谢谢楼主的共享，注释也挺多的！！

学习，学习。。。

大哥 挂了4个钩子 就叫云安全主动防御了。 名字叫的太大了？

收藏，学习。。。。

刚看了作品报告，写得很不错，楼主辛苦了。我觉得这些对于学习者来说，有很大的帮助，再次表示感谢！

好东西一定要支持拉！

我喜欢楼主                                                       的技术

樓主厲害啊~

值得收藏的经典

很好，正在学习中

我想楼主一个人搞这么多代码，可能也是一步一步学习过来的，不容易哈。这么好的东西一定要收藏

简单看了一下代码，我个人的感觉，这个软件更像一个Hips，而不是一个基于行为序列的主动防御。

不顶起，就太不给力了，mark!

开源伟大 顶起

收藏先...再慢慢学习...

佩服，佩服

支持！！！！

强悍啊！我的专业也不是计算机的，但是个人对其有兴趣，但是感觉学着好累啊！

收藏了。。。

楼主， 为什么编译通不过：
e:\codelibary\卓然主动防御源码\源码(应用层+驱动部分) : error C2220: warning trea
ted as error - no object file generated
e:\codelibary\卓然主动防御源码\源码(应用层+驱动部分) : error C4142: benign redef
inition of type

我用的DDK是WINDDK\3790.1830
驱动没有一个编译通过的， 都是warning treated as error 的错误， 但是又不知道是哪行

我用VS2008编译应用程序：
Deleting intermediate and output files for project '主动防御', configuration 'Debug|Win32'
Compiling...
stdafx.cpp
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(293) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(298) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(395) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(500) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(613) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(616) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(710) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(713) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(800) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(804) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(811) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(920) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\transact.h(924) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2911) : error C2061: syntax error : identifier '__RPC__inout_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2926) : error C2061: syntax error : identifier '__RPC__in_ecount_full_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2930) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2930) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2943) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2946) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2946) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(2959) : error C2061: syntax error : identifier '__RPC__inout_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3231) : error C2061: syntax error : identifier '__RPC__in_ecount_full_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3234) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3234) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3247) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3261) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3901) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(3915) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4161) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4173) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4188) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4202) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4218) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4316) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4423) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4437) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4545) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4560) : error C2061: syntax error : identifier '__RPC__out'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4670) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4673) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4673) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4686) : error C2061: syntax error : identifier '__RPC__in_ecount_full'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4688) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4688) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4813) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4815) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4815) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4926) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(4942) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5586) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5725) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5731) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5731) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5743) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5748) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5748) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(5760) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6040) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6052) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6064) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6064) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6076) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6185) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6305) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6405) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6417) : error C2061: syntax error : identifier '__RPC__deref_out_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6527) : error C2061: syntax error : identifier '__RPC__in_ecount_full_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6530) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6530) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6543) : error C2061: syntax error : identifier '__RPC__in_ecount_full_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6546) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6546) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6679) : error C2061: syntax error : identifier '__RPC__inout_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6693) : error C2061: syntax error : identifier '__RPC__in'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6830) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6835) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6835) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6848) : error C2061: syntax error : identifier '__RPC__in_ecount_full'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6850) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6850) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6863) : error C2061: syntax error : identifier '__RPC__in_ecount_full_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6865) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6865) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6980) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6982) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6982) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(6994) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7003) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7003) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7114) : error C2061: syntax error : identifier '__RPC__inout'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7120) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7120) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7133) : error C2061: syntax error : identifier '__RPC__in_ecount_full'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7135) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7135) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7230) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7328) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7454) : error C2061: syntax error : identifier '__RPC__in_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7461) : error C2059: syntax error : ')'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7461) : error C2143: syntax error : missing ')' before ';'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7591) : error C2061: syntax error : identifier '__RPC__in_ecount_full_opt'
c:\program files\microsoft sdks\windows\v6.0a\include\oledb.h(7591) : fatal error C1003: error count exceeds 100; stopping compilation
Build log was saved at "file://e:\CodeLibary\卓然主动防御源码\源码(应用层+驱动部分)\应用程序部分\卓然驱动级主动防御\Debug\BuildLog.htm"
主动防御 - 102 error(s), 0 warning(s)
========== Rebuild All: 0 succeeded, 1 failed, 0 skipped ==========

也不知道什么原因， 能说一下你的编译环境吗？

报告里写的很清楚。

楼上的你编译过了？
我装的就是VS2008呀， 应用程序编译不过的
你看看上面的错误提示， 都是VS2008自带的sdk的错误

我K， 我终于知道什么原因了， 原来你们装VS2008都不装额外的SDK的， 我装了一个platform sdk 2003并且在VS2008中设置了include， 估计是因为冲突了所以编译不通过

对于驱动， 我发现用DDK3790.1380 xp checked 也是编译不过
e:\codelibary\卓然主动防御源码\源码(应用层+驱动部分)\驱动部分\file\filemon.c(263) : error C2220: warning treated as error - no object file generated
e:\codelibary\卓然主动防御源码\源码(应用层+驱动部分)\驱动部分\file\filemon.c(263) : warning C4142: benign redefinition of type

估计我得装WDK了。 这些版本居然差别这么大

收藏学习~~