MCPcopy Create free account
hub / github.com/Spuckwaffel/Kernel-Thread-Driver / Read

Function Read

Driver/events.h:78–89  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

76}
77
78void Read() {
79 readd StructAddress = {};
80 SIZE_T BytesRead{ 0 };
81 (MmCopyVirtualMemory(process::process, (PVOID)readlocal<ULONG64>(process::STRUCT_OFFSET_ADDRESS), PsGetCurrentProcess(), &StructAddress, sizeof(readd), KernelMode, &BytesRead));
82
83 //StructAddress = readlocal<readd>(readlocal<ULONG64>(process::STRUCT_OFFSET_ADDRESS)); //double reading because STRUCT_OFFSET_ADDRESS points to the struct and then we read the content
84 if (StructAddress.address < 0x7FFFFFFFFFFF && StructAddress.address > 0 && StructAddress.size > 0 && StructAddress.size < 200) {
85 read(StructAddress.address, StructAddress.output, StructAddress.size);
86 }
87
88 status::SUCESSFUL(); //we cant check if its unsuccessful
89}

Callers 1

mainthreadFunction · 0.70

Calls 2

readFunction · 0.85
SUCESSFULFunction · 0.85

Tested by

no test coverage detected