DSMM: Discarded Section Manual Map

June 18, 2020 ยท View on GitHub

Manual map your driver and create a system thread inside a legit Windows driver (post-boot).

This method doesn't trigger PatchGuard.

Tested on Windows 10 x64 build 17763.

Screenshot

(Re)sources:

  • Blackbone
  • owned_alignment
  • https://rayanfam.com/topics/inside-windows-page-frame-number-part2/