A forum for reverse engineering, OS internals and malware analysis 

Accessing EPROCESS Structure on x64 systems

Forum for discussion about kernel-mode development.

Re: Accessing EPROCESS Structure on x64 systems

 #19356  by EP_X0FF
 Tue May 21, 2013 3:12 am
Stylo wrote:what will happen if i redirect the Flink / Blink fields at ActiveProcessLinks that should cause BSOD?
PatchGuard will happen.
 Return to “Kernel-Mode Development”