NTSD÷-ZOL ZOLҳ | ҳ | а | ͷư ¼  |   ע  |    
 PCIT  
            Բ! Ҫҵ. .һзȺ - -

ҵĲ ־   ZOL̳Ʒ̳Ӱֻ̳̳ʼǱ̳̳Ϸ̳̳ƵװȦ ժ  

־ZOL > Ĳ > NTSD÷
̸Ӳ̷ߴҪ ֹWindowsעԶ̷ 
NTSD÷

2008-11-16 11:47:23    ࣺڿ |  |  (1) |  (1368) 
ntsd һdosڽһЩ½˵̡÷Ϊcmd ͿԽ̣

һý̵PID
ʽntsd -c q -p pid
 ntsd -c q -p 1332 PIDΪ1332explorer.exẹ
⣺explorer.exepidΪ1332λȡ̵pidأCMDTASKLISTͿԻȡǰн̵PIDеexploer.exe̶1332

ý
ʽntsd -c q -pn ***.exe ***.exe Ϊexeʡ
ntsd -c q -pn explorer.exe
̵ܽDOStaskkill
ʽ taskkill /pid 1234 /f  ҲԴﵽͬЧ

Щ֪滹У

ntsd
һЩߵȼḶ̌tskilltaskkill޷ôǻһǿĹߣǾϵͳdebug
ntsd.׼ȷ˵ntsdһϵͳԹߣֻṩϵͳĹԱʹãǶɱ̻Ǻˬ.ϳWINDOWSϵͳԼḶ́ntsdɱ.

ȻЩrootkitĳľΪҺţţľǺٵ.
ntsd ԳʱҪûָһҪӵĽ̡ʹ TLIST  PVIEWERԻĳ
̵Ľ IDȻ ntsd -p pid ̡ntsd ʹµľ䷨

ntsd [options] imagefile
Уimagefile ҪԵӳƣoptions ѡ֮һ
ѡ˵-2һڵַģʽӦó´-dض򵽵ն-g ʹִԶͨ
һϵ-Gʹ ntsd ӳֹʱ˳oö̵ĵԣĬֵΪɵԳһ
-pָɽ ID ʶĽ-vϸ

磬 inetinfo.exe Ľ ID Ϊ 104 ntsd Գӵ inetinfo (IIS)
ntsd -p 104
Ҳʹ ntsd һ½еԡ磬ntsd notepad.exe һµ notepad.exe 
̣ӡ
һӵĳ̣Ϳø鿴ջöϵ㡢תڴ棬ȵȡ
~ʾ̵߳һбKB ʾǰ̵߳Ķջ켣~*KBʾ̵߳Ķջ켣Rʾǰ
֡ļĴU벢ʾƫD[type][< range>]תڴBP[#] Ľ̳:http://www.wuyapc.com
öϵBC[]һϵBD[]һϵBE[< bp>]һϵBL[]гһ
ϵ

һǳҪĲ-vǿͨһҽЩӿļ.
кܶಡľ߶ϲԼɶ̬⣬ȻעᵽϵͳļؿбУﵽԼĿ.

ҪһntsdضضһıļǷо.
c:\>set _NT_DEBUG_LOG_FILE_APPEND=c:\pdw.txt
ע⣬ȻضˣǵȻʾĻϣһ뵽debugģʽʹ-c
qͿԱ.
c:\>ntsd -c q -v notepad.exe
ǵpdw.txtļУͿԿnotepad.exeļĵϢ.
ntsdʹ²ɱ.
c:\>ntsd -c q -p PID ֻҪṩ̵PIDôͿԸɵ̡
һƪ̸Ӳ̷ߴҪ   һƪֹWindowsעԶ̷ 
  ҵ־... 
  ַ:http://xinglingcun.com/ar 
  ԿҪؿĴ 
  Fdisk /MBR ޸Ӳ̵5Ӧ 
  Լ 
  Vista뺬ͽ 
    ־... 
  ܻϲ... 
  ǳ̸֯ 
  ˽˲ᶮ 
  ͼʵеļƷ 
  ˴ľ 
  99 
  һ 
 Ͷ壺 ࣺڿ | (1) | (1368) | ղصҵժ | Ķ | а

      ˭ƪ־>>  ˭Ը־ͶƱ?>>
                  0
                  Ʊ


                  0
                  Ʊ


             


:NTSD÷>> 


      ۣ
         û  ע

                 ǳ: 
            

      ڡݣ

       
      ֤룺  
      ͼƬ
         *Ctrl+Enterٻظ

      ZOLκʹͽ  ϵ͹Ա  鿴
      ZOL | ûע |  | ԱƸ(5) | ZOL | Ӫ | վͼ | ϵʽ | ӭͶ | 
      RSS |  
      Copyright &copy;1999 - 2009 ZOL. All rights reserved. йش Ȩ. 
