diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2020-03-24 18:06:08 +0100 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2020-03-24 18:06:08 +0100 |
| commit | cd76323e681de15f8391ce900142e965ad3b689c (patch) | |
| tree | 89eaa5831078de8f2c5a67d70efd4c5477722c75 | |
| parent | 82098008ace097392c950a911b15030c342e0f8a (diff) | |
update READMEVS-2017-backport
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
| -rw-r--r-- | README.md | 6 |
1 files changed, 2 insertions, 4 deletions
@@ -25,7 +25,7 @@ It should now be possible to load the (Debug) target driver by running `driver-s You can now use **PastDSECtrl** to manual map your (unsigned) driver. -## *** IMPORTANT, READ THIS BEFORE RUNNING ANYTHING *** +# Insights Your driver requires an exported `NTSTATUS DriverEntry(_In_ struct _DRIVER_OBJECT *DriverObject, _In_ PUNICODE_STRING RegistryPath)` symbol just as usual. @@ -37,9 +37,7 @@ Example: - *PatchGuard* will complain if you use functions like `PsSetLoadImageNotifyRoutine`, `PsSetCreateProcessNotifyRoutine` and `PsSetCreateThreadNotifyRoutine` - `ObRegisterCallbacks` returns *Access denied* - there may be other functions e.g. `FltRegisterFilter` - -It is possible to use these funcions by hijacking an existing driver objects. You'll figure that out. # Contributors -As you can see, I've used some slightly modified code from [BlackBone](https://github.com/DarthTon/Blackbone) for the driver mapping and relocation.
\ No newline at end of file +Some slightly modified code from [BlackBone](https://github.com/DarthTon/Blackbone) for the driver mapping and relocation. |