MCPcopy Create free account

hub / github.com/BlackSnufkin/BYOVD / functions

Functions211 in github.com/BlackSnufkin/BYOVD

⨍ Functions 211◇ Types & classes 48
↓ 17 callersFunctionrun
Execute the full BYOVD attack flow: 1. Run preflight checks 2. Load and start the vulnerable driver 3. Monitor and kill the target process (until Ctrl
byovd-lib/src/lib.rs:155
↓ 16 callersMethodas_raw
(&self)
byovd-lib/src/device.rs:39
↓ 13 callersFunctionvread_u64
(drv: &Astra, cr3: u64, va: u64)
Astra64-RW/src/kernel.rs:53
↓ 8 callersFunctionis_kptr
(v: u64)
Astra64-RW/src/astra.rs:47
↓ 8 callersFunctionto_wstring
Convert a `&str` to a null-terminated wide string suitable for Win32 W-suffix APIs.
byovd-lib/src/util.rs:11
↓ 6 callersFunctionvread_u32
(drv: &Astra, cr3: u64, va: u64)
Astra64-RW/src/kernel.rs:49
↓ 5 callersMethodread_phys
(&self, addr: u64, buf: &mut [u8])
Astra64-RW/src/astra.rs:151
↓ 5 callersMethodread_u64
(&self, pa: u64)
Astra64-RW/src/astra.rs:201
↓ 5 callersFunctionvirt_to_phys
(drv: &Astra, cr3: u64, va: u64)
Astra64-RW/src/kernel.rs:15
↓ 5 callersFunctionvwrite
(drv: &Astra, cr3: u64, va: u64, buf: &[u8])
Astra64-RW/src/kernel.rs:57
↓ 4 callersFunctionexport_rva
RVA of an exported symbol within an image loaded by `load_image`.
Astra64-RW/src/pe.rs:25
↓ 4 callersFunctionioctl_error
(code: u32)
byovd-lib/src/device.rs:187
↓ 4 callersFunctionload_image
Load `name` as an unresolved image. Returns `(base, SizeOfImage)`.
Astra64-RW/src/pe.rs:13
↓ 3 callersFunctioncmd_800
Cmd 800 — close `victim` inside `target_handle`'s handle table, attached via KeStackAttachProcess. The driver strips ProtectFromClose first.
Xhunter1-Killer/src/main.rs:154
↓ 3 callersFunctionsend_ioctl
Send the kill IOCTL described by `config` to terminate `pid`. Opens the device, builds the input from `DriverConfig::build_ioctl_input`, and dispatch
byovd-lib/src/lib.rs:108
↓ 3 callersMethodunmap
(&self, va: usize)
Astra64-RW/src/astra.rs:131
↓ 2 callersFunctiondetect_eprocess_offsets
()
Astra64-RW/src/kernel.rs:157
↓ 2 callersMethoddevice_path
(&self)
NSec-Killer/src/main.rs:19
↓ 2 callersFunctionfind_pid
(image_name: &str)
Xhunter1-Killer/src/main.rs:167
↓ 2 callersFunctionfind_pid_by_name
Find the first process matching `name` (case-insensitive) and return its PID.
byovd-lib/src/process.rs:11
↓ 2 callersFunctionget_pid_by_name
Back-compat alias for `find_pid_by_name`.
byovd-lib/src/process.rs:78
↓ 2 callersMethodkill_process
(&self, pid: u32)
K7Terminator/src/main.rs:145
↓ 2 callersMethodmap_phys
Map `size` bytes from physical address `phys` into our user VA space. The driver truncates the returned VA to 32 bits — we recover the upper half by w
Astra64-RW/src/astra.rs:90
↓ 2 callersFunctionsend_cmd
Send one xhunter1 command, return (NTSTATUS, full response buffer).
Xhunter1-Killer/src/main.rs:110
↓ 2 callersMethodstop_and_delete
Stop the driver service and mark it for deletion.
byovd-lib/src/service.rs:120
↓ 2 callersFunctionvread
(drv: &Astra, cr3: u64, va: u64, buf: &mut [u8])
Astra64-RW/src/kernel.rs:43
↓ 2 callersMethodwrite_phys
(&self, addr: u64, buf: &[u8])
Astra64-RW/src/astra.rs:175
↓ 1 callersMethodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
NSec-Killer/src/main.rs:32
↓ 1 callersFunctioncmd_785
Cmd 785 — kernel-minted PROCESS_ALL_ACCESS handle on `pid`. Defeats PPL.
Xhunter1-Killer/src/main.rs:139
↓ 1 callersFunctiondecode_entry
(entry: u32, base_va: u64)
Astra64-RW/src/lpe.rs:142
↓ 1 callersMethoddevice_access
Desired access flags for `CreateFileW` on the device. Default: `SERVICE_ALL_ACCESS` (0xF01FF).
byovd-lib/src/lib.rs:68
↓ 1 callersMethoddriver_file
(&self)
NSec-Killer/src/main.rs:15
↓ 1 callersMethoddriver_name
(&self)
NSec-Killer/src/main.rs:11
↓ 1 callersFunctionenable_se_debug
()
Xhunter1-Killer/src/main.rs:41
↓ 1 callersFunctionencode_entry
(target_va: u64, base_va: u64, orig_entry: u32)
Astra64-RW/src/lpe.rs:133
↓ 1 callersFunctionensure_running_as_local_system
Verify the current process is running as LocalSystem (S-1-5-18). Returns an error if not.
byovd-lib/src/privilege.rs:85
↓ 1 callersFunctionenumerate_process_handles
Enumerate every handle owned by `target_pid` via `NtQuerySystemInformation(SystemExtendedHandleInformation)`.
Xhunter1-Killer/src/main.rs:195
↓ 1 callersMethodexecute
(&self)
K7Terminator/src/main.rs:217
↓ 1 callersFunctionfind_cr3
(drv: &Astra)
Astra64-RW/src/kernel.rs:74
↓ 1 callersFunctionfind_eprocess_by_ptwalk
Walk the ActiveProcessLinks chain starting from `PsInitialSystemProcess` to locate the System EPROCESS and a target by PID.
Astra64-RW/src/kernel.rs:169
↓ 1 callersFunctionfind_gadget
( mod_base: usize, mod_size: usize, mod_kva: u64, shadow_table_base: u64, )
Astra64-RW/src/lpe.rs:94
↓ 1 callersFunctionfind_kernel_base
Walk back from `lstar` (inside KiSystemCall64) to find the page-aligned ntoskrnl MZ header. Validates AMD64 + PE32+ + SizeOfImage covering lstar.
Astra64-RW/src/kernel.rs:102
↓ 1 callersFunctionfind_module_base_walkback
Walk back page-by-page from `hint_va` until we hit `MZ`. Returns the page-aligned VA of the host module containing `hint_va`.
Astra64-RW/src/kernel.rs:126
↓ 1 callersFunctionget_build_number
()
Astra64-RW/src/kernel.rs:144
↓ 1 callersMethodget_pids_by_name
(&self, name: &str)
K7Terminator/src/main.rs:122
↓ 1 callersMethodignore_ioctl_error
Ignore IOCTL error returns (e.g. drivers that report error even on success).
byovd-lib/src/lib.rs:78
↓ 1 callersMethodioctl_bytes_legacy
Internal helper backing the trait-driven `send_ioctl()`. Takes byte slices (matching `DriverConfig::build_ioctl_input` output) and an optional output
byovd-lib/src/device.rs:156
↓ 1 callersMethodioctl_code
(&self)
NSec-Killer/src/main.rs:23
↓ 1 callersMethodioctl_output_size
Expected IOCTL output buffer size in bytes (0 = no output buffer).
byovd-lib/src/lib.rs:89
↓ 1 callersMethodis_service_running
(&self)
K7Terminator/src/main.rs:44
↓ 1 callersMethodload_driver
(&self)
K7Terminator/src/main.rs:64
↓ 1 callersFunctionnt_user_set_window_pos_index
Parse the EAX immediate from `win32u!NtUserSetWindowPos`. Returns the service index (bits 0..11). The table selector (bit 12+) must be 1.
