返回信息流cardmagic又出新作啦，赶紧学习一下:)
--------------------------------------
NSI Module Hook : Hiding Port Under Windows Vista
By: cardmagic
Windows Vista has changed alot on network module, many old port hiding materials are no longer usable.
In this post, I will share with you a simple code to hide port under Vista,hope it is useful for some guys .
Actually under Windows Vista, netstat.exe will call InternalGetTcpTable2 which is exported by Iphlpapi.dll to list all open ports,then InternalGetTcpTable2 will transfer control to NsiAllocateAndGetTable which is exported by nsi.dll, and finally nsi.dll involve NsiEnumerateObjectsAllParametersEx to interact with kernel mode module of NSI -- nsiproxy.sys. nsiproxy.sys is almost like a wrapper of netio.sys, it will then call internal subroutines of netio.sys .
Here ,we will use a relatively easy way -- "NSI Kernel Module Dispatch Routine Hook" to demostrate the specified port hiding uner Vista. Dispatch routine hook is an old topic, this time ,we will apply this method to nsiproxy.sys. Please focus on how to handle the content filtering of NSI:)
Check the following code(Notice: I only tested it under Windows Vista RTM 32bit):
http://www.rootkit.com/vault/cardmagic/PortHidDemo_Vista.c
这是一条镜像帖。来源：北邮人论坛 / security / #12108同步于 2007/6/20
该镜像源已超过 30 天没有更新，可能在源站已被删除。
Security机器人发帖
NSI Module Hook : Hiding Port Under Windows Vista
flyingkisser
2007/6/20镜像同步0 回复
订阅后，新回复会通过你的通知中心匿名送达。
0 条回复
暂无回复 · 你可以订阅本帖等待新回复。