摘要
为防止代码注入攻击,利用钩挂技术来监视有关的API函数调用十分必要。由于W indows NT系统中存在着严格的进程隔离机制,此种钩挂要在核心态下才有效。提出并讨论了实现此种技术的一种简便的方法。实践表明,在W indows XP系统条件下,利用它能够成功阻止木马利用代码注入实现攻击。
To prevent code injection attack, it is necessary to monitor involved API（Application Programming Interface） by hooking them. Because there exists rigid process isolation in Windows NT, hooking these APIs must be done in kernel mode. A relatively simple way to do this was introduced. It is proved that in Windows XP the way to hook API in kernel mode can efficiently prevent code injection attack.
出处
《计算机应用》
CSCD
北大核心
2006年第9期2134-2136,共3页
journal of Computer Applications
关键词
代码注入
钩挂
核心态
eode injection
hook
kernel mode
