Skip to content
This repository has been archived by the owner on Aug 21, 2022. It is now read-only.

kernel driver used to monitor the activity of BadlionAnticheat.sys by patching its IAT

License

Notifications You must be signed in to change notification settings

KiFilterFiberContext/BadlionLogger

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

BadlionLogger

BadlionLogger is a rudimentary PoC of a kernel driver used to monitor the activity of BadlionClient's kernelmode anti-cheat (BadlionAnticheat.sys) by applying IAT hooks on the image during the image load callback.

BadlionAnticheat is virtualized with VMProtect, a popular VM packer used in many products.
This project employs a blackbox approach to monitoring driver activity without devirtualization due to no integrity checking.

Example

DriverEntry

CreateProcess callback

Disclaimer

  • BadlionLogger is a proof-of-concept and is not intended to be a reliable product
  • This project contains numerous bad practices that should be considered

About

kernel driver used to monitor the activity of BadlionAnticheat.sys by patching its IAT

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages