检测windows下rootkit对文件的隐藏。some usermode overwrites first few bytes
of ZwQueryDirectoryFile and that trick will fail then :( So, you will
probably need a small database of the correct indexes for all Windows
versions
标签：
ZwQueryDirectoryFile
overwrites
usermode
windows
上传时间：
2014-12-08
上传用户：lps11188
