/ Personal Computer World 2007 December / PCWDEC07.iso / Software / Freeware / Sophos Anti-Rootkit 1.3.1 / sarsfx.exe / MEMSWEEP.sys / INIT

next >

MacOS 8.1

Win98

DOS

view JSON data

view as text

+--------+-------------------------+-------------------------+--------+--------+
|00000000| 5c 00 44 00 65 00 76 00 | 69 00 63 00 65 00 5c 00 |\.D.e.v.|i.c.e.\.|
|00000010| 4d 00 65 00 6d 00 53 00 | 77 00 65 00 65 00 70 00 |M.e.m.S.|w.e.e.p.|
|00000020| 32 00 00 00 5c 00 44 00 | 6f 00 73 00 44 00 65 00 |2...\.D.|o.s.D.e.|
|00000030| 76 00 69 00 63 00 65 00 | 73 00 5c 00 4d 00 65 00 |v.i.c.e.|s.\.M.e.|
|00000040| 6d 00 53 00 77 00 65 00 | 65 00 70 00 32 00 00 00 |m.S.w.e.|e.p.2...|
|00000050| 55 8b ec 83 ec 14 e8 35 | fb ff ff 85 c0 0f 8c 8e |U......5|........|
|00000060| 00 00 00 56 8b 75 08 57 | 8b 3d 8c 0a 01 00 68 80 |...V.u.W|.=....h.|
|00000070| 0c 01 00 8d 45 f4 50 c7 | 46 34 f6 04 01 00 c7 46 |....E.P.|F4.....F|
|00000080| 38 80 04 01 00 c7 46 40 | b0 04 01 00 c7 46 70 7a |8.....F@|.....Fpz|
|00000090| 05 01 00 ff d7 8d 45 fc | 50 6a 00 6a 00 6a 22 8d |......E.|Pj.j.j".|
|000000a0| 45 f4 50 6a 00 56 ff 15 | 94 0a 01 00 8b f0 85 f6 |E.Pj.V..|........|
|000000b0| 7c 32 68 a4 0c 01 00 8d | 45 ec 50 ff d7 8d 45 ec ||2h.....|E.P...E.|
|000000c0| 50 ff 15 c0 0a 01 00 8d | 45 f4 50 8d 45 ec 50 ff |P.......|E.P.E.P.|
|000000d0| 15 90 0a 01 00 8b f0 85 | f6 7d 12 ff 75 fc ff 15 |........|.}..u...|
|000000e0| f8 0a 01 00 e8 f9 fb ff | ff 8b c6 eb 02 33 c0 5f |........|.....3._|
|000000f0| 5e c9 c2 08 00 cc cc cc | c0 0d 00 00 00 00 00 00 |^.......|........|
|00000100| 00 00 00 00 c4 10 00 00 | 8c 0a 00 00 b4 0d 00 00 |........|........|
|00000110| 00 00 00 00 00 00 00 00 | ee 10 00 00 80 0a 00 00 |........|........|
|00000120| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000130| 00 00 00 00 d2 10 00 00 | e0 10 00 00 00 00 00 00 |........|........|
|00000140| 7c 0e 00 00 94 0e 00 00 | ac 0e 00 00 be 0e 00 00 ||.......|........|
|00000150| d2 0e 00 00 e4 0e 00 00 | f0 0e 00 00 00 0f 00 00 |........|........|
|00000160| 16 0f 00 00 26 0f 00 00 | 40 0f 00 00 5c 0f 00 00 |....&...|@...\...|
|00000170| 6e 0f 00 00 64 0e 00 00 | a4 0f 00 00 b8 0f 00 00 |n...d...|........|
|00000180| d8 0f 00 00 e6 0f 00 00 | 00 10 00 00 10 10 00 00 |........|........|
|00000190| 28 10 00 00 38 10 00 00 | 56 10 00 00 6c 10 00 00 |(...8...|V...l...|
|000001a0| 80 10 00 00 9a 10 00 00 | aa 10 00 00 52 0e 00 00 |........|....R...|
|000001b0| 8c 0f 00 00 3c 0e 00 00 | 00 00 00 00 97 01 49 6f |....<...|......Io|
|000001c0| 66 43 6f 6d 70 6c 65 74 | 65 52 65 71 75 65 73 74 |fComplet|eRequest|
|000001d0| 00 00 25 01 49 6f 44 65 | 6c 65 74 65 44 65 76 69 |..%.IoDe|leteDevi|
|000001e0| 63 65 00 00 27 01 49 6f | 44 65 6c 65 74 65 53 79 |ce..'.Io|DeleteSy|
|000001f0| 6d 62 6f 6c 69 63 4c 69 | 6e 6b 00 00 66 03 52 74 |mbolicLi|nk..f.Rt|
|00000200| 6c 49 6e 69 74 55 6e 69 | 63 6f 64 65 53 74 72 69 |lInitUni|codeStri|
|00000210| 6e 67 00 00 21 01 49 6f | 43 72 65 61 74 65 53 79 |ng..!.Io|CreateSy|
|00000220| 6d 62 6f 6c 69 63 4c 69 | 6e 6b 00 00 1b 01 49 6f |mbolicLi|nk....Io|
