KernelMode.info

Win64AST is an ARK tool for WIN7X64/WIN8X64/WIN2008R2/WIN2012.
To use this tool, you need to setup .NET Framework 4.0 if your system is WIN7. Because the GUI of this tool is written by VB2010.

Functions:
Process Manager
Kernel Module Viewer
SSDT/SSSDT Viewer
Port Viewer
Force delete file
Forbid create Process/Thread/File/Key/ValueKey
More and more functions will be added in the future.

Publish page: http://www.m5home.com/bbs/thread-5154-1-1.html

Special thanks to: fyyre[DISABLE_PG_DS_V3]

Shutdown of PG as requirement -> compromising OS security -> seriously minimizes usefulness of this tool.

EP_X0FF wrote:Shutdown of PG as requirement -> compromising OS security -> seriously minimizes usefulness of this tool.

Disable PG is not necessary.

If you do not use "Forbid Create XXX" options, you needn't disable PG.

NEW VERSION RELEASED[2012-09-16].
URL: http://pan.baidu.com/share/link?shareid ... 1915097229

m5home wrote:NEW VERSION RELEASED[2012-09-16].
URL: http://pan.baidu.com/share/link?shareid ... 1915097229

please attach your files here in the thread.

frank_boldewin wrote:

m5home wrote:NEW VERSION RELEASED[2012-09-16].
URL: http://pan.baidu.com/share/link?shareid ... 1915097229

please attach your files here in the thread.

OK.

EP_X0FF wrote:Shutdown of PG as requirement -> compromising OS security -> seriously minimizes usefulness of this tool.

In the new version of WIN64AST(1.00 BETA2), I use standard method to realize all functions, no use kernel hook.
So, "Disable PG" is not a requirement of use this tool.
But, you need to enable test signing mode, and sign the driver use "test signature"(Tool is in the attachment).

EP_X0FF wrote:Shutdown of PG as requirement -> compromising OS security -> seriously minimizes usefulness of this tool.

Could you edit my thread, delete this line:

If you want to use this tool, you need to disable PatchGuard, because I use kernel hook to realize some functions.

And change the title:

ARK for WINDOWS x64 - WIN64AST

m5home wrote:

EP_X0FF wrote:Shutdown of PG as requirement -> compromising OS security -> seriously minimizes usefulness of this tool.

Could you edit my thread, delete this line:

If you want to use this tool, you need to disable PatchGuard, because I use kernel hook to realize some functions.

And change the title:

ARK for WINDOWS x64 - WIN64AST

Done.

Thanks,
--AD

it would be helpful, if the readme file in the attachment would be written in english, so everyone here can follow. ;)