Dor00tkit/BamExtensionTableHook

Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.

语言：C · GitHub 星标：100 · Fork：12

在 GitHub 上查看原仓库