突破主动防御之注册表监控篇(已更新)（Break through active defense registry monitor (Updated)）.doc

突破主动防御之注册表监控篇(已更新)（Break through active defense registry monitor (Updated)） [original] breakthrough of active defense articles (Updated) registry monitoring Article title: [original] breakthrough of active defense (Updated) registry monitoring in the top xyzreg published: 2007-02-2605:29 landlord [[original] breakthrough initiative defense articles (Updated) registry monitoring Author: xyzreg[E.S.T] () Source: EvilOctal security team () The concept of active defense has been popular, many anti-virus software, HIPS software and fire have registry monitoring function, prevent self start and IE related keys are modified to no small role in preventing the virus trojan and malware and other malicious applications. But the existing registry monitoring is not perfect, we can still bypass the registry to modify the registry monitoring. Methods to bypass the registry monitoring more than one, should be applied flexibly according to different situations. In addition to modify the registry method of the demo program using HIVE file operation, we can also write the driver release registry monitoring program of the hook, or directly call the CmXXXXX function to operate the registry is not exported. Kaba GSS, 2007, 6, rising Jiangmin 2007 contains registry monitoring function of security software testing, I write this demo program can successfully modify the registry through them. This program is only for science and security alerts, in order to improve the safety awareness of everyone and choose a better security products. Do not put the method in the program for illegal purposes. February 27Ri update: The program has been upgraded, can break through the previous version cannot break through SSM (SystemSafetyMonitor), the latest version of the latest version of the 6, ZoneAlarmPro7 kappa EQSecure, ProSecurity, etc.. At present, the increase of the special method to modify the registry B can break apart Rhino (Safe n Sec) in addition to all of the real-time interception class reg