Hot answers tagged

2

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so the result is probably some non-existent address. You should add its value, which is an RVA, to the image base. I.e. something like this: memcpy(&LibraryName,...


2

This is mostly speculative, since Nvidia didn't go into details about the implementation details. All I could find was this quote: RTX 3060 software drivers are designed to detect specific attributes of the Ethereum cryptocurrency mining algorithm, and limit the hash rate, or cryptocurrency mining efficiency, by around 50 percent. However following Occam's ...


1

So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one. If the driver is compiled in the debug mode, the RVA for the Import Descriptor seems to be wrong. But the issue is resolved with compiling in the release rather than in the debug mode. Thanks to all for the help.


1

This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community wiki, attempting to give clues, ask for details and point to resources. Correct me if I'm wrong but since kernel drivers share the same address space I can just ...


Only top voted, non community-wiki answers of a minimum length are eligible