Skip to content

补充 DriverObject->DriverStartIo 查询、完整性证据与 UI 展示 #201

Description

@WangWei-CM

建议在内核->IO管理下面新增DriverStartIO查询,支持空值、读取失败、非空三种状态;可能的输出样例(这不是要求):
0 IRP_MJ_CREATE 0xFFFFF80266DE2260 - 0xFFFFF80266DE2260 C:\Windows\System32\drivers\i8042prt.sys
1 IRP_MJ_CREATE_NAMED_PIPE 0xFFFFF80260091250 - 0xFFFFF80260091250 C:\Windows\system32\ntoskrnl.exe
2 IRP_MJ_CLOSE 0xFFFFF80266DE21C0 - 0xFFFFF80266DE21C0 C:\Windows\System32\drivers\i8042prt.sys

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions