mrexodia/TitanHide

FindCaveAddress bug

Kwansy98 opened this issue · 2 comments

Kwansy98 commented

Not all memory of ntoskrnl.exe readable, maybe use MmIsAddressValid to verify before read. My test win10 vm kernel version is 10.0.19041.1741


// bug fix simple way
if (!MmIsAddressValid(Code + i))
{
	j = 0;
	continue;
}

titanhidebug

Mattiwatti commented

How is it a bug in TitanHide if another driver copies a function and then calls this function with an invalid address?

Kwansy98 commented

I didn't read the previous code carefully, range is the section of NtFunction(which is always readable) instead of whole ntoskrnl.exe, my mistake :(