电脑攻击与防御 The Attack and Defense of ComputersDr 许.pptVIP

電腦攻擊與防禦  The Attack and Defense of Computers Dr. 許 富 皓 Rootkit for Windows by [Bryce Cogswell et al. ] Categories of Rootkits – Windows User-mode Rootkits Kernel-mode Rootkits User-mode Rootkits Windows API [wikipedia] The Windows API, informally WinAPI, is the name given by Microsoft to the core set of application programming interfaces available in the Microsoft Windows operating systems. It is designed for use by C/C++ programs and is the most direct way to interact with a Windows system for software applications. Windows API [developerfusion] Windows can do lots of things: manage hardware run programs display icons Much of these functions are carried out by DLL files. DLLs (Dynamic Linked Libraries) store functions, so other programs can access them. The advantage of using DLLs is that the same file can be accessed at the same time by different programs. The functions stored in the windows DLLs are called Windows API. Native API[wikipedia] The Native API (with capitalized N) is the publicly incompletely documented application programming interface used internally by the Windows NT family of operating systems. Most of the Native API calls are implemented in ntoskrnl.exe and are exposed to user mode by ntdll.dll. Some Native API calls are implemented in user mode directly within ntdll.dll. While most of Microsoft Windows is implemented using the documented and well-defined Windows API, a few components, such as the Client/Server Runtime Subsystem are implemented using the Native API, as they are started early enough in the Windows NT Startup Process that the Windows API is not available yet. Windows Library Files -- user32.dll [processlibrary][] user32.dll is a file that contains Windows API functions related the Windows user interface, such as: Window handling basic UI functions … and so forth. It is a core file for several versions of the Microsoft Windows operating system. If this file is damaged or deleted, the operating system will not