Research on Kernel Information Monitor Based on High-Privilege for Computer System

Abstract:

In a lot of software, the functions involved to system management are unsatisfied. Meanwhile, the widely used Microsoft Spy + + which comes with Visual Studio has hidden the core part of the system. So, most of users and researchers have no way to understand and study deeply on the status of system operating, the forming procedures and problems maybe existed, such that many technicians can not enter the core zone of the OS. This paper aimed to provide a platform for developers to study the process and thread deeply, the platform whose functions are no less than Microsoft Spy + + and can provide much and more detail information of process and thread than that of Microsoft Spy++.

• Periodical: Applied Mechanics and Materials (Volumes 513-517)
• Pages: 2161-2164
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.513-517.2161
• Online since: February 2014
• Authors: Xiao Ling Li*
• Keywords: Kernel Mode, Native API, Process Monitoring, Win API

References

[1] Greg Hoglund, James Bulter. Rootkits: Subverting the Windows Kernel[J], (2010).

[2] Sven B. Schreiber. Undocumented Windows 2000 Secrets[J], (2006).

[3] Microsoft, Microsoft Platform SDK [EB], (2006).

[4] Microsoft, Microsoft Windows DDK [EB], (2006).

[5] Dong Hwi Lee, Jae Myung Kim. The Study of Respone Model & Mechanism against Windows Kernel Comproises", Dept of Inf Security[J], (2006).