-
红队C代码仓库的代号为RedTeamCCode
资源介绍
RedTeamCCode
红队C代码仓库
CrowdStrike钩住了ntdll.dll API
C:\Users\dev\Desktop>hook_finder_64.exe C:\Windows\System32\ntdll.dll
Loading C:\Windows\System32\ntdll.dll
------------------------------------------
BASE 0x00007FFAE0030000 MZÉ
PE 0x00007FFAE00300E8 PE
ExportTableOffset 0x00007FFAE01812A0
OffsetNameTable 0x00007FFAE01838C0
Function