hiberfil.sys

Cypress CyUsb3.sys

Programmer's Reference

? 2012 Cypress Semiconductor

Contents3Table of Contents

Part IDriver Overview5Part IIModifying CyUSB3.INF7Part IIIMatching Devices to the Driver

13

1Windows XP................................................................................................................................... 142Windows Vista ,Win7 and Win8 Beta................................................................................................................................... 16

Part IVReinstalling the Driver19

Cypress CyUsb3.sys

Programmer's Reference

? 2012 Cypress Semiconductor

Contents3Table of Contents

Part IDriver Overview5Part IIModifying CyUSB3.INF7Part IIIMatching Devices to the Driver

13

1Windows XP................................................................................................................................... 142Windows Vista ,Win7 and Win8 Beta................................................................................................................................... 16

Part IVReinstalling the Driver19

Cypress CyUsb3.sys

Programmer's Reference

? 2012 Cypress Semiconductor

Contents3Table of Contents

Part IDriver Overview5Part IIModifying CyUSB3.INF7Part IIIMatching Devices to the Driver

13

1Windows XP................................................................................................................................... 142Windows Vista ,Win7 and Win8 Beta................................................................................................................................... 16

Part IVReinstalling the Driver19

获取加载后就自动删除的驱动SYS文件 最近闲得没事做，想逆几个驱动玩玩，于是就把目标投向了Xuetr，利用Xuetr查询它的驱动文件位置

发现DriverPath里面显示的是驱动的位置，但是驱动文件死活找不到，原来是因为它在加载完驱动之后，马上自删除了该文件，估计是考虑到不想被别有用心的人拿来逆向吧

今天我们的任务就是要来获取这个SYS文件，然后利用IDA来XX，以学习Xuetr里面的一些先进技术

一开始想到的方法是既然文件在这个位置出现过，那么我写一个死循环的函数来不断的CopyFile，这样不就可以获取到它的SYS文件么，于是就有了下面的代码

#include #include

#define SRC_PATH \#define DST_PATH \

int main() {

while (!CopyFileA(SRC_PATH,DST_PATH,FALSE));

printf(\); return 0; }

这样只要这个Console程序退出就知道已经拷贝成功了，注意文件的保存位置是在C盘的根目录下，所以WIN7的话要以管理员运行程序，不然CopyFile会出现Access Denied的错误，还有就是要在