OSa

OSa is a RootKit with a built-in translator. The ability to redefine on-the-fly access to functions in Dlls and on-the-fly translation of functions allows you to easily and quickly determine and (or) change the behavior of a process in relation to the system and other processes.

OSa is intended for debugging programs, for monitoring and/or changing the behavior of various processes, analyzing their interaction with the operating system and/or other programs.

There are examples of work with the registry, the file system and an example that shows OSa's ability to hide a process from the standard Windows process viewer (taskmgr.exe).

OSa allows to recreate executable binary files so that they replace function calls from DLLs (system and not only) with their own before starting to execute their startup code, it is also possible to work with already running processes.