27 Commits

Author	SHA1	Message	Date
CORP\zengquan	37450dbe93	Update the code from work computer	2022-12-06 19:13:18 +08:00
CORP\zengquan	7fed05cdfc	Fixup the Minifilter callback remove bug	2022-09-30 12:35:39 +08:00
CORP\zengquan	c95e4e0727	Support remove the Minifilter callback	2022-09-29 16:05:44 +08:00
CORP\zengquan	0a702f8899	Add the MiniFilter callback enum	2022-09-07 19:54:43 +08:00
CORP\zengquan	f185b9975c	Add the MiniFilter UI	2022-09-06 19:49:41 +08:00
BeneficialCode	b705e5ab2f	Add some kernel inject dll code	2022-09-05 08:38:10 +08:00
CORP\zengquan	e85218297a	Fixup the system notify remove method bug	2022-08-26 15:22:05 +08:00
CORP\zengquan	16458951ad	Support erase PreObOperation	2022-08-25 18:46:24 +08:00
CORP\zengquan	ec2b4a06ac	Fixup the object callback remove bug	2022-08-16 19:18:53 +08:00
CORP\zengquan	58ca578588	Add some theme settings	2022-08-15 09:17:05 +08:00
CORP\zengquan	0e2b9e4416	fixup the ExReferenceCallBackBlock's bug	2022-08-09 14:15:15 +08:00
CORP\zengquan	5fcc7b8dae	Add the log to the ImageNotify	2022-06-22 09:51:33 +08:00
BeneficialCode	472889cbb4	1.Add the thread's own module ... 2.Add PiDDBCache、UnloadedDriver and Threads copy on right menu 3.fix the driver backup path in WinArk runtime path	2022-06-08 22:31:19 +08:00
BeneficialCode	d59f744cdc	Fixup the registry callback enum bug	2022-06-04 01:49:00 +08:00
CORP\zengquan	7c5de3c900	Get Registry Notify Count by CmpCallbackCount	2022-06-03 20:06:07 +08:00
CORP\zengquan	4a78703ea8	Add the registry callback enum	2022-06-03 17:35:24 +08:00
BeneficialCode	f710715e81	1. Add the remove notify function ... 2. Fixup the PAGE_FAULT_IN_NONPAGED_AREA	2022-04-23 22:31:52 +08:00
BeneficialCode	8968b2ee5f	Add the intercept the driver load and backup it	2022-02-20 11:55:44 +08:00
CORP\zengquan	71d0d43c0a	Add the backup file part1	2022-02-18 18:47:28 +08:00
CORP\zengquan	64da2a4102	Add the dangerous process display	2022-02-18 15:18:08 +08:00
CORP\zengquan	e9cd4375e7	Fixup system notify enum error	2022-01-04 18:21:19 +08:00
BeneficialCode	b3451b3fd1	Add the ObCallback Routine Dispaly	2022-01-02 20:54:51 +08:00
BeneficialCode	5b2ec478c4	Add the PiDDBCacheTable and UnloadedDrivers Information Display	2022-01-01 15:47:39 +08:00
CORP\zengquan	c425897cbe	Build one struct that user mode can consume. ... Add the APC region.	2021-12-31 18:31:06 +08:00
CORP\zengquan	7ecacd5749	fixup the symbol parser load pdb file error. The dllSize cannot be zero.	2021-11-26 21:11:23 +08:00
CORP\zengquan	3885ce3253	fixup the ssdt rva and windows focus on win7	2021-11-25 15:15:34 +08:00
CORP\zengquan	e45bb192ac	Delete some old source code	2021-11-14 12:27:47 +08:00