mirror of
https://github.com/evilele/EDR-Introspection
synced 2026-06-09 08:11:09 +00:00
cailllev
72 lines
3.9 KiB
Plaintext
72 lines
3.9 KiB
Plaintext
0: kd> dt nt!_EPROCESS ffffa80e6815f080 MitigationFlags2
|
|
+0x754 MitigationFlags2 : 0x40000000
|
|
0: kd> dt nt!_EPROCESS ffffa80e6815f080 MitigationFlags
|
|
+0x750 MitigationFlags : 0x8800a1
|
|
0: kd> ba w4 ffffa80e6815f080 + 0x0754
|
|
0: kd> bl
|
|
0 e Disable Clear ffffa80e`6815f7d4 w 4 0001 (0001)
|
|
|
|
0: kd> g
|
|
14:08:21.044 ERR #0 4 5168 System KiKernelExit not found
|
|
14:08:21.055 ERR #1 4 5168 System KiKernelExit not found
|
|
14:08:21.070 ERR #0 4 5168 System ExpLargePoolTableLock not found
|
|
14:08:21.077 ERR #1 4 5168 System PoolBigPageTable not found
|
|
14:08:21.083 ERR #2 4 5168 System PoolBigPageTableSize not found
|
|
14:08:21.166 ERR #0 4 5168 System ObReferenceProcessHandleTable not found
|
|
14:08:21.174 ERR #1 4 5168 System HandleTable not found
|
|
14:08:21.194 ERR #2 4 5168 System MmSession not found
|
|
14:08:21.200 ERR #0 4 5168 System ImageNotify maxcount not found
|
|
14:08:21.206 ERR #0 4 5168 System ProcessNotify maxcount not found
|
|
14:08:21.217 ERR #1 4 5168 System KiIdleLoop not found
|
|
14:08:25.619 INF #1 4 5168 System The NeacSafe driver has been installed
|
|
Breakpoint 0 hit
|
|
NeacSafe64+0x53931:
|
|
fffff804`62f93931 75f0 jne NeacSafe64+0x53923 (fffff804`62f93923)
|
|
0: kd> r
|
|
rax=ffffa80e6815f7d4 rbx=ffffa80e6815f7d4 rcx=ffffa80e6815f7d4
|
|
rdx=ffffd87285f976d4 rsi=0000000000000000 rdi=0000000000000001
|
|
rip=fffff80462f93931 rsp=ffffca8afd333438 rbp=ffffca8afd333480
|
|
r8=0000000000000000 r9=ffffb80000000020 r10=0000000000000001
|
|
r11=ffffa80e6815f700 r12=ffffa80e62691bd0 r13=0000000000000002
|
|
r14=ffffa80e62691bb0 r15=00000000c000000d
|
|
iopl=0 nv up ei pl zr na po nc
|
|
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
|
|
NeacSafe64+0x53931:
|
|
fffff804`62f93931 75f0 jne NeacSafe64+0x53923 (fffff804`62f93923) [br=0]
|
|
0: kd> k
|
|
# Child-SP RetAddr Call Site
|
|
00 ffffca8a`fd333438 fffff804`62f58e58 NeacSafe64+0x53931
|
|
01 ffffca8a`fd333440 fffff804`62f5cb60 NeacSafe64+0x18e58
|
|
02 ffffca8a`fd3334b0 fffff804`5c8c3c32 NeacSafe64+0x1cb60
|
|
03 ffffca8a`fd333520 fffff804`5c9104a2 FLTMGR!FltpFilterMessage+0x162
|
|
04 ffffca8a`fd333590 fffff804`5c8cc053 FLTMGR!FltpMsgDispatch+0xf2
|
|
05 ffffca8a`fd333600 fffff804`cafab63d FLTMGR!FltpDispatch+0x133
|
|
06 ffffca8a`fd3336a0 fffff804`cb4d0cc8 nt!IofCallDriver+0xcd
|
|
07 ffffca8a`fd3336e0 fffff804`cb4cfb12 nt!IopSynchronousServiceTail+0x1c8
|
|
08 ffffca8a`fd333790 fffff804`cb4cf19e nt!IopXxxControlFile+0x962
|
|
09 ffffca8a`fd333a00 fffff804`cb2b1455 nt!NtDeviceIoControlFile+0x5e
|
|
0a ffffca8a`fd333a70 00007ffd`f3801cd4 nt!KiSystemServiceCopyEnd+0x25
|
|
0b 0000004a`cfefecc8 00007ffd`e5e63bc2 0x00007ffd`f3801cd4
|
|
0c 0000004a`cfefecd0 00007ff6`317060f8 0x00007ffd`e5e63bc2
|
|
0d 0000004a`cfefecd8 00007ffd`e5e63bc2 0x00007ff6`317060f8
|
|
0e 0000004a`cfefece0 00000000`00000000 0x00007ffd`e5e63bc2
|
|
0: kd> u rip
|
|
NeacSafe64+0x53931:
|
|
fffff804`62f93931 75f0 jne NeacSafe64+0x53923 (fffff804`62f93923)
|
|
fffff804`62f93933 c3 ret
|
|
fffff804`62f93934 666666660f1f840000000000 nop word ptr [rax+rax]
|
|
fffff804`62f93940 4e8d1c02 lea r11,[rdx+r8]
|
|
fffff804`62f93944 482bd1 sub rdx,rcx
|
|
fffff804`62f93947 7309 jae NeacSafe64+0x53952 (fffff804`62f93952)
|
|
fffff804`62f93949 4c3bd9 cmp r11,rcx
|
|
fffff804`62f9394c 0f876e010000 ja NeacSafe64+0x53ac0 (fffff804`62f93ac0)
|
|
0: kd> dd
|
|
fffff804`62f93931 66c3f075 0f666666 0000841f 4e000000
|
|
fffff804`62f93941 48021c8d 0973d12b 0fd93b4c 00016e87
|
|
fffff804`62f93951 04100f00 c1834811 0fc1f610 83481274
|
|
fffff804`62f93961 100ff0e1 110f110c c1280f00 10c18348
|
|
fffff804`62f93971 4cc0034c 8b4dc12b e9c149c8 496f7406
|
|
fffff804`62f93981 1000f981 870f0000 000000b3 3fe08349
|
|
fffff804`62f93991 66662deb 66666666 841f0f66 00000000
|
|
fffff804`62f939a1 66666600 66666666 00841f0f 00000000
|