From 60e725a6687e8fb466a85eed864b170d92161f38 Mon Sep 17 00:00:00 2001 From: IDontCode Date: Thu, 12 Nov 2020 00:44:26 +0000 Subject: [PATCH] Update README.md --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 9926051..7f4fbac 100644 --- a/README.md +++ b/README.md @@ -7,10 +7,6 @@ -# credit - -* buck#0001 - contributed to nasa-tables which is inherited in this project... - # PSKDM (Process-Context Specific Kernel Driver Mapper) Map a driver into specific processes only, with zero allocations in the kernel. The driver is allocated in a suspended runtimebroker.exe which is created with the sole @@ -39,4 +35,8 @@ processes pointing at the allocated driver in the runtimebroker, thus mapping th Keeping your driver out of the kernels paging tables. Most driver mappers map a driver into a kernel pool (ExAllocatePool). Physmeme, Kdmapper, Drvmapper, all do this, its easily detected and easy to dump. This keeps your driver inside of your context :) -I guess you can call this physmeme v2? You can use any driver that exposes physical memory read/write with this driver mapper, simply replace the vulnerable driver inside of raw_driver.hpp. \ No newline at end of file +I guess you can call this physmeme v2? You can use any driver that exposes physical memory read/write with this driver mapper, simply replace the vulnerable driver inside of raw_driver.hpp. + +# credit + +* buck#0001 - contributed to nasa-tables which is inherited in this project... \ No newline at end of file