diff --git a/VDM/main.cpp b/VDM/main.cpp index 0159eaf..aef75e2 100644 --- a/VDM/main.cpp +++ b/VDM/main.cpp @@ -10,21 +10,25 @@ int __cdecl main(int argc, char** argv) } vdm::vdm_ctx vdm; - std::printf("[+] drv_handle -> 0x%x, drv_key -> %s\n", drv_handle, drv_key.c_str()); - std::printf("[+] %s physical address -> 0x%p\n", vdm::syscall_hook.first, vdm::syscall_address.load()); - - const auto ntoskrnl_base = + const auto ntoskrnl_base = reinterpret_cast( util::get_module_base("ntoskrnl.exe")); - const auto ntoskrnl_memcpy = + const auto ntoskrnl_memcpy = util::get_kernel_export("ntoskrnl.exe", "memcpy"); + std::printf("[+] drv_handle -> 0x%x, drv_key -> %s\n", drv_handle, drv_key.c_str()); + std::printf("[+] %s physical address -> 0x%p\n", vdm::syscall_hook.first, vdm::syscall_address.load()); std::printf("[+] ntoskrnl base address -> 0x%p\n", ntoskrnl_base); std::printf("[+] ntoskrnl memcpy address -> 0x%p\n", ntoskrnl_memcpy); short mz_bytes = 0; - vdm.syscall(ntoskrnl_memcpy, &mz_bytes, ntoskrnl_base, sizeof mz_bytes); + vdm.syscall( + ntoskrnl_memcpy, + &mz_bytes, + ntoskrnl_base, + sizeof mz_bytes + ); std::printf("[+] kernel MZ -> 0x%x\n", mz_bytes); if (!vdm::unload_drv(drv_handle, drv_key)) diff --git a/VDM/vdm/vdm.hpp b/VDM/vdm/vdm.hpp index 913fa8f..d7d66b4 100644 --- a/VDM/vdm/vdm.hpp +++ b/VDM/vdm/vdm.hpp @@ -31,7 +31,8 @@ namespace vdm sizeof(vdm::raw_driver) ); - if (!result) return { {}, {} }; + if (!result) + return { {}, {} }; vdm::drv_handle = CreateFile( "\\\\.\\GIO", diff --git a/drivers/README.md b/drivers/README.md deleted file mode 100644 index 9e1cd6a..0000000 Binary files a/drivers/README.md and /dev/null differ