README

rtcore-fpc

Playing with unsecured driver(s) allowing read/write to kernel memory. For now, playing with EPROCESS : -removing PPL flag -stealing system token

memRW.exe load "%cd%\rtcore64.sys" memRW.exe list memRW.exe removeppl PID memRW.exe makesystem PID memRW.exe stealtoken from_pid to_pid memRW.exe unload "%cd%\rtcore64.sys"

Greatly inspired by https://github.com/RedCursorSecurityConsulting/PPLKiller

Tools to check EPROCESS struct : https://ntdiff.github.io/

Detailed EPROCESS struc : https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/eprocess/index.htm

Bunch of other drivers to look at : https://guidedhacking.com/threads/how-to-bypass-kernel-anticheat-develop-drivers.11325/

Must read (mimikatz 4 ever...) : https://posts.specterops.io/mimidrv-in-depth-4d273d19e148