Title:
crash-dump-write-to-disk
Download
Description: how to bypass the Operating System’s normal input/output (I/O) disk driver path and use the crash dump driver stack (i.e., “crash dump I/O path”) to read the master boot record (MBR). This technique subverted the TDL4 rootkit and would be effective against any traditional I/O hooking rootkit/malware.
To Search:
File list (Check if you may need any files):
dmpflt-8c2f6fb9f548\DmpFlt.cpp
...................\PostCrash.cpp
...................\Helper.cpp
...................\DmpFlt.vcxproj
...................\DmpFlt.sln
...................\PreCrashStaging.hpp
...................\Common.hpp
...................\DmpFlt.hpp
...................\Helper.hpp
...................\Timer.hpp
...................\Dump.hpp
...................\PreCrashStaging.cpp
...................\PostCrash.hpp
...................\Timer.cpp
