|
Posted by Scherbina Vladimir on January 18, 2006, 4:29 am
If you were Registered and logged in, you could reply and use other advanced thread options
It usually hooks SDT. SDT is a service discriptor table - a table that
contains addresses of system calls.
This is not documented mechanism to implement hooking, so it's prone to
BSOD's. Google for details.
--
Vladimir
> Hi All,
>
> This is my first question to this group. Can someone please help me to
> understand how does antivirus product basically work in kernel mode.
> I mean in kernel mode how and when does it scans the binary. Which User
> and kernel mode APIs does it hook to implement its functionality.
>
> When does the driver gets loaded during the booting up of system.
>
> Any Info would be a great help.
>
| 
XML site map