apisetschema.dll now has version 6
воскресенье, 25 января 2015 г.
среда, 21 января 2015 г.
interrupts in w10 build 9879 64bit
it seems that Microsoft completely removed KiInterruptTemplate in this version of windows and interrutps now stored in KPRCB (like in w8.1)
Lets see on function KiConnectInterrupt
Lets see on function KiConnectInterrupt
пятница, 9 января 2015 г.
среда, 7 января 2015 г.
apisetschema.dll from windows 10 build 9879
Yep, they did it again - apisetschema.dll now has version 5. One hard evening of reversing and you can enjoy the results
Btw - there are module in kernel mode which is missed in apisetschema.dll:ext-ms-win-ntos-ksigningpolicy-l1-1-0.dll in cia.dll. I have no ideas about how translation of ext-ms- names happens in kernel mode
Btw - there are module in kernel mode which is missed in apisetschema.dll:ext-ms-win-ntos-ksigningpolicy-l1-1-0.dll in cia.dll. I have no ideas about how translation of ext-ms- names happens in kernel mode
понедельник, 3 ноября 2014 г.
w10tp kernel mode RPC
From the time of windows 8 there are yet new several drivers using kernel-mode rpc:
- CEA.sys - "Event Aggregation Kernel Mode Library". Use interface D09BDEB5-6171-4A34-BFE2-06FA82652568 from BrokerLib.dll
- fastfat.sys - use interface 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA from efssvc.dll
- wfplwfs.sys - "WFP NDIS 6.30 Lightweight Filter Driver". Use interface C605F9FB-F0A3-4E2A-A073-73560F8D9E3E from bisrv.dll
Подписаться на:
Сообщения (Atom)