Astra64-RW/src/lpe.rs:76
↓ 1 callersFunctionopen_device
(path: &str)
Xhunter1-Killer/src/main.rs:94
↓ 1 callersMethodpreflight_check
Optional pre-flight check before driver initialization (e.g. privilege verification).
byovd-lib/src/lib.rs:95
↓ 1 callersMethodread_msr
(&self, idx: u32)
Astra64-RW/src/astra.rs:72
↓ 1 callersMethodread_u32
(&self, pa: u64)
Astra64-RW/src/astra.rs:198
↓ 1 callersFunctionresolve_set_window_pos
()
Astra64-RW/src/lpe.rs:158
↓ 1 callersFunctionrun_lpe
()
Astra64-RW/src/lpe.rs:190
↓ 1 callersFunctionrun_monitor
Run the trait-driven kill-on-sight monitor. Continuously scans for `process_name` and dispatches the kill IOCTL on each match. Runs until Ctrl+C.
byovd-lib/src/lib.rs:140
↓ 1 callersFunctionrun_monitor_loop
Repeatedly look up `process_name` and call `on_found(pid)` on every match. Loop exits on Ctrl+C. The closure form lets callers do whatever they want
byovd-lib/src/monitor.rs:30
↓ 1 callersFunctionsetup_ctrlc_handler
Install a Ctrl+C handler that clears the returned flag on signal. Use this when you need a custom monitoring loop. For the standard PID-based loop, u
byovd-lib/src/monitor.rs:13
↓ 1 callersFunctionshadow_descriptor_candidate_rvas
Pattern-scan `KeAddSystemServiceTable` for every RIP-relative memory operand and enumerate plausible target RVAs. Caller validates each by reading the
Astra64-RW/src/lpe.rs:33
↓ 1 callersMethodskip_unload
Skip driver unload on cleanup (e.g. drivers that BSOD on unload).
byovd-lib/src/lib.rs:73
↓ 1 callersFunctionspawn_shell
()
Astra64-RW/src/lpe.rs:170
↓ 1 callersMethodstart
Start the driver service. Treats `ERROR_SERVICE_ALREADY_RUNNING` as success.
byovd-lib/src/service.rs:101
↓ 1 callersMethodterminate_name
(&self, name: &str)
K7Terminator/src/main.rs:256
↓ 1 callersMethodterminate_pid
(&self, pid: u32)
K7Terminator/src/main.rs:241
Methodas_raw
(&self)
byovd-lib/src/handle.rs:24
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
PoisonX-Killer/src/main.rs:33
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
Wsftprm-Killer/src/main.rs:33
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
PCTcore64-Killer/src/main.rs:29
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
Ksapi64-Killer/src/main.rs:27
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
BdApiUtil-Killer/src/main.rs:28
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
GameDriverX64-Killer/src/main.rs:35
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
STProcessMonitor-Killer/src/main.rs:61
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
UnknownKiller/src/main.rs:28
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
GoFlyDrv-Killer/src/main.rs:27
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
Xkpsm-Killer/src/main.rs:27
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
HWAudioOs2Ec-Killer/src/main.rs:26
Methodbuild_ioctl_input
(&self, _pid: u32, process_name: &str)
Viragt64-Killer/src/main.rs:32
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
MonProcessEX-Killer/src/main.rs:26
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
TfSysMon-Killer/src/main.rs:27
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
AppRemover-Killer/src/main.rs:27
Methodbuild_ioctl_input
(&self, pid: u32, _process_name: &str)
CcProtect-Killer/src/main.rs:27
Methoddevice_access
(&self)
Wsftprm-Killer/src/main.rs:28
Methoddevice_access
(&self)
PCTcore64-Killer/src/main.rs:37
Methoddevice_access
(&self)
STProcessMonitor-Killer/src/main.rs:54
Methoddevice_path
(&self)
PoisonX-Killer/src/main.rs:25
Methoddevice_path
(&self)
Wsftprm-Killer/src/main.rs:20
Methoddevice_path
(&self)
PCTcore64-Killer/src/main.rs:21
Methoddevice_path
(&self)
Ksapi64-Killer/src/main.rs:19
Methoddevice_path
(&self)
BdApiUtil-Killer/src/main.rs:20
Methoddevice_path
(&self)
GameDriverX64-Killer/src/main.rs:27
Methoddevice_path
(&self)
STProcessMonitor-Killer/src/main.rs:43
Methoddevice_path
(&self)
UnknownKiller/src/main.rs:20
Methoddevice_path
(&self)
GoFlyDrv-Killer/src/main.rs:19
Methoddevice_path
(&self)
Xkpsm-Killer/src/main.rs:19
Methoddevice_path
(&self)
HWAudioOs2Ec-Killer/src/main.rs:18
Methoddevice_path
(&self)
Viragt64-Killer/src/main.rs:19
Methoddevice_path
(&self)
MonProcessEX-Killer/src/main.rs:18
next →1–100 of 211, ranked by callers