Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-10 17:31:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

DSE bypass : implemented "callback swapping" method

Browse Source 
The new default method for unsigned driver loading uses a KDP compatible
technique, since it does not overwrite the protected variable g_CiOptions.
Based on the work of: https://github.com/0mWindyBug/KDP-compatible-driver-loader

Co-authored-by: Windy Bug <139051196+0mWindyBug@users.noreply.github.com>
This commit is contained in:
Maxime Meignan
2023-11-03 14:38:01 +01:00
parent 15c3b706f1
commit f15471d12c
12 changed files with 1408 additions and 1015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast/Includes/KernelDSE.h
+15
View File
@@ -8,6 +8,21 @@
#define PRINT_ERROR_AUTO(func) _tprintf_or_not(TEXT("[!] ERROR ") TEXT(__FUNCTION__) TEXT(" ; ") func TEXT(" (0x%08x)\n"), GetLastError())
#endif
enum dseDisablingMethods_e {
G_CIOPTIONS_PATCHING,
CALLBACK_SWAPPING,
};
BOOLEAN IsCiEnabled();
DWORD64 FindCIBaseAddress();
BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue);
BOOL disableDSE(enum dseDisablingMethods_e method, BOOL verbose);
BOOL reenableDSE(enum dseDisablingMethods_e method, BOOL verbose);
BOOL disableDSEbyCallbackSwapping(DWORD64* oldCiValidateImageHeaderEntryAddr);
BOOL reenableDSEbyCallbackSwapping(DWORD64 ciValidateImageHeaderEntryAddr);
BOOL disableDSEbyPatchingCiOptions(BOOL verbose, _Out_ ULONG* OldCiOptionsValue);
BOOL reenableDSEbyPatchingCiOptions(ULONG OldCiOptionsValue);