ubd_sys.txt

一个驱动上实现 无进程 无端口 无服务的简单rootkit

using IoWorkItem
    one for receive,one for send
    so if two or more client connect to it At the sAme mAy hAve problems,but DDK sAys IoWorkItems:
"System worker threads are a limited resource. Drivers must not permanently reserve a work item for the driver's use. Work items are designed for operations that complete quickly. Drivers should free any work items that they allocate as soon as possible."

the pAcket to be sent wAs put is SendList,when send it,we wAit until the right Ack pAcket come bAck,then we free the pAcket in sendList.

晕啊,英语太差了 写不下去了 :(