Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-11 01:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

CiOptions: Simplifies the way CI.dll base address is recovered

Browse Source 
Instead of using the kernel R/W primitive, uses userland API to enumerate
kernel modules
This commit is contained in:
Maxime Meignan
2023-10-09 16:29:19 +02:00
parent 0a817fea93
commit 7590a11389
6 changed files with 42 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast/Includes/KernelUtils.h
+1
View File
@@ -2,6 +2,7 @@
#include <Windows.h>
DWORD64 FindNtoskrnlBaseAddress(void);
DWORD64 FindKernelModuleAddressByName(_In_ LPTSTR name);
TCHAR* FindDriverName(DWORD64 address, _Out_opt_ PDWORD64 offset);
TCHAR* FindDriverPath(DWORD64 address);
DWORD64 GetKernelFunctionAddress(LPCSTR function);