POC-ExFlushTb

December 3, 2023 ยท View on GitHub

A POC for monitoring Tb. This code is not neat, it's just a POC.

image

Principle

Hijack HalIommuDispatch + 0x48 image

KeFlushSingleTb
    -> ExFlushTb
KeFlushTb
    -> ExFlushTb

Compile

  • Visual Studio 2022 & WDK11
  • llvm-msvc [link]