Update README.md

4 years ago · a79e358a68
parent 48e75f8df2
commit a79e358a68
1 changed files with 72 additions and 0 deletions
--- a/README.md
+++ b/README.md
@ -70,4 +70,76 @@ BEDaisy then sends a few IOCTL's to disk.sys using `ZwDeviceIoControlFile`
 02646074	190.99211121	[GoodEye]     - IoControlCode: 0x000000000007C088	
 02646075	190.99211121	[GoodEye]     - OutputBufferLength: 0x0000000000000211	
 02646076	190.99211121	[GoodEye]     - InoutBufferLength: 0x0000000000000021	
+```
+
+# IRP
+
+BEDaisy checks the IRP's of every single loaded driver. Below is the checks done on dxgkrnl.sys on windows 10-2004.
+
+```
+00042942	92.55983734	[GoodEye]gh_wcsnicmp called from: 0xFFFFF804DEFDD874	
+00042943	92.55983734	[GoodEye]     - string1: C:\Windows\System32\drivers\dxgkrnl.sys	
+00042944	92.55983734	[GoodEye]     - string2: C:\Windows\System32\drivers\dxgkrnl.sys	
+00042945	92.55983734	[GoodEye]     - count: 0x27	
+00042946	92.55996704	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFDD8B6	
+00042947	92.55996704	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF80498F10000	
+00042948	92.56076813	[GoodEye]ExFreePoolWithTag called from: 0xFFFFF804DEFDD8D7	
+00042949	92.56076813	[GoodEye]     - Freeing pool at: 0xFFFFC8081516C850	
+00042950	92.56076813	[GoodEye]     - Pool Tag: 0x0	
+00042951	92.56208801	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042952	92.56209564	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8049905E400	
+00042953	92.56209564	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042954	92.56209564	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042955	92.56209564	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042956	92.56209564	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8049905E400	
+00042957	92.56209564	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042958	92.56209564	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042959	92.56209564	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042960	92.56210327	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042961	92.56210327	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042962	92.56210327	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042963	92.56210327	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042964	92.56210327	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042965	92.56211090	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042966	92.56211090	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042967	92.56211090	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042968	92.56211090	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042969	92.56211853	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042970	92.56211853	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042971	92.56211853	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042972	92.56211853	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042973	92.56211853	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042974	92.56212616	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042975	92.56212616	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042976	92.56212616	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042977	92.56212616	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042978	92.56212616	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042979	92.56213379	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042980	92.56213379	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF80498F516A0	
+00042981	92.56213379	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042982	92.56213379	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF80499059670	
+00042983	92.56214142	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042984	92.56214142	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8049916C4D0	
+00042985	92.56214142	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042986	92.56214142	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042987	92.56214142	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042988	92.56214905	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042989	92.56214905	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042990	92.56214905	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042991	92.56214905	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042992	92.56214905	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042993	92.56215668	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042994	92.56215668	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042995	92.56215668	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042996	92.56215668	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042997	92.56215668	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00042998	92.56216431	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00042999	92.56216431	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00043000	92.56216431	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00043001	92.56216431	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00043002	92.56216431	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00043003	92.56217194	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00043004	92.56217194	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
+00043005	92.56217194	[GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116	
+00043006	92.56217194	[GoodEye]     - NonPaged VirtualAddress: 0xFFFFF8047EF364C0	
 ```