Works with /GS- compiled drivers Hooks NtAddAtom which exists everywhere and is rarely called Clears MmUnloadedDrivers Clears PiDDBCacheTable Clears g_KernelHashBucketList Clears Wdfilter RuntimeDriverList RuntimeDriverCount and RuntimeDriverArry Use NtLoadDriver and NtUnloadDriver for less traces Prev...
Works with /GS- compiled drivers Hooks NtAddAtom which exists everywhere and is rarely called Clears MmUnloadedDrivers Clears PiDDBCacheTable Clears g_KernelHashBucketList Use NtLoadDriver and NtUnloadDriver for less traces Prevent load if \Device\Nal exists (Prevents BSOD) Header section skipped ...
Works with /GS- compiled drivers Hooks NtAddAtom which exists everywhere and is rarely called Clears MmUnloadedDrivers Clears PiDDBCacheTable Clears g_KernelHashBucketList Clears Wdfilter RuntimeDriverList RuntimeDriverCount and RuntimeDriverArry Use NtLoadDriver and NtUnloadDriver for less traces Prev...
Hook "NtQueryInformationAtom" which exists in all windows versions Fixed unable to load /GS- compiled drivers Update: Now hooks "NtAddAtom" which is 100x times less used than NtQueryInformationAtom Fixed 2 BSODs related to clear g_KernelHashBucketList and clear MmUnloadedDrivers ...
Works with /GS- compiled drivers Hooks NtAddAtom which exists everywhere and is rarely called Clears MmUnloadedDrivers Clears PiDDBCacheTable Clears g_KernelHashBucketList Clears Wdfilter RuntimeDriverList RuntimeDriverCount and RuntimeDriverArry Use NtLoadDriver and NtUnloadDriver for less traces Prev...