mirror of
https://github.com/wavestone-cdt/EDRSandblast.git
synced 2026-06-08 16:37:12 +00:00
Maxime Meignan
7590a11389
Instead of using the kernel R/W primitive, uses userland API to enumerate kernel modules
14 lines
456 B
C
14 lines
456 B
C
#pragma once
|
|
#pragma comment(lib, "ntdll.lib")
|
|
#define DEFAULT_EVIL_DRIVER_FILE TEXT("evil.sys")
|
|
|
|
#include "PrintFunctions.h"
|
|
|
|
#if !defined(PRINT_ERROR_AUTO)
|
|
#define PRINT_ERROR_AUTO(func) _tprintf_or_not(TEXT("[!] ERROR ") TEXT(__FUNCTION__) TEXT(" ; ") func TEXT(" (0x%08x)\n"), GetLastError())
|
|
#endif
|
|
|
|
BOOLEAN IsCiEnabled();
|
|
DWORD64 FindCIBaseAddress();
|
|
BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue);
|