WebcamProtector

Introduction

Link: 커널 후킹을 이용한 웹캠 보호 프로그램 제작(pdf)
Link: 웹캠 보호 프로그램 시연 영상(YouTube)

Develop Environment

• Visual Studio Community 2015 Update 3
• Windows Driver Kit Version 7.1.0

Platform

• Windows 7 x86

Mechanism

• Windows Device Driver
• SSDT(System Service Descriptor Table) Hooking
• Kernel-User Communication : Global event object, DeviceIoControl
  
  

Reference

• Greg Hoglund,James Butler, "Rootkits: Subverting the Windows Kernel", Addison-Wesley, 2006
• Mark E. Russinovich,David A. Solomon,Alex Ionescu, "Windows Internals (6th edition)", Pearson, 2012

Screenshots

• Exception settings
  

• Attack blocking notification (Metasploit)