[myid]

Hi, I want to know how does PCHunter enumerate ports. I try these ways to test, all failed:
1.Hook IRP_MJ_DEVICE_CONTROL of TCPIP.SYS(NT5) or TDX.SYS(NT6).
2.Hook IRP_MJ_DEVICE_CONTROL of TCPIP.SYS(NT5) or TDX.SYS(NT6), delete TCPIP.SYS(NT5) or TDX.SYS(NT6) to prevent PCHunter get original address.
3.Hook NETIO!NsiGetAllParametersEx and NETIO!NsiGetParameterEx, return STATUS_UNSUCCESSFUL (test on NT6).
All these ways can bypass NETSTAT.EXE, but no effect for PCHunter.

[EP_X0FF]

Maybe it is locating TCB Table in nonpaged memory, something similar to various forensic tools like volatility etc.

[myid]

Maybe it is locating TCB Table in nonpaged memory, something similar to various forensic tools like volatility etc.

What is "TCB Table"? Could you give me a name? I want to explore it by WINDBG.

[EP_X0FF]

http://mnin.blogspot.ru/2011/03/volatil ... odule.html

[myid]

http://mnin.blogspot.ru/2011/03/volatil ... odule.html

Thank you.