These are just functions that make writing/reading memory in a different process a lot easier, it's by common means using KeStackAttachProcess to attach a kernel mode thread to a usermode address space and then using an MDL and setting the protection rights with MmProtectMdlSystemAddress, this just shortens the code. Uses RtlCopyMemory to read/write memory
-
Notifications
You must be signed in to change notification settings - Fork 9
johnsonjason/KeProcessOverlay
About
Reading/writing memory from kernel-mode
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published