Skip to content

Simple code to manipulate the memory of a usermode process from kernel.

Notifications You must be signed in to change notification settings

jakeau/KernelReadWriteMemory

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 

Repository files navigation

KernelReadWriteMemory

Simple proof of concept -code to manipulate the memory of a usermode process from kernelmode of a windows NT operating system. This is complished by using the undocumented NT API "MmCopyVirtualMemory" function in ntoskrnl.exe.

This works for both x64 & x86 processes.

About

Simple code to manipulate the memory of a usermode process from kernel.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C 100.0%