| Commit message (Collapse) | Author | Age |
|---|
| | |
|
| | |
|
| |
|
|
| |
KiSwInterrupt is present since Windows 10 and is the interrupt handler for int 20h. This interrupt is a spurious interrupt on older versions of Windows, and does nothing useful on Windows 10. If int 20h is issued from kernel mode, the PatchGuard verification routine KiSwInterruptDispatch is called. This leads to a bugcheck if PatchGuard has not been initialized.
|
| |
|
|
| |
This makes this optional pattern scan work on the current Windows 10 20H1 preview release
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
PE section names must be null terminated because they are not guaranteed to be. However they must be null terminated at 8 characters, not at the length of the string that happens to be relevant for whatever reason. This would have led to false positives when finding sections, were it not for the off-by-one error that was keeping an additional character in the buffer
|
| | |
|
| | |
|
| |
|