![]() |
|
#8
|
|||
|
|||
|
Dont' forget about MmGetSystemRoutineAddress routine
Of couse if it works only for routines exported by ntoskrnl or HAL.. But in some cases it's enough.Here is a plan how to make simple native encryptor Very common.1) Get some user mode PE encryptor\compressor sources (better in asm) 2) Change GetProcAddress to MmGetSystemRoutineAddress 3) Change VirtualAlloc\VirtualFree to ExAllocatePool\ExFreePool 4) Debug ![]() P.S. Classical compression based on possibility of making VirualSize of PE section bigger than PhisicalSize will work only in case Section alignment= 1000, File alignment= 200. Any other combination does'nt work for me. Anyway compression in drivers it's not a good idea coz memory in pool is very valuable resource. Last edited by adaptor; 05-17-2006 at 19:47. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Encrypt and Decrypt with public key and private key(RSA based) | CarrotStickCam | Source Code | 2 | 01-16-2023 14:53 |