Clément Labro comments

Results 26 comments of


                                            Clément Labro

List ASR rules

Added with commit f106e7b

Use Other Drivers

Technically, yes, it is possible to use other drivers than RTCore64.sys. The only requirement is a kernel R/W primitive. So it is not that complicated to implement, especially if the...

Add vulnerable driver IOMap64.sys (CVE-2024-41498)

Hi! I tested it in a virtual machine so hardware doesn't matter. Make sure you're running the PoC as an administrator. Other than that, I don't know what can go...

Feature idea: whitelisted MSI packages auditing

Hi! This looks cool. I think it's a good idea indeed. I'll have to look more closely into it. Thanks for the suggestion.

Feature idea: whitelisted MSI packages auditing

Thanks, no need to open a PR. I prefer to implement things myself as far as possible honestly. This way, I'm sure I understand all aspects, especially when it's a...

Feature idea: list certificates & private keys in user and system stores

Sounds like a decent idea. Thanks for the suggestion, and the very detailed description. :)