You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

41 lines
1.0 KiB

#include "detect.h"
#include "util.h"
bool
AntiKernelDbgByPoolTag()
{
bool bKdbg = false;
PSYSTEM_POOLTAG_INFORMATION pPoolTagTable = NULL;
do
{
NTSTATUS lStatus = EnumPoolTagTable(&pPoolTagTable);
if (!NT_SUCCESS(lStatus))
{
break;
}
ULONG uCount = pPoolTagTable->Count;
for (ULONG i = 0; i < uCount; ++i)
{
auto pPoolTagInfo = pPoolTagTable->TagInfo[i];
if (pPoolTagInfo.TagUlong == 'oIdK' && pPoolTagInfo.PagedAllocs == 0 && pPoolTagInfo.PagedFrees == 0 &&
pPoolTagInfo.PagedUsed == 0 && pPoolTagInfo.NonPagedUsed >= PAGE_SIZE &&
pPoolTagInfo.NonPagedUsed < 10 * PAGE_SIZE && pPoolTagInfo.NonPagedAllocs > 0x30 &&
pPoolTagInfo.NonPagedFrees > 0x30)
{
bKdbg = true;
break;
}
}
} while (0);
if (pPoolTagTable)
{
ExFreePoolWithTag(pPoolTagTable, 'haha');
}
return bKdbg;
}