search

mrexodia / TitanHide

Hiding kernel-driver for x86/x64.
MIT License
2.12k stars 421 forks source link

FindCaveAddress bug #75

Closed Kwansy98 closed 2 years ago

Kwansy98 commented 2 years ago

Not all memory of ntoskrnl.exe readable, maybe use MmIsAddressValid to verify before read. My test win10 vm kernel version is 10.0.19041.1741


// bug fix simple way
if (!MmIsAddressValid(Code + i))
{
    j = 0;
    continue;
}

titanhidebug

Mattiwatti commented 2 years ago

How is it a bug in TitanHide if another driver copies a function and then calls this function with an invalid address?

Kwansy98 commented 2 years ago

I didn't read the previous code carefully, range is the section of NtFunction(which is always readable) instead of whole ntoskrnl.exe, my mistake :(