kdmapper - KDMapper is a simple tool that exploits iqvw64e.sy

项目说明

KDMapper

KDMapper is a simple 工具 that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory

Tested from Windows 10 1607 to Windows 11 25H2 26200.8875 :hea:

Note: Add definition DISABLE_OUTPUT to remove all console outputs

Note: Is recommended set a custom entry point like in the HelloWorld example

Parameters:

--copy-header to enable the copy dri option by commandline
--free to automatically unmap the allocated memory
--indPages to map in allocated independent pages
--PassAllocationPtr to pass allocation ptr as first param
[PDB offset based build only]:
--offsetsPath "FilePath" to include your own offsets file path (by default .\offsets.ini)(if FilePath contains spaces, it must be enclosed in quotation marks)
--dontUpdateOffsets to execute without updating the offsets file (warning: you have to be sure that the offsets are not outdated to your current windows build, or you risk a potential BSOD)

Features:

Works with /GS- compiled drivers
Hooks NtAddAtom which exists e and is rarely called
Clears MmUnloadedDrivers
Clears PiDDBCacheTable
Clears g_KernelHashBucketList
Clears Wdfilter RuntimeDri RuntimeDri and RuntimeDri
Use NtLoadDriver and NtUnloadDriver for less traces
Prevent load if \Device\Nal exists (Prevents BSOD)
Header section skipped while copying driver to kernel
Added the possibility to modify params before call dri
Added PDB_OFFSETS macro that will allow the use of Offset PDB features (choose the target build)
Introduced new project "SymbolsFromPDB" that will help KDMapper to adapt quickly to any windows updates by parsing the target .PDB files (PDB_OFFSETS macro must be defined to use this feature)

Building:

Requirements:

Common issues

BSOD with a simple driver

Error \\Device\\Nal is already in use.

This means that there is a intel dri loaded or another instance of kdmapper is running or kdmapper crashed and didn't unload the previous driver.

If you are sure that there is no other instance of kdmapper running, you can try to restart your computer to fix this issue.

If the problem persists, you can try to unload the intel dri (If the driver was loaded with kdmapper will have a random name and will be located in %temp%), if not, the driver name is iqvw64e.sys and is installed with your 网络 drivers.

Errors 0xC0000022 and 0xC000009A:

Both are usually caused by FACEIT AC or other Antivirus/AntiCheat

Note: Some AntiCheats will keep running even if the 游戏 is not open

Note: Some Antivirus will keep blocking this even if you disabled them

Error 0xC0000603:

The certificate has been blocked as and the mapper will return a status of STATUS_IMAGE_CERT_REVOKED. More info at Microsoft

If you want to disable your driver list you have to open regedit.exe, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config and set 'tEnable' as dword with value 0 and restart to apply the changes
Alternativelty check this Microsoft

Creators and contributors

Original creator

Updated and improved by

Initial PDB offsets parser written by

Some code cleaning

Have Fun!!

项目信息

开发语言：C++

Star 数：3134

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕KDMapper is a simple 工具 that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。