You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
|
|
|
# CallMeWin32kDriver
|
|
|
|
|
Load your driver like win32k.sys
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Motivation
|
|
|
|
|
This feature was analyzed from a certain PUBG cheat driver.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## What it can do?
|
|
|
|
|
- Protection against direct dump by Anti-Rootkit tools
|
|
|
|
|
- Bypass MmCopyMemory
|
|
|
|
|
- Hide world does not trigger PG
|
|
|
|
|
|
|
|
|
|
## How to detect?
|
|
|
|
|
- Attach a GUI process before using MmCopyMemory
|
|
|
|
|
|
|
|
|
|
## Compile
|
|
|
|
|
- Visual Studio 2022 & WDK10
|
|
|
|
|
- llvm-msvc [[link]](https://github.com/NewWorldComingSoon/llvm-msvc-build)
|
|
|
|
|
|
|
|
|
|
## Some discussions on UnknownCheats
|
|
|
|
|
https://www.unknowncheats.me/forum/anti-cheat-bypass/511107-load-driver-win32k-sys.html
|
