IDontCode
/
BELog
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update README.md

Browse Source
master
xerox 4 years ago
parent 48e75f8df2
commit a79e358a68
1 changed files with 72 additions and 0 deletions
Show Stats Download Patch File Download Diff File

72
README.md
Unescape View File

@ -70,4 +70,76 @@ BEDaisy then sends a few IOCTL's to disk.sys using `ZwDeviceIoControlFile`
02646074 190.99211121 [GoodEye] - IoControlCode: 0x000000000007C088 02646074 190.99211121 [GoodEye] - IoControlCode: 0x000000000007C088
02646075 190.99211121 [GoodEye] - OutputBufferLength: 0x0000000000000211 02646075 190.99211121 [GoodEye] - OutputBufferLength: 0x0000000000000211
02646076 190.99211121 [GoodEye] - InoutBufferLength: 0x0000000000000021 02646076 190.99211121 [GoodEye] - InoutBufferLength: 0x0000000000000021
```
# IRP
BEDaisy checks the IRP's of every single loaded driver. Below is the checks done on dxgkrnl.sys on windows 10-2004.
```
00042942 92.55983734 [GoodEye]gh_wcsnicmp called from: 0xFFFFF804DEFDD874
00042943 92.55983734 [GoodEye] - string1: C:\Windows\System32\drivers\dxgkrnl.sys
00042944 92.55983734 [GoodEye] - string2: C:\Windows\System32\drivers\dxgkrnl.sys
00042945 92.55983734 [GoodEye] - count: 0x27
00042946 92.55996704 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFDD8B6
00042947 92.55996704 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F10000
00042948 92.56076813 [GoodEye]ExFreePoolWithTag called from: 0xFFFFF804DEFDD8D7
00042949 92.56076813 [GoodEye] - Freeing pool at: 0xFFFFC8081516C850
00042950 92.56076813 [GoodEye] - Pool Tag: 0x0
00042951 92.56208801 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042952 92.56209564 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8049905E400
00042953 92.56209564 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042954 92.56209564 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042955 92.56209564 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042956 92.56209564 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8049905E400
00042957 92.56209564 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042958 92.56209564 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042959 92.56209564 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042960 92.56210327 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042961 92.56210327 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042962 92.56210327 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042963 92.56210327 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042964 92.56210327 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042965 92.56211090 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042966 92.56211090 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042967 92.56211090 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042968 92.56211090 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042969 92.56211853 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042970 92.56211853 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042971 92.56211853 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042972 92.56211853 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042973 92.56211853 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042974 92.56212616 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042975 92.56212616 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042976 92.56212616 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042977 92.56212616 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042978 92.56212616 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042979 92.56213379 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042980 92.56213379 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F516A0
00042981 92.56213379 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042982 92.56213379 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80499059670
00042983 92.56214142 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042984 92.56214142 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8049916C4D0
00042985 92.56214142 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042986 92.56214142 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042987 92.56214142 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042988 92.56214905 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042989 92.56214905 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042990 92.56214905 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042991 92.56214905 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042992 92.56214905 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042993 92.56215668 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042994 92.56215668 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042995 92.56215668 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042996 92.56215668 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042997 92.56215668 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00042998 92.56216431 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00042999 92.56216431 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00043000 92.56216431 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00043001 92.56216431 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00043002 92.56216431 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00043003 92.56217194 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00043004 92.56217194 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00043005 92.56217194 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00043006 92.56217194 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
``` ```
Write Preview
Loading…
Cancel
Save