Another POC
May 20, 2022 ยท View on GitHub
After you map with kdmapper just free all mapped memory.
use (MmFreePagesFromMdl and FreePool)
and you will only have one page allocated
in this method i am using .data ptr to communicate (NtUserGetObjectInformation) (https://www.unknowncheats.me/forum/anti-cheat-bypass/425352-driver-communication-using-data-ptr-called-function.html)
but you can use any kind of communication
Visual studio project
Properties -> C/C++ -> Optimization
Full program optimization (Yes (/GL))
Properties -> C/C++ -> Code generation
Security Check (Disable Security Check (/GS-))
Control flow protection (No)
TODO
Replace KeAttachProcess with my Custom AttachProcess
https://github.com/EBalloon/Rw-No-Attach