search

Mr-Un1k0d3r / EDRs

1.96k stars 348 forks source link

Create MDE.txt #20

Closed ScriptIdiot closed 2 years ago

ScriptIdiot commented 2 years ago

Full output as below:

Loading C:\windows\system32\ntdll.dll HookFinder Mr.Un1k0d3r RingZer0 Team Listing loaded modules

C:\Users\lowprivuser\Desktop\hook_finder64.exe is loaded at 0x0000000000400000. C:\Windows\SYSTEM32\ntdll.dll is loaded at 0x00007FFE428B0000. C:\Windows\System32\KERNEL32.DLL is loaded at 0x00007FFE41020000. C:\Windows\System32\KERNELBASE.dll is loaded at 0x00007FFE3FEF0000. C:\Windows\SYSTEM32\apphelp.dll is loaded at 0x00007FFE3DFB0000. C:\Windows\System32\msvcrt.dll is loaded at 0x00007FFE412A0000. **Listing Nt API only

NtQuerySystemTime is hooked

Completed

Mr-Un1k0d3r commented 2 years ago

MDE have no user mode hook in place no need to add it.

We could add a mention in the readme about it.