New answers tagged

1

So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one. If the driver is compiled in the debug mode, the RVA for the Import Descriptor seems to be wrong. But the issue is resolved with compiling in the release rather than in the debug mode. Thanks to all for the help.


1

This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community wiki, attempting to give clues, ask for details and point to resources. Correct me if I'm wrong but since kernel drivers share the same address space I can just ...


2

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so the result is probably some non-existent address. You should add its value, which is an RVA, to the image base. I.e. something like this: memcpy(&LibraryName,...


Top 50 recent answers are included