CallMeWin32kDriver

Load your driver like win32k.sys

Motivation

This feature was analyzed from a certain PUBG cheat driver.

What it can do?

Protection against direct dump by Anti-Rootkit tools
Bypass MmCopyMemory
Hide world does not trigger PG

How to detect?

Attach a GUI process before using MmCopyMemory

Compile

Visual Studio 2022 & WDK10
llvm-msvc [link]

Some discussions on UnknownCheats

https://www.unknowncheats.me/forum/anti-cheat-bypass/511107-load-driver-win32k-sys.html