|00000230| 43 72 65 61 74 65 44 65 | 76 69 63 65 00 00 47 02 |CreateDe|vice..G.|
|00000240| 4d 6d 49 73 41 64 64 72 | 65 73 73 56 61 6c 69 64 |MmIsAddr|essValid|
|00000250| 00 00 ad 01 4b 65 44 65 | 74 61 63 68 50 72 6f 63 |....KeDe|tachProc|
|00000260| 65 73 73 00 33 01 49 6f | 46 72 65 65 4d 64 6c 00 |ess.3.Io|FreeMdl.|
|00000270| 67 02 4d 6d 55 6e 6c 6f | 63 6b 50 61 67 65 73 00 |g.MmUnlo|ckPages.|
|00000280| 59 02 4d 6d 50 72 6f 62 | 65 41 6e 64 4c 6f 63 6b |Y.MmProb|eAndLock|
|00000290| 50 61 67 65 73 00 04 01 | 49 6f 41 6c 6c 6f 63 61 |Pages...|IoAlloca|
|000002a0| 74 65 4d 64 6c 00 db 02 | 50 73 49 6e 69 74 69 61 |teMdl...|PsInitia|
|000002b0| 6c 53 79 73 74 65 6d 50 | 72 6f 63 65 73 73 00 00 |lSystemP|rocess..|
|000002c0| 4e 04 5a 77 51 75 65 72 | 79 49 6e 66 6f 72 6d 61 |N.ZwQuer|yInforma|
|000002d0| 74 69 6f 6e 50 72 6f 63 | 65 73 73 00 a4 01 4b 65 |tionProc|ess...Ke|
|000002e0| 41 74 74 61 63 68 50 72 | 6f 63 65 73 73 00 de 02 |AttachPr|ocess...|
|000002f0| 50 73 4c 6f 6f 6b 75 70 | 50 72 6f 63 65 73 73 42 |PsLookup|ProcessB|
|00000300| 79 50 72 6f 63 65 73 73 | 49 64 00 00 d6 02 50 73 |yProcess|Id....Ps|
|00000310| 47 65 74 43 75 72 72 65 | 6e 74 50 72 6f 63 65 73 |GetCurre|ntProces|
|00000320| 73 49 64 00 7f 04 5f 65 | 78 63 65 70 74 5f 68 61 |sId..._e|xcept_ha|
|00000330| 6e 64 6c 65 72 33 00 00 | a5 03 52 74 6c 53 65 74 |ndler3..|..RtlSet|
|00000340| 44 61 63 6c 53 65 63 75 | 72 69 74 79 44 65 73 63 |DaclSecu|rityDesc|
|00000350| 72 69 70 74 6f 72 00 00 | 47 00 45 78 46 72 65 65 |riptor..|G.ExFree|
|00000360| 50 6f 6f 6c 00 00 f5 02 | 52 74 6c 41 64 64 41 63 |Pool....|RtlAddAc|
|00000370| 63 65 73 73 41 6c 6c 6f | 77 65 64 41 63 65 00 00 |cessAllo|wedAce..|
|00000380| 1a 03 52 74 6c 43 72 65 | 61 74 65 41 63 6c 00 00 |..RtlCre|ateAcl..|
|00000390| 3a 00 45 78 41 6c 6c 6f | 63 61 74 65 50 6f 6f 6c |:.ExAllo|catePool|
|000003a0| 57 69 74 68 54 61 67 00 | 7f 03 52 74 6c 4c 65 6e |WithTag.|..RtlLen|
|000003b0| 67 74 68 53 69 64 00 00 | 1e 03 52 74 6c 43 72 65 |gthSid..|..RtlCre|
|000003c0| 61 74 65 53 65 63 75 72 | 69 74 79 44 65 73 63 72 |ateSecur|ityDescr|
|000003d0| 69 70 74 6f 72 00 ae 03 | 52 74 6c 53 75 62 41 75 |iptor...|RtlSubAu|
|000003e0| 74 68 6f 72 69 74 79 53 | 69 64 00 00 6a 03 52 74 |thorityS|id..j.Rt|
|000003f0| 6c 49 6e 69 74 69 61 6c | 69 7a 65 53 69 64 00 00 |lInitial|izeSid..|
|00000400| 03 04 53 65 52 65 6c 65 | 61 73 65 53 75 62 6a 65 |..SeRele|aseSubje|
|00000410| 63 74 43 6f 6e 74 65 78 | 74 00 e1 03 53 65 41 63 |ctContex|t...SeAc|
|00000420| 63 65 73 73 43 68 65 63 | 6b 00 ea 03 53 65 43 61 |cessChec|k...SeCa|
|00000430| 70 74 75 72 65 53 75 62 | 6a 65 63 74 43 6f 6e 74 |ptureSub|jectCont|
|00000440| 65 78 74 00 6e 74 6f 73 | 6b 72 6e 6c 2e 65 78 65 |ext.ntos|krnl.exe|
|00000450| 00 00 50 00 4b 66 4c 6f | 77 65 72 49 72 71 6c 00 |..P.KfLo|werIrql.|
|00000460| 51 00 4b 66 52 61 69 73 | 65 49 72 71 6c 00 48 41 |Q.KfRais|eIrql.HA|
|00000470| 4c 2e 64 6c 6c 00 00 00 | 00 00 00 00 00 00 00 00 |L.dll...|........|
+--------+-------------------------+-------------------------+--------+--------+