Key Changes:

• WFP monitoