Record · corpus.blog/posts/01a0872e-ce07-7283-b976-78c6bb1827a9

GMER - the art of exposing Windows rootkits in kernel mode

artemonsecurity.blogspot.com · published 5 April 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at artemonsecurity.blogspot.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 46
Words captured: 3,542

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZkhiLirkaqv8rY62Q8Aope7QUwvbGk2uTF7F_npeWyqE2WLw0gVlNPsA-q5N0HPDrZlOLF-vIrStGWHcs2Dri0Az9EYj2rOp40qvkiseXVz66jOuABfljaAEgTuuyrFoKp6Vws1prs8s2MeZ0rqNcGlfMZxjxA4ZGs27wGe9zy1ian8BkAutqBiBPN9Un/s1119/1700831070455.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-b_Yo4w4u72PX_THgZJhdh8zxiS35wEsq2ktsf_zGuRMJeGdNy29LiKSEyETk_kytklyph4OWKmXu0F6wKNnnVUX1OXeLOmm3diXd0A6-z43_Gj3yAVbtx2xEbkU5yExDQN_NU82QjA4nBWrSVsOKj9gA5khVzmHJF-5xB3vKCqP5sH_5UuPFjqWOYfZo/s758/1700906569143.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyC1FCbuRqUbzF7hjqv7z3g4cwQD8AqssXEEKjKPaNAK3EY52SnI5l25P42W3OyD9A5HgB9P6NSq1WrRm-XDPs-6YvfeRffCwajuiunqivorM4JmVgk6qdXVW2jW7VfCTVb6-_QDRdMT9B4w2MKVVvAZzNyLUixkl2pdUa2e9HbPbJo_-vtZDPGtWgFd6F/s834/1700907461310.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrDCXu4ZC0SKa1ftDICWYZ6sbMWSu09_HzhXiKeGU3s7oPzsKvX5DZ2NI-STtnb5O4MmtPCpr7bymK3Y3OXQa9CeDZyizC12MS6yyy69KObHZQ2n1PIdYzOPpzQ2AswO2a6e5FLpImAs9FnwrpSbRZW6h307pTE2ejVVp6l7eUafc7l7zgDJGD08Wp6aOZ/s804/1706033364718.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKq_ZXBGiMH0G_L5mMmo6s2b_PGHDDLL2K9VBUNC-QNgLkida4KBEhVI2e9zxqyl7iVxvmU33iI_wgDwGwEUhXrXr3LlnzJbWejjVNIidMU0cBmlkx9YFqKaoo9bXzDU-tsC3XZ2ZIaYbaUJSJ-TeVM8Gbn8bcTSH17-sh5E7r110-wnMzrKZnuR1L_fLC/s860/1702827884438.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_fN1w4En02A5loCeGaQsnYD7z9jxvDIx4u8EvIj9noxvis2mY40k0RPlV1tB_il5JJ3D6YVMX4sLhTU7AU2gZpjFhuMq7ldvdrbN1Ie_WcbbN1HcZNWBGk6n8ussOy2KGMwqcrBj_wm0AbSV7oTtlFOBN8B0whWf1qRIyJO7J21MrV7EfeEuVrdKxJykh/s974/Screenshot%202024-04-05%20214921.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_a43Rix9N0q8ftUx7YnHrKlK0K0yMJZmLnegQDneP6_nKGn3F5hO_KaUVpsz6oNbE5tW6c0shHWImzKcDds5slFr-0eOfdNnNRNqggW8UkD2iOVm3K9dSRYGlrzll7tUKYPObUsM41stbm02SvnHxQlxut2N6_thWF9mVQrHF7FRB5ndJ9LQRqsDZgDTB/s723/1701127126845.