You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
834 B
834 B
CallMeWin32kDriver
Load your driver like win32k.sys
Motivation
This feature was analyzed from a certain PUBG cheat driver.
What it can do?
- Protection against direct dump by Anti-Rootkit tools
- Bypass MmCopyMemory
- Hide world does not trigger PG
How to detect?
- Attach a GUI process before using MmCopyMemory
Compile
- Visual Studio 2022 & WDK10
- llvm-msvc [link]
Some discussions on UnknownCheats
https://www.unknowncheats.me/forum/anti-cheat-bypass/511107-load-driver-win32k-sys.html