Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-11 01:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

New BYOVD-driver support: GDRV.sys (GigaByte)

Browse Source
This commit is contained in:
v1k1ngfr
2022-12-25 01:07:15 +01:00
committed by Maxime Meignan
parent 9939301140
commit 0bbe76aab1
6 changed files with 142 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast/Includes/DriverGDRV.h
+7
View File
@@ -0,0 +1,7 @@
#pragma once
#include <Windows.h>
HANDLE GetDriverHandle_GDRV();
VOID CloseDriverHandle_GDRV();
VOID ReadMemoryPrimitive_GDRV(SIZE_T Size, DWORD64 Address, PVOID Buffer);
VOID WriteMemoryPrimitive_GDRV(SIZE_T Size, DWORD64 Address, PVOID Buffer);
EDRSandblast/Includes/KernelMemoryPrimitives.h
+6 -1
View File
@@ -11,6 +11,7 @@
#define RTCore 0
#define DBUtil 1
#define GDRV 2
// Select the driver to use with the following #define
#define VULN_DRIVER RTCore
@@ -24,9 +25,13 @@
#define CloseDriverHandle CloseDriverHandle_DBUtil
#define ReadMemoryPrimitive ReadMemoryPrimitive_DBUtil
#define WriteMemoryPrimitive WriteMemoryPrimitive_DBUtil
#elif VULN_DRIVER == GDRV
#define DEFAULT_DRIVER_FILE TEXT("gdrv.sys")
#define CloseDriverHandle CloseDriverHandle_GDRV
#define ReadMemoryPrimitive ReadMemoryPrimitive_GDRV
#define WriteMemoryPrimitive WriteMemoryPrimitive_GDRV
#endif
BYTE ReadMemoryBYTE(DWORD64 Address);
WORD ReadMemoryWORD(DWORD64 Address);
DWORD ReadMemoryDWORD(DWORD64 Address);