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilmnRYiSk6wh4KqFV8POiTbuFPSYYg48Mwcf5Yjw-oK6zrVazrczyyMI6iCsn6dR-VPWIFuGFSuDjWfQSXtts2wv3V_Q05S7Pm11nBu7oOU7p6kjWcLYxw6tKqiRlbQCT4gTCz5Dyguxa_d7zneRhkcu_F4xfDXca2XKj08feXIUoo8ppXm81lBVG0llYC/s744/1703357705176.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6svSEQAd3lTQuHuioZbM7-10PTysi2ZMTTl-plWvIn5LL5KOo3WGgIAVplXIaldWmCSVOSEpHX0ENZFBCT8ytDrzcNgb5Z_Arfp2eBGbSAaXqQw8xnagz_hlL09X8maVIQb3OltP8qlsqX7Jzabz7cWUmkgFZsSQn_QVxvIyn700ZeID7TJyuOl2nO2oZ/s645/Screenshot%202024-04-05%20220019.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl0PHYfuPC2ipRgZnLc0WHF5OLhtbkmEw1EkRBu5vmGsXQ-ylqIo3vGme3km7E1I2RozHHh1pR67ulIsfTd9vhHGWp4VjGwr7lkgHSEuKD6bLt79SXTjHpgcD9mGKhuEX-6Q8TuxemiLWdXSzqnkJoYpHl6Kes83rUGKnAkmVKsklP3M-QBC2K7FBHFA87/s725/1707504529003.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLkBMwhW6msqrKBCXLqWcgXXayio8qSYVGexW2A06gMohdMYssSyJQ6DGCIpEORAlo5omHYNepQ37OHJ5Lm2qpqM0dOeOyyRIyRBT8G7vrdmqXGSBsP7IvPKibuLruXeBXOvDWVZTJst-ovDrIhVQTSRdwGLcGB8IwiQ6EKibEaSKKSd0aiFHyqKUiZEDB/s955/1708026179818.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVoojVxLHXyxS_tkCdHYrCMlZgZBItDp5p85os678BUQ3All2VLrf6ynUGo7IqQ2NhbM2xYY40QVfAqPt2LJD-UqlENnslgigjxt8t4plDFNa33opv4DaNJL-Im3oA4YNS2lU6GKyB4da4G_v8o7SEvHpzdZFMNRWMXgXI6LV8u0pUSzJ5BXV7ErWCRmOz/s635/1706269859748.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJvmZKyA6-f1ES8K4mHJBJ_80ji_vAestpdndpxyPDRotrRpdcaZKPm-hf62_aKTh_CZH_nuY6Ru5Fl_6SA0TwBc5d4BdqVgroQUdWIyEhe6a9yofF1sQO7wqcgUQpCI9HpVCX1FEeCc82wHcg2eUKbMSJWnaI3YfSxHpqu3FqqbvXO13oiANO7F7lb8zG/s769/1706271882019.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLtVM4RJqOj_BuyhJbYHJpbb-llCuZ8PjbAeBGOZk1s7c-JacCLqMAdtFU5F1_CWQoIDrXy79YeMD2oLcOyfLmGIqizdgao9BSOPS1hIr2l1DN8O5X96oF1kjkiQgieVr8adQZTozd-_Jr8nF5dl-oeRBVDxJNkW1Z0Dvz33arGTqnwbwLi9zW4v_k-G_D/s649/Screenshot%202024-04-05%20220940.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxRLl4FLacCHsnlRSghqcgD2w8IColY7Sy6LIE90CCcoAQXu3NxBvCA-t7mOo_qxjz9hyes0Km6l7b9bS4bqNLpw8EbEc4rkKuDjZ05yuDzi2g5b6bjyYSwR_Mq-2ljoWEGtCGOcRBRAg6nnEcdfRMUAQ20twoTOv0O5d6CecWCjTowMugoA-jot0fQXQs/s539/Screenshot%202024-04-05%20221100.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtWh8ZcQeIKZVdS8cAdGs4knlwGUkZEglHxaCIF86Cyy_nFAUDeTbGe2CHjA9CMtghHDR-1l5c4a5wuBqLj2D0ihumgNksx8303lQRhKFyynpYhyphenhyphenRDrWfiATNnSgttue6iOJPpl5mTmN9cpH82I03y17QWx56xqZJMpTGqCuvyPuBAookBo_7PC_gsnJLE/s680/1706279116709.