{"type":"rich","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fkagasu.hatenablog.com%2Fentry%2F2019%2F12%2F29%2F155520\" title=\"InfinityHook \u3092\u5229\u7528\u3057\u3066 Windows \u306e syscall \u3092 hook \u3059\u308b\u65b9\u6cd5 - \u5099\u5fd8\u9332\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","version":"1.0","provider_name":"Hatena Blog","blog_url":"https://kagasu.hatenablog.com/","url":"https://kagasu.hatenablog.com/entry/2019/12/29/155520","categories":["Windows(Kernel Mode)","C/C++"],"height":"190","image_url":"https://cdn-ak.f.st-hatena.com/images/fotolife/k/kagasu/20191229/20191229155321.png","published":"2019-12-29 15:55:20","title":"InfinityHook \u3092\u5229\u7528\u3057\u3066 Windows \u306e syscall \u3092 hook \u3059\u308b\u65b9\u6cd5","width":"100%","description":"\u2160. \u306f\u3058\u3081\u306b \u2161. \u3084\u308a\u65b9 1. clone \u3059\u308b 2. \u30b3\u30f3\u30d1\u30a4\u30eb\u3059\u308b 3. \u5b9f\u884c\u3059\u308b \u5b9f\u884c\u7d50\u679c FAQ Q. hook \u3067\u304d\u307e\u305b\u3093\u3002 \u53c2\u8003 \u2160. \u306f\u3058\u3081\u306b Windows \u306e syscall \u3092 hook \u3059\u308b\u30e1\u30b8\u30e3\u30fc\u306a\u65b9\u6cd5\u306f SSDT Hook \u3067\u3059\u3002 \u3057\u304b\u3057\u3001Windows \u306b\u306f\u30ab\u30fc\u30cd\u30eb\u9818\u57df\u306e\u6539\u3056\u3093\u3092\u691c\u77e5\u3059\u308b\u4ed5\u7d44\u307f\u3068\u3057\u3066 Kernel Patch Protection(KPP) \u5225\u540d PatchGuard(PG) \u304c\u5b58\u5728\u3057\u3066\u3044\u307e\u3059\u3002 KPP/PG \u306e\u5b58\u5728\u306b\u3088\u308a\u30ab\u30fc\u30cd\u30eb\u9818\u57df\u306b\u5b58\u5728\u3059\u308bSSDT\u306e\u66f8\u304d\u63db\u3048\u306f\u691c\u77e5\u3055\u308c\u3001Windows \u306f BSoD \u3057\u307e\u3059\u3002\u3053\u306e\u8a18\u4e8b\u3067\u306f everdox\u6c0f \u304c\u4f5c\u2026","author_url":"https://blog.hatena.ne.jp/kagasu/","author_name":"kagasu","provider_url":"https://hatena.blog","blog_title":"\u5099\u5fd8\u9332"}