POC about how to detect windows kernel debug by pool tag.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
gmh5225 3b1797b196
Update
9 months ago
images Update 9 months ago
.clang-format Update 9 months ago
LICENSE Update 9 months ago
README.md Update 9 months ago
detect.h Update 9 months ago
detect.poc.pooltag.cpp Update 9 months ago
main.cpp Update 9 months ago
poc.sln Update 9 months ago
poc.vcxproj Update 9 months ago
poc.vcxproj.filters Update 9 months ago
util.cpp Update 9 months ago
util.h Update 9 months ago

README.md

AntiKernelDebug-poc

What's this?

A POC about how to detect windows kernel debug by pool tag.

How does this poc actually work?

Query system pool tag information matches TagUlong == 'oIdK'.

Tested in Win10 1809

image

Compile

  • Visual Studio 2019
  • llvm-msvc [link]