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJ-FbTsdj4H_iCBseLuLN-mlhM9wasYNSyyn0kirMank6xNGDeBg09XNLTjp1LggtMCZI-TyL_ZtMS02AulXyhAkNslP236dgX3N2iyMDfjzPmvk1_MoHV1P8es9TDI8vk_otlHZrBRm9A0LpQO1oMYKyfQIWFR_TUz5oggDWfwBthDzy__SFQ4L6opXyg/s657/1706281215401.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3FcorYFG-BFNLbItfwVoKcfxA3dwUa9i8geJfW6iVKV23oY5OWI_dWmJ_0vlxp8wptXfBWNTdHIySk1PxxVrn6Pn3sTUtAKDtWj4JG9m47gE7om8VvsuVLxF4zV2HrML51wML3q3UqoJJtrUno2N9_Rmepyiv_vIfljtnFM7mWcArcE3CtH-jrHhnJc_D/s631/Screenshot%202024-04-05%20221506.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFYXO5-FPM0VKs4OSxPNbO4NqLJ85-n5rSKNHN0uFU3pGOED7aDRH-v3PpXe79sZpwi9K2O7d7Lq4MNX_fXcIp7ph9mNW4u2cDDcB-7wqU-KYJrMnMWZXSNNECHaTSAu_h3f_G9t9ry6B2pgbPLN_9poupVAw5pdOy8OZd2aI-wJVfY-bcIkXRdH__vpKz/s912/1704819522820.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBsr2ngalxYytmHo43iunXQCiPnGIw5FKHnoy5lj3xBgoOORrJtJXcYWwdd6oLnwqtHFvg1o9StJpubxxGTvmMRuqExAQ-zd6Z5yn56RIIDYVQlyVLiEeRS8BjEazvDDHVpXQA5HLfHlTtYRnzwPIq3x17j10hvdzvHW77ffuaiQIEULCGKfxPJSV9U_DQ/s676/1704814830012.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3tY66OuKn9Ur4szBipCIddzo4bshR6owRhVigsNXcNUdPa2eEY_TbfKcnCkZq-uMRYjQdt-33iyHoTspTXgfLIx16m7I2s2oV5lklLOdGPY_YTH7Fgp482zn6gcoybWPScUY9t4T-UUapiLMKNmzM6b-K8hjz37izF1Zm2emeyp2mANbkuPRUoFSb0WHf/s953/Screenshot%202024-04-05%20222036.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqdHSikJkXPxhKAT8mglsNUDDaom4JYMEArRsNTcqWNWxit1Pf85jOHDu48iiJ3kNgSDHdyIXaokPCsg_uKwy09iyZPEK54eKN_pamJeF6ygRiJBjVAou3lxdSgQrXvqG3tUR0lV7yUsGx5aN3AurundWzrrSgy24cClkoQomO7CLNbCEEwgVpnz_liplk/s1015/1703535875432.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4YeR9cx7Fj-LlQwvyNoUJI3tpN8kmjHD0NoGvRqURyoC4foBavi6YBYdlwyuAg40xPLHZ2O8MIyNTFFgMLSgc9ngW1IFIdUwVKjSb5U2H49qtyToPJVpw8-7I39sIujQefakbxHB5dW1qehKE2FImm2_QbyEfVGMxH4Wmh8_Ziq5RilC0Ky4HXGu05Iel/s1384/Screenshot%202024-04-05%20222518.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbqUgnFe5Nk5E56Y9mDzNLpyJ0MMblCSOrHgyHdQyortc8FgnSSBWSKq82T8XUmX6p0JigFs3rn1cRB8U2BwvGUNa8hCCeAx-lKg1zLVkYcrADsYj2UBo_li00aGrjcpSPTrkRLrn5WvbnN3_bkkjHkH9r9cSpsANDkIOBftDr72-iMy7kIU1X2n6VRBR4/s693/Screenshot%202024-04-05%20223433.