Lab 10-01 本实验包括一个驱动程序和一个可执行文件。你可以从任意位置运行可执行文件,但为了使程序能够正常运行,必须将驱动程序放到C:\Windows\System32目录下,这个目录在受害者计算机中已经存在。可执行文件是Lab10-01.exe,驱动程序是Lab 10-01.sys. 问题
5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 运行看看: AI检测代码解析 "时间","进程名","PID","操作","路径","结果","详细信息" "21:31:32.7487660","Lab10-01.exe","2472","Process Start","","SUCCESS","Parent PID: 1796, Command line: ""C:\Documents and Settings\Administrator\桌面\...