| OpenProcess and the PSPCIDTABLE
Ever wonder how rootkit detectors work?
Take for instance, Blacklight.
It loops OpenProcess from 0x0004 to 0x41DC and if it gets a handle it records it. But beware, processes can hook OpenProcess(nProtect, HackShield, XTrap) Most now do it in the kernel, so you must program a driver to undo them. If its removed from the pspcidtable, then this method will not work.
mov eax, 4
.while eax<=0000041DCh
push eax
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,eax
Call AddPid
pop eax
add eax, 4
.endw
AddPid:
;Logging here
ret
PS:
Im just writing this to gain points. Yes, Im THAT desperate.
| 
Linear Mode