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZLu0GlooxfoG3cv-duKQiu8SFypNJpovrD8CwW-y_E495VkWf1IqU2XQDJm06W4OvfLcvKyUbseuNKWyDf0YNY_s0FqiPItwI7lvkrZJZDIRq9hLiVYBj-my4s4XAsDy6VDR2Fo_VUMe265jhdrhyNEU1TsDSGMOD3lCon6gEa8UrFJklOnQ5SAIac6-N/s715/Screenshot%202024-04-05%20223752.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUQti7aA3Tk6r_PTkoh38lEcntN865xixp6NP0aRVduqULkH3y-yA8WmZF_WjfK2oEj7we5MjT1-JXPz7Vmr9i0aTqvWZn_GslkkGtPMXqwhGxnhWBxJHrg4EGz0STBOv4W9NwpDY16u7xpx-_oS39t-18MCmRqchsUAYG5TfcK1gBxPQnzK7JIyjWME8l/s878/1706033807538.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTUk-q1TwnXBgV64rwmOqtaVztZXb3O3pk-8gUaj3Jq_FTjLx9ec244EtvsGhSYxWsen7Z6yNt6S4bfsgOJELw_D9EW_bLWSBAQuaetopRfA4kyls1s27JC1lWlk4rjfa0d32kYEWzMViQPIlOK66b8In4RXItPAiYZOinhXSABoJSissp4o0WbapxVyHL/s988/Screenshot%202024-04-05%20224000.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9w-aw8qMEdVNJtysv0gx9eC-hnTUtuaT0IB-btT5c7FlWM9iFbsynajj2yFbDVpc6GKGgN0aD9zput8aI05NbjIHAUWc8BvhZ9Y5E43JP2mvSqzQqteSGFD-d1vzkBMryvGScyLo2R8HiQ1brl0fqhB-OES2bQ7APC_U8NSnKUmqhUzvWIJNvU2xB5qKK/s859/1706034511849.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyKLZSf4Y_l1-_lHKaOEyBjMDdmH7kLzoLefib2pMGZeslTe2XtWxn-aYQqXmDjtqnTvnQbSK2QEnm8cACkwklFmq75V2rvLhztvJmtB9pqMonq9aYl0l7RxqhOnwtPTS6F5rCDjTHp-LK48PfViFj2xJzRvjKDqmrPhNXVIHtJUUHa86Ku9nOhax3bq97/s581/Screenshot%202024-04-05%20224430.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJ2oVSWB7PtK6IbXVWEcAwGn16jkKiXRzbJNMKEGDS8h81q49yO1GDU-tY2gC6P0DE8EFmb8aahaMAZwL7EIjLEP7x3iMmx-daC4z3E0hsfms2vpHgIaNIQQXsPo6kZZEd8lPD8swc5wfWFYlWNItPGPt_bCY7WyycQ36Ect6ZqvwnB-tKL84S35-yRfqC/s1451/Screenshot%202024-04-05%20224610.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL8YsfekbMZeSs1QSn4_fIfsYHv3rjkqaRMCHOWXlfRDdC3Oi7piJN8F_vMN16gn2S7Fx-BOXXZp8c3au-4yeN-Yi_ej3u6r6vUGHhDljTd0AAbG27MYQrlnhFnevLMMxbx_BVxRKPaGu0EXcXqAcKxjBhiQXG0u2-OqJWHviRJvvLkKhDjDHDUUIXgrLr/s671/Screenshot%202024-04-05%20225204.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/a/AVvXsEgYJL3CeNjMdkaMdaW9CkjkQ3SqAn_pwAYf9d6nRV-nPAkc3gAAnVQDdjzJbBNalTuIFHBN1K1-vTW0S60pn6PBmVmHMFj-QfdpgpBcK3a1X-9CvyWGv7mWJV9h3qnAquDjKnQmLfpykhFAt3EYNikWB7om3mg6lllv4xY41mRw-pJ1x2EFtpp5eEnwg6Ur

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOoqi7778UKJoDyyoGr61yMpOcRLoGGCJkOYCjqz_cSW3MOh2R28-XPOpRppmmiERdsHwOsT0WffX22X9dWlFUxPajKGzQOjnUsF6cQPE5QrqUEazfN4SOBIkMvecgn0RjZXlTQj0g6erXPkKxBcQpXkRV9P9lg7TfCfHls1Rsnw2E-kUPpQOIdBmv0yxU/s1074/Screenshot%202024-04-05%20225452.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2WRPmXDOGxPvew3-AoKmyhSTzj_gn-Zem0-Br0OqenAxMqgs6SkUGXjZOtbIZgFAen1HbNLD_Lg0Cpxh4PPdV4Ldy2DACfYtWhIYbkyr8nBfPe-QRjctvIpcUV8wEct7jJsJaMK7U1LxAVh4Dv1jpw0OeJ2c4dHAylDZ3lURPPUJvHiPR24c6tJEzGaub/s921/1701892135454.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTTng_mqIKTlD6Jj2uSIFv7uzefErxjymv9MymH38tZF8SStlsNVRg8-vK6IR7yuJlEA0vxkT2aGlrKjo5W4kh_VrKGumX_tmriNGFfe_bI0VSMSx2D0BehuzVBd2RC_G8BpJZEKC_gCvQtSgTQK9OyAFHKTp1xjyBoxMXsYT0w8WCQ6bYyPcYJ9qb0xCL/s1187/1706033471706.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI3E0dFw6G7PaAnQSn_pRVRXgmE1tgL8KTnfT22iVatYt3S5FJ0JdJP_bMLPuOaFSEicFZn-G3oDKM55hp4rZAtRxHe33dNadl60-Jc-hBm8PGBx9PaCtoCmlPHJSqXwvnO8HngvFMyxQt9bwY6b5NLNi046l2qFXCgoqudeM1YOcEdZG7P29RP2i7VWte/s1207/Screenshot%202024-04-05%20225917.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIgE866wrLN03mIPyDFuVWrmvfilzyDcXmAjndU84VIjsLNENVqpXXzh4i4oWqd3sNQqAYt9ATatZJcUCKVGnCyGNfaqBPk0jdoRDav2S7XGIfscXHOWknPIZTllyEjdYRFPBouFqjuDCbVKQbH4qRV5apxinKBvXWWg_zmaY3nOz8i3rEeSXifzpGZYVT/s601/Screenshot%202024-04-05%20230133.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioVJfnR3FRy-snJE7xjIt4mPvPah0VeFCSA5cx7hr506zBDWq2BKzfgZ4b2oJCTikp4zT4IxnFmRhuUwthRxEqF_TLpFC9uefKEcCW34h7jfZaJ68PWA1Ip2hZ8FnFnIq_81nz0yRJ7fCyCyAUXFjsWgeSBzF1YJTFcLm3_B9GwIde2A_vIRVHxgnymoWk/s601/Screenshot%202024-04-05%20230133.png

blogger.googleusercontent.com

https://the-deniss.github.io/posts/2023/02/09/elevation-of-privileges-from-everyone-through-avast-av-sandbox-to-system-amppl.html?trk=article-ssr-frontend-pulse_little-text-block

the-deniss.github.io

https://github.com/Mattiwatti/PPLKiller?trk=article-ssr-frontend-pulse_little-text-block

github.com

https://github.com/hfiref0x/KDU?trk=article-ssr-frontend-pulse_little-text-block

github.com

https://github.com/wavestone-cdt/EDRSandblast/tree/master/Offsets?trk=article-ssr-frontend-pulse_little-text-block

github.com

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a?trk=article-ssr-frontend-pulse_little-text-block

cisa.gov

https://www.crowdstrike.com/blog/evolution-protected-processes-part-2-exploitjailbreak-mitigations-unkillable-processes-and/?trk=article-ssr-frontend-pulse_little-text-block

crowdstrike.com

https://www.alex-ionescu.com/146/?trk=article-ssr-frontend-pulse_little-text-block

alex-ionescu.com

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/srb/ns-srb-_scsi_request_block?trk=article-ssr-frontend-pulse_little-text-block

learn.microsoft.com