Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-11 01:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

CiOptions: Simplifies the way CI.dll base address is recovered

Browse Source 
Instead of using the kernel R/W primitive, uses userland API to enumerate
kernel modules
This commit is contained in:
Maxime Meignan
2023-10-09 16:29:19 +02:00
parent 0a817fea93
commit 7590a11389
6 changed files with 42 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast/Includes/KernelDSE.h
+3 -1
View File
@@ -2,10 +2,12 @@
#pragma comment(lib, "ntdll.lib")
#define DEFAULT_EVIL_DRIVER_FILE TEXT("evil.sys")
#include "PrintFunctions.h"
#if !defined(PRINT_ERROR_AUTO)
#define PRINT_ERROR_AUTO(func) _tprintf_or_not(TEXT("[!] ERROR ") TEXT(__FUNCTION__) TEXT(" ; ") func TEXT(" (0x%08x)\n"), GetLastError())
#endif
BOOLEAN IsCiEnabled();
DWORD64 FindCIBaseAddress(BOOL verbose);
DWORD64 FindCIBaseAddress();
BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue);