reading/writing other process memory using KbExecuteShellCode

[m0rethan3]

is there way that it can be done?

[HoShiMin]

Why are you want to deal with KbExecuteShellCode? There are much more convenient ways to do it.

[m0rethan3]

i made some shellcode that provides KbExecuteShellCode functionality and its more convenient for me to use it than to load or map the driver

[HoShiMin]

If it is a kernelmode shellcode, you could use traditional RW like KeStackAttachProcess -> memcpy -> KeUnstackDetachProcess. Or use an MDL (IoAllocateMdl -> MmProbeAndLockPages -> MmMapLockedPagesSpecifyCache -> MmProtectMdlSystemAddress -> memcpy -> MmUnmapLockedPages -> MmUnlockPages -> IoFreeMdl). But if it is a usermode shellcode, you're unable to switch address spaces, so the only way you could do it - use an MDL.

[m0rethan3]

many thanks very helpful