Joebox 1.0.0 (released 18.01.2008) - first public available version Joebox 1.0.1 (released 26.01.2008) - NtOpenKey hooked - NT (\??\C:\) and device paths (\device\harddiskvolum1) are converted to DOS paths - Registry paths \registry\machine and \registry\user are converted to HKEY_LOCAL_MACHINE and HKEY_USERS - Drivers are know analysed properly - Analysis driver find the config file relatively to his path - Driver log file will be stored in directory were the driver was placed - Added cookie system to driver to call hooked function without being analysed - Complete revision of the analysis file - Added section other file operations - Added section keys opened - If a file was opened or created is detected by the returned IO status block - If a key was opened or created is detected by the returned disposition - Removed bogus kernel calling statistic - No more a maximum of concurrent process and driver analysis - Fixed error "driver unloaded without canceling pending operations" - Corrected time from system to local time Joebox 1.0.2 (released 28.01.2008) - Fixed error "driver unloaded without canceling pending operations" definitively - Fixed page fault bug while extract registry paths - Corrected bugy driver and process filter