Tuesday, November 27, 2012

How to manually find kernel modules on Windows

KPCR -> KDVersionblock -> PsLoadedModuleList


http://memogaki.wordpress.com/2011/10/01/kpcr/
http://stackoverflow.com/questions/10690330/how-do-i-get-the-address-to-kernel-modules-nt-and-win32k

No comments: