backengineering / CallMeWin32kDriver

Load your driver similar to win32k.sys

CallMeWin32kDriver

Load your driver similar to win32k.sys

Motivation

This feature was analyzed from a certain PUBG cheat driver.

What it can do?

• Protection against direct dump by Anti-Rootkit tools
• Bypass MmCopyMemory
• Does not trigger PatchGuard

How to detect?

• Attach a GUI process before using MmCopyMemory

Compile

• Visual Studio 2022 & WDK10
• llvm-msvc [link]