47 (UTC+0)
UNC PATH And NTQueryDirectoryFile
Hi
I am writing a kernel rootkit for vista. It hook onto NTQUERYDirectoryFile to hide some files. It works well when the user perform a "dir" or broowse through window explorer.

However, if i use a remote machine and dir through UNC Path (\\servername\c$) or Net USE, the file will be displayed.

Anybody has any idea which kernel api is UNC Path directory listing using Or how can i resolve this problem ??
   
Posted by EreTIk (Normal user) [ip info hidden] - Jul 16 2010, 13:28 (UTC+0)
Re: UNC PATH And NTQueryDirectoryFile
Probably not processed all information classes:
* FileDirectoryInformation
* FileFullDirectoryInformation
* FileIdFullDirectoryInformation
* FileBothDirectoryInformation
* FileIdBothDirectoryInformation
* FileNamesInformation
* FileIdGlobalTxDirectoryInformation

What specifically are used for file system redirector - i do not remember.
   
Posted by pain_abator (Normal user) [ip info hidden] - Jul 19 2010, 01:48 (UTC+0)
Re: UNC PATH And NTQueryDirectoryFile
Thanks for your suggestion
i think i missed FileIdGlobalTxDirectoryInformation
from your list

will be trying later
Posted by _MAX_ (Normal user) [ip info hidden] - Jul 16 2010, 09:00 (UTC+0)
Re: UNC PATH And NTQueryDirectoryFile
Unfortunately i have the same problem


Do you program in Assembly? she asked. NOP, he said.