Add a readme

This commit is contained in:
2020-07-01 00:02:34 +07:00
parent e0b5cd21a7
commit 4ce58a1307
2 changed files with 63 additions and 3 deletions

View File

@ -120,9 +120,9 @@ DriverControl(PDEVICE_OBJECT /* DriverObject */, PIRP Irp) {
inputData = (PINPUT_DATA)(Irp->AssociatedIrp.SystemBuffer);
outputData = (POUTPUT_DATA)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority | MdlMappingNoExecute);
scanRange = &(inputData->scanRange);
DbgPrint("[NAK] :: Range: %llx - %llx", scanRange->start, scanRange->end);
DbgPrint("[NAK] :: Range: %llx - %llx\n", scanRange->start, scanRange->end);
(outputData->poolChunk).addr = (ULONG64)scanRemote(scanRange->start, scanRange->end, scanRange->tag);
DbgPrint("[NAK] :: Found: %llx", (outputData->poolChunk).addr);
DbgPrint("[NAK] :: Found: %llx\n", (outputData->poolChunk).addr);
break;
case DEREFERENCE_ADDRESS:
// DbgPrint("[NAK] :: [ ] Deref address\n");
@ -319,7 +319,7 @@ printChunkInfo(PPOOL_HEADER p) {
VOID
scanLargePool(PVOID /* largePageTableArray */, ULONG64 /* largePageTableSize */) {
DbgPrint("[NAK] :: [-] Scan large pool not supported yet");
DbgPrint("[NAK] :: [-] Scan large pool not supported yet\n");
}
PVOID
@ -331,6 +331,7 @@ scanRemote(ULONG64 startAddress, ULONG64 endAddress, ULONG tag) {
break;
if (!MmIsAddressValid(currentAddr)) {
// DbgPrint("[NAK] Skip page at %p\n", currentAddr);
currentAddr = (PVOID)((ULONG64)currentAddr + PAGE_SIZE);
continue;
}