cardmagic writes: Windows Vista has changed alot on network module, many old port hiding materials are no longer usable.
In this post, I will share with you a simple code to hide port under Vista,hope it is useful for some guys .
Actually under Windows Vista, netstat.exe will call InternalGetTcpTable2 which is exported by Iphlpapi.dll to list all open ports,then InternalGetTcpTable2 will transfer control to NsiAllocateAndGetTable which is exported by nsi.dll, and finally nsi.dll involve NsiEnumerateObjectsAllParametersEx to interact with kernel mode module of NSI -- nsiproxy.sys. nsiproxy.sys is almost like a wrapper of netio.sys, it will then call internal subroutines of netio.sys .
Here ,we will use a relatively easy way -- "NSI Kernel Module Dispatch Routine Hook" to demostrate the specified port hiding uner Vista. Dispatch routine hook is an old topic, this time ,we will apply this method to nsiproxy.sys. Please focus on how to handle the content filtering of NSI:)
Check the following code(Notice: I only tested it under Windows Vista RTM 32bit):
http://www.rootkit.com/vault/cardmagic/PortHidDemo_Vista.c
In this post, I will share with you a simple code to hide port under Vista,hope it is useful for some guys .
Actually under Windows Vista, netstat.exe will call InternalGetTcpTable2 which is exported by Iphlpapi.dll to list all open ports,then InternalGetTcpTable2 will transfer control to NsiAllocateAndGetTable which is exported by nsi.dll, and finally nsi.dll involve NsiEnumerateObjectsAllParametersEx to interact with kernel mode module of NSI -- nsiproxy.sys. nsiproxy.sys is almost like a wrapper of netio.sys, it will then call internal subroutines of netio.sys .
Here ,we will use a relatively easy way -- "NSI Kernel Module Dispatch Routine Hook" to demostrate the specified port hiding uner Vista. Dispatch routine hook is an old topic, this time ,we will apply this method to nsiproxy.sys. Please focus on how to handle the content filtering of NSI:)
Check the following code(Notice: I only tested it under Windows Vista RTM 32bit):
http://www.rootkit.com/vault/cardmagic/PortHidDemo_Vista.c
102
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
