检测windows下rootkit对文件的隐藏。some usermode overwrites first few bytes of ZwQueryDirectoryFile and that t
检测windows下rootkit对文件的隐藏。some usermode overwrites first few bytes of ZwQueryDirectoryFile and that trick will fail then :( So, you will probably need...