diff options
| author | Barry Golden <[email protected]> | 2015-08-07 17:05:36 -0700 |
|---|---|---|
| committer | Barry Golden <[email protected]> | 2015-08-07 17:05:36 -0700 |
| commit | 93217010e0c3d492c432fbccb167f6070775ba36 (patch) | |
| tree | 914aa9ccf9757a996882321d0896262989e80459 /general/obcallback | |
| parent | 7c089b4b332b8a8bd2e29672bbf4f6ee430b3e77 (diff) | |
Update README.md
Diffstat (limited to 'general/obcallback')
| -rw-r--r-- | general/obcallback/ReadMe.md | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/general/obcallback/ReadMe.md b/general/obcallback/ReadMe.md index d91a209d..ca4069a2 100644 --- a/general/obcallback/ReadMe.md +++ b/general/obcallback/ReadMe.md @@ -14,18 +14,18 @@ The following is a command line usage scenario to exercise access restriction: ``` C:\> obcallbacktestctrl.exe -? (for command line help) C:\> obcallbacktestctrl.exe -install (installs the kernel driver) -C:\> obcallbacktestctrl.exe -name notepad (specifies that the string “notepad” will be watched as a protected executable) - (now you can start up “notepad.exe”) +C:\> obcallbacktestctrl.exe -name notepad (specifies that the string "notepad" will be watched as a protected executable) + (now you can start up "notepad.exe") C:\> notepad C:\> tlist (locate the process ID of notepad.exe) C:\> kill -f 2329 (attempt to kill off the notepad.exe with a PID of 2329) -process notepad.exe (2329) - 'Untitled – Notepad' could not be killed +process notepad.exe (2329) - 'Untitled - Notepad' could not be killed C:\> obcallbacktestctrl.exe -deprotect (remove the protections on the notepad process) -C:\> kill -f 2329 (attempt to kill off the process – which will succeed) +C:\> kill -f 2329 (attempt to kill off the process - which will succeed) C:\> obcallbacktestctrl.exe -uninstall (uninstall the kernel driver) ``` @@ -33,8 +33,8 @@ The following is another sample test you can run to prevent a process from being ``` C:\> obcallbacktestctrl.exe -install (installs the kernel driver) -C:\> obcallbacktestctrl.exe -reject notepad (specifies that the string “notepad” will be watched and prevented from starting as a process) +C:\> obcallbacktestctrl.exe -reject notepad (specifies that the string "notepad" will be watched and prevented from starting as a process) -C:\> notepad (now you can start up “notepad.exe”) +C:\> notepad (now you can start up "notepad.exe") Access is denied. ``` |