Hello,
I think there is a mistake in the script.
The script find WdfVersionBind function firstly.
Then it use WdfVersionBind function's argument to get WDF_BIND_INFO address.
And get the global WDFFUNCTIONS pointer from the WDF_BIND_INFO offset 0x20.
But i noticed the type of the field 0x20 in WDF_BIND_INFO should be WDFFUNCTIONS ** not WDFFUNCTIONS*.
.text:0000000140001628 mov eax, 8
.text:000000014000162D imul rax, 74h ; 't'
.text:0000000140001631 mov rcx, cs:g_WdfF_Functions
.text:0000000140001638 mov rax, [rcx+rax]
.text:000000014000163C mov [rsp+58h+var_18], rax
...
.text:000000014000166E mov rax, [rsp+58h+var_18]
.text:0000000140001673 call cs:__guard_dispatch_icall_fptr
Hello,
I think there is a mistake in the script.
The script find WdfVersionBind function firstly.
Then it use WdfVersionBind function's argument to get WDF_BIND_INFO address.
And get the global WDFFUNCTIONS pointer from the WDF_BIND_INFO offset 0x20.
But i noticed the type of the field 0x20 in WDF_BIND_INFO should be WDFFUNCTIONS ** not WDFFUNCTIONS*.