diff options
| author | Barry Golden <[email protected]> | 2015-07-30 16:03:24 -0700 |
|---|---|---|
| committer | Barry Golden <[email protected]> | 2015-07-30 16:03:24 -0700 |
| commit | 4dc90ad04d5e40851e2e370f487b7cc9a3be071b (patch) | |
| tree | c2e74dd18a743893c555d311f29ad9fba77b60c6 /general/obcallback | |
| parent | d3abcb10a801986a2956d6bbdfeb652bda1d9a74 (diff) | |
Update README.md
Diffstat (limited to 'general/obcallback')
| -rw-r--r-- | general/obcallback/ReadMe.md | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/general/obcallback/ReadMe.md b/general/obcallback/ReadMe.md index def34eac..7efc2741 100644 --- a/general/obcallback/ReadMe.md +++ b/general/obcallback/ReadMe.md @@ -11,7 +11,7 @@ The sample exercises both the [**PsSetCreateProcessNotifyRoutineEx**](http://msd The following is a command line usage scenario to exercise access restriction: -``` {.syntax xml:space="preserve"} +``` C:\> obcallbacktestctrl.exe -? (for command line help) C:\> obcallbacktestctrl.exe -install (installs the kernel driver) C:\> obcallbacktestctrl.exe -name notepad (specifies that the string “notepad” will be watched as a protected executable) @@ -27,13 +27,11 @@ C:\> obcallbacktestctrl.exe -deprotect (remove the protections on C:\> kill –f 2329 (attempt to kill off the process – which will succeed) C:\> obcallbacktestctrl.exe -uninstall (uninstall the kernel driver) - - ``` The following is another sample test you can run to prevent a process from being created: -``` {.syntax xml:space="preserve"} +``` C:\> obcallbacktestctrl.exe -install (installs the kernel driver) C:\> obcallbacktestctrl.exe -reject notepad (specifies that the string “notepad” will be watched and prevented from starting as a process) |