Kernel Mustard - All Comments

Sleeve Sealers

Sleeve Sealers — Mon, 28 Sep 2009 06:17:29 GMT

Many technological developments will give you, the customer, real advantages – using less film, using less energy and running faster production speeds reliably

Start Coding Right Now! » How Do I Become A Programmer?

Start Coding Right Now! » How Do I Become A Programmer? — Tue, 30 Jun 2009 07:48:41 GMT

Pingback from Start Coding Right Now! » How Do I Become A Programmer?

bathroom spy cam

bathroom spy cam — Thu, 02 Aug 2007 16:53:28 GMT

BUILD Breakage

» Hot Patching

» Hot Patching — Thu, 14 Jun 2007 14:02:34 GMT

Pingback from » Hot Patching

» Hot Patching

» Hot Patching — Thu, 14 Jun 2007 14:02:33 GMT

Pingback from » Hot Patching

Kernel Mustard » Blog Archive » Whence came function hooking?

Kernel Mustard » Blog Archive » Whence came function hooking? — Thu, 14 Jun 2007 05:46:55 GMT

Pingback from Kernel Mustard » Blog Archive » Whence came function hooking?

Kernel Mustard » Blog Archive » Waiting in NDIS drivers

Kernel Mustard » Blog Archive » Waiting in NDIS drivers — Thu, 05 Oct 2006 03:28:49 GMT

PingBack from http://kernelmustard.com/2006/10/04/waiting-in-ndis-drivers/

反馈收集和回复

Usermode Troubleshooooo..ting paper — Thu, 03 Aug 2006 14:55:03 GMT

反馈收集和回复===请您在这里通过添加评论留下您对这篇文章的反馈信息，我会及时整理并且回复。如果您的反馈不想让别人看到，可以点击右边的Email链接给我发邮件：
http://blogs.msdn.com/lixiong/contact.aspx...

Hot Patching

Khurram Aziz — Mon, 20 Feb 2006 04:31:12 GMT

Over the last few years; rebooting Windows frequency is decreased. People have started making good installers....

re: Infone Goes Dark

Steve Dispensa — Sun, 04 Dec 2005 13:32:00 GMT

I did too.

Will somebody create a similiar service ?

re: Am I the only one who thinks TiVo is expensive?!

Steve Dispensa — Thu, 24 Nov 2005 02:33:00 GMT

no your not alone!

re: Rootkit detection

Steve Dispensa — Mon, 21 Nov 2005 08:32:00 GMT

Someone asked about RegMon in Mark's blog and this was my answer:

"I got curious after reading your question and I took a look at the drivers that came with regmon.exe; the main difference that I've found is that the old NT driver imports KeServiceDescriptorTable to hook a couple of functions and the 2K3 driver doesn't import it but it imports two functions to 'hook' and 'unhook' the registry provided by Microsoft: CmRegisterCallback and CmUnRegisterCallback.

After this discovering I went to the MSDN and found that these functions are available from XP so I got confused again.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/Kernel_r/hh/Kernel_r/k102_ec214e13-1342-48b5-9a31-8c6c9da57cd6.xml.asp

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/Kernel_r/hh/Kernel_r/k102_13cbc14e-4652-4a3d-a87e-f6eef883f912.xml.asp

I'm not sure but maybe this fact is the one that hit the target:

"For Windows XP, the system only makes post-notification calls only when a registry key is created or opened. For Microsoft Windows Server 2003 and later operating systems, the system makes post-notification calls for every registry operation"

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/Kernel_r/hh/Kernel_r/DrvrRtns_988f8f3d-4ee8-4351-8fc0-703a88bd8421.xml.asp

Anyway, all that I have said is pure speculation :=)"

http://www.sysinternals.com/blog/2005/09/multi-platform-images.html

re: Rootkit detection

Steve Dispensa — Thu, 17 Nov 2005 20:28:00 GMT

There are earlier sources of Regmon and Filemon floating on the web. You could check them out before diving into reversing Regmon.

re: Seen on digg.com the other day

Steve Dispensa — Tue, 15 Nov 2005 21:47:00 GMT

Another site that I find useful is http://www.dnsstuff.com/

Results of the MD5 collision program and implications

TrackBack — Tue, 15 Nov 2005 06:32:00 GMT

re: Wanted: Mouseless Usability Testing

Steve Dispensa — Mon, 14 Nov 2005 05:34:00 GMT

A fixed Windows-Tab is coming in Vista. Enjoy!

Rootkit detection

TrackBack — Mon, 14 Nov 2005 04:11:00 GMT

re: Control Kernel Debugging From The Target

Steve Dispensa — Sun, 13 Nov 2005 10:14:00 GMT

Awesome! This looks like it will come in very handy in verifying kd sessions in our lab. :D

Why couldn't Microsoft detect the Sony DRM kit automatically?

TrackBack — Sun, 13 Nov 2005 02:48:00 GMT

re: Am I the only one who thinks TiVo is expensive?!

Steve Dispensa — Fri, 11 Nov 2005 18:11:00 GMT

I'd pay 50 bucks a month for Tivo - it's that worth it to me.

But market forces cause it to be 10 to 20 a month. Schweet.