DdiMon
DdiMon copied to clipboard
tandasat
Monitoring and controlling kernel API calls with stealth hook using EPT
BSOD code `sgdt [rcx]` windbg---------------------------------------------------- PROCESS_NAME: Notepad2.exe TRAP_FRAME: ffff9f040f207c70 -- (.trap 0xffff9f040f207c70) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000033...
- windows7 ``` Windows 7 Kernel Version 7600 MP (1 procs) Free x64 Built by: 7600.16385.amd64fre.win7_rtm.090713-1255 ``` - VM ``` VMware® Workstation 15 15.5.0 build-14665864 ``` - ddimon ``` the...
the system lags when running the hypervisor.. and i checked your code in hooking section the method is slow because the "const auto original" always finds the original function inside...
Use GVA in ShHandleEptViolation to find hookinfo, which should actually be found using GPA. For example, if you use the function of mdl to remap VA in the guest, you...
