You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
1 year ago | |
---|---|---|
images | 1 year ago | |
.clang-format | 1 year ago | |
LICENSE | 1 year ago | |
README.md | 1 year ago | |
detect.h | 1 year ago | |
detect.poc.pooltag.cpp | 1 year ago | |
main.cpp | 1 year ago | |
poc.sln | 1 year ago | |
poc.vcxproj | 1 year ago | |
poc.vcxproj.filters | 1 year ago | |
util.cpp | 1 year ago | |
util.h | 1 year ago |
README.md
AntiKernelDebug-poc
What's this?
A POC about how to detect windows kernel debug by pool tag.
How does this poc actually work?
Query system pool tag information matches TagUlong == 'oIdK'.
Tested in Win10 1809
Compile
- Visual Studio 2019
- llvm-msvc [link]