search

TheCruZ / kdmapper

KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory
MIT License
1.92k stars 497 forks source link

Check if driver is loaded and not loading twice #79

Closed on51n closed 1 year ago

on51n commented 1 year ago

How do i check if my Driver is already loaded so it can't be loaded twice

saperex commented 1 year ago

for example, use the CreateFile function, with the driver name, if it ends with INVALID_HANDLE_VALUE, then the driver is not loaded, and if it ends with a handle, then the driver is loaded.

TheCruZ commented 1 year ago

If you mean your mapped driver you must make your own method to know if it's loaded since kdmapper idea is hide completely that this driver is loaded