IDontCode
/
BELog
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update README.md

Browse Source
master
xerox 4 years ago
parent 032ac66cfd
commit 48e75f8df2
1 changed files with 0 additions and 63 deletions
Show Stats Download Patch File Download Diff File

63
README.md
Unescape View File

@ -70,67 +70,4 @@ BEDaisy then sends a few IOCTL's to disk.sys using `ZwDeviceIoControlFile`
02646074 190.99211121 [GoodEye] - IoControlCode: 0x000000000007C088 02646074 190.99211121 [GoodEye] - IoControlCode: 0x000000000007C088
02646075 190.99211121 [GoodEye] - OutputBufferLength: 0x0000000000000211 02646075 190.99211121 [GoodEye] - OutputBufferLength: 0x0000000000000211
02646076 190.99211121 [GoodEye] - InoutBufferLength: 0x0000000000000021 02646076 190.99211121 [GoodEye] - InoutBufferLength: 0x0000000000000021
```
# IRP
Below you can see that bedaisy calls `MmIsAddressValid` on every single IRP of every single driver. Below is `dxgkrnl.sys`.
```
00052032 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052033 94.91796112 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01510
00052034 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052035 94.91796112 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052036 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052037 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F011B0
00052038 94.91796875 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052039 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052040 94.91796875 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052041 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052042 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052043 94.91797638 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052044 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052045 94.91797638 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052046 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052047 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052048 94.91798401 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052049 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052050 94.91798401 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052051 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052052 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052053 94.91799164 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052054 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052055 94.91799164 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052056 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052057 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052058 94.91799927 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052059 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052060 94.91799927 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052061 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01290
00052062 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052063 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052064 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052065 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052066 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052067 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052068 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052069 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01070
00052070 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052071 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052072 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052073 94.91801453 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052074 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052075 94.91801453 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052076 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052077 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052078 94.91802216 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052079 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052080 94.91802216 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052081 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052082 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052083 94.91802979 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052084 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052085 94.91802979 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052086 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052087 94.91803741 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
``` ```
Write Preview
Loading…
Cancel
Save