From cd76323e681de15f8391ce900142e965ad3b689c Mon Sep 17 00:00:00 2001 From: Toni Uhlig Date: Tue, 24 Mar 2020 18:06:08 +0100 Subject: update README Signed-off-by: Toni Uhlig --- README.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 48712b5..d856459 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ It should now be possible to load the (Debug) target driver by running `driver-s You can now use **PastDSECtrl** to manual map your (unsigned) driver. -## *** IMPORTANT, READ THIS BEFORE RUNNING ANYTHING *** +# Insights Your driver requires an exported `NTSTATUS DriverEntry(_In_ struct _DRIVER_OBJECT *DriverObject, _In_ PUNICODE_STRING RegistryPath)` symbol just as usual. @@ -37,9 +37,7 @@ Example: - *PatchGuard* will complain if you use functions like `PsSetLoadImageNotifyRoutine`, `PsSetCreateProcessNotifyRoutine` and `PsSetCreateThreadNotifyRoutine` - `ObRegisterCallbacks` returns *Access denied* - there may be other functions e.g. `FltRegisterFilter` - -It is possible to use these funcions by hijacking an existing driver objects. You'll figure that out. # Contributors -As you can see, I've used some slightly modified code from [BlackBone](https://github.com/DarthTon/Blackbone) for the driver mapping and relocation. \ No newline at end of file +Some slightly modified code from [BlackBone](https://github.com/DarthTon/Blackbone) for the driver mapping and relocation. -- cgit v1.2.3