diff --git a/README.md b/README.md index 3ada2af..65b7cea 100644 --- a/README.md +++ b/README.md @@ -70,67 +70,4 @@ BEDaisy then sends a few IOCTL's to disk.sys using `ZwDeviceIoControlFile` 02646074 190.99211121 [GoodEye] - IoControlCode: 0x000000000007C088 02646075 190.99211121 [GoodEye] - OutputBufferLength: 0x0000000000000211 02646076 190.99211121 [GoodEye] - InoutBufferLength: 0x0000000000000021 -``` - -# IRP - -Below you can see that bedaisy calls `MmIsAddressValid` on every single IRP of every single driver. Below is `dxgkrnl.sys`. - -``` -00052032 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052033 94.91796112 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01510 -00052034 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052035 94.91796112 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052036 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052037 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F011B0 -00052038 94.91796875 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052039 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052040 94.91796875 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052041 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052042 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052043 94.91797638 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052044 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052045 94.91797638 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052046 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052047 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052048 94.91798401 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052049 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052050 94.91798401 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052051 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052052 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052053 94.91799164 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052054 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052055 94.91799164 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052056 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052057 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052058 94.91799927 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052059 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052060 94.91799927 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052061 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01290 -00052062 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052063 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052064 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052065 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052066 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052067 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052068 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052069 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01070 -00052070 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052071 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052072 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052073 94.91801453 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052074 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052075 94.91801453 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052076 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052077 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052078 94.91802216 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052079 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052080 94.91802216 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052081 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052082 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052083 94.91802979 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052084 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052085 94.91802979 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 -00052086 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116 -00052087 94.91803741 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0 ``` \ No newline at end of file