Nothing Special   »   [go: up one dir, main page]

Skip to content

A simple example how to decrypt kernel debugger data block

Notifications You must be signed in to change notification settings

Air14/KDBGDecryptor

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 

Repository files navigation

KDBGDecryptor

A simple example how to decrypt kernel debugger data block with two different methods:

  1. By calling KdDecodeBlockData
  2. By copying encrypted kdbg struct from memory and then decrypting it with KiWaitNever and KiWaitAlways (more stealthy)

This sample was tested on Windows 20H2 (build 19042)

About

A simple example how to decrypt kernel debugger data block

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published