edr-evasion
-
Mapping kernel code without pool traces
MmAllocateIndependentPagesEx allocates pages directly from the PFN database, bypassing pool accounting entirely. Combine that with the Intel NAL BYOVD primitive and a …
MmAllocateIndependentPagesEx allocates pages directly from the PFN database, bypassing pool accounting entirely. Combine that with the Intel NAL BYOVD primitive and a …