Maxime Meignan bf749f54c7 PE parser: added a feature to parse a PE directly from kernel memory ...

Could be used in the future to resolve export instead of a
suspicious LoadLibrary("ntoskrnl.exe")

2023-11-03 16:13:13 +01:00

..

Drivers

cosmetic changes

2023-11-03 16:10:40 +01:00

Includes

PE parser: added a feature to parse a PE directly from kernel memory

2023-11-03 16:13:13 +01:00

KernellandBypass

DSE bypass : implemented "callback swapping" method

2023-11-03 15:13:36 +01:00

LSASSProtectionBypass

small cleanup in header files

2023-10-06 16:12:52 +02:00

UserlandBypass

various cosmetic changes to please the code analyzer

2023-10-31 17:07:17 +01:00

Utils

PE parser: added a feature to parse a PE directly from kernel memory

2023-11-03 16:13:13 +01:00

EDRSandblast.vcxproj

visual studio configuration changes

2023-11-03 16:11:39 +01:00

EDRSandblast.vcxproj.filters

Implements a check on PDB files to avoid using an invalid one and crash the machine

2023-10-10 15:44:20 +02:00