You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
9 months ago | |
---|---|---|
images | 9 months ago | |
.clang-format | 9 months ago | |
LICENSE | 9 months ago | |
README.md | 9 months ago | |
detect.h | 9 months ago | |
detect.poc.pooltag.cpp | 9 months ago | |
main.cpp | 9 months ago | |
poc.sln | 9 months ago | |
poc.vcxproj | 9 months ago | |
poc.vcxproj.filters | 9 months ago | |
util.cpp | 9 months ago | |
util.h | 9 months ago |
README.md
AntiKernelDebug-poc
What's this?
A POC about how to detect windows kernel debug by pool tag.
How does this poc actually work?
Query system pool tag information matches TagUlong == 'oIdK'.
Tested in Win10 1809
Compile
- Visual Studio 2019
- llvm-msvc [link]