buildchk_wnet_x86.log

使用内核方法检测隐藏的进程

BUILD: Examining c:\docume~1\admini~1\桌面\基于ps~1\sys directory for files to compile.
Compiling (NoSync) c:\docume~1\admini~1\桌面\基于ps~1\sys directory ********************
1>'nmake.exe /nologo BUILDMSG=Stop. -i NTTEST= UMTEST= NOLINK=1 PASS1_NOLIB=1 386=1'
1>BUILDMSG: Processing c:\docume~1\admini~1\桌面\基于ps~1\sys
1>cl -nologo -Ii386\ -I. -ID:\WINDDK\3790.1830\inc\mfc42 -I. -Iobjchk_wnet_x86\i386 -ID:\WINDDK\3790.1830\inc\wnet -ID:\WINDDK\3790.1830\inc\wnet -ID:\WINDDK\3790.1830\inc\ddk\wnet -ID:\WINDDK\3790.1830\inc\ddk\wdm\wnet -ID:\WINDDK\3790.1830\inc\crt -D_X86_=1 -Di386=1  -DSTD_CALL -DCONDITION_HANDLING=1   -DNT_INST=0 -DWIN32=100 -D_NT1X_=100 -DWINNT=1 -D_WIN32_WINNT=0x0502 /DWINVER=0x0502 -D_WIN32_IE=0x0603    -DWIN32_LEAN_AND_MEAN=1 -DDEVL=1 -DDBG=1 -D__BUILDMACHINE__=WinDDK -DFPO=0  -DNDEBUG -D_DLL=1      /c /Zl /Zp8 /Gy /Gm- -cbstring /W1 /Gz  /GX-  /GR- /GF /GS /G6 /Ze /Gi- /QIfdiv- /hotpatch -Z7 /Od /Oi  /Oy-   -FID:\WINDDK\3790.1830\inc\wnet\warning.h   .\listprocess.c 
1>listprocess.c
1>
1>Stop.
Compiling  c:\docume~1\admini~1\桌面\基于ps~1\sys directory ********************
100>'nmake.exe /nologo BUILDMSG=Stop. -i NTTEST= UMTEST= NOLINK=1 386=1'
100>BUILDMSG: Processing c:\docume~1\admini~1\桌面\基于ps~1\sys
100>
100>Stop.
Linking c:\docume~1\admini~1\桌面\基于ps~1\sys directory ********************
1>'nmake.exe /nologo BUILDMSG=Stop. -i LINKONLY=1 NOPASS0=1 NTTEST= UMTEST= 386=1'
1>BUILDMSG: Processing c:\docume~1\admini~1\桌面\基于ps~1\sys
1>	link -out:objchk_wnet_x86\i386\ListProcess.sys -machine:ix86 @C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nm75.tmp
1>Microsoft (R) Incremental Linker Version 7.10.4035
1>Copyright (C) Microsoft Corporation.  All rights reserved.
1>
1>-MERGE:_PAGE=PAGE 
1>-MERGE:_TEXT=.text 
1>-SECTION:INIT,d 
1>-OPT:REF 
1>-OPT:ICF 
1>-IGNORE:4198,4010,4037,4039,4065,4070,4078,4087,4089,4221 
1>-INCREMENTAL:NO 
1>-FULLBUILD 
1>/release 
1>-NODEFAULTLIB 
1>/WX 
1>-debug 
1>-debugtype:cv 
1>-version:5.2 
1>-osversion:5.2 
1>/functionpadmin:5 
1>/safeseh 
1>/pdbcompress 
1>-STACK:0x40000,0x1000 
1>-driver 
1>-base:0x10000 
1>-subsystem:native,5.02 
1>-entry:GsDriverEntry@8 
1>-out:objchk_wnet_x86\i386\ListProcess.sys 
1>objchk_wnet_x86\i386\listprocess.obj 
1>D:\WINDDK\3790.1830\lib\wnet\i386\BufferOverflowK.lib 
1>D:\WINDDK\3790.1830\lib\wnet\i386\ntoskrnl.lib 
1>D:\WINDDK\3790.1830\lib\wnet\i386\hal.lib 
1>D:\WINDDK\3790.1830\lib\wnet\i386\wmilib.lib 
1>	echo Skip Binplace:
1>Skip Binplace:
1>
1>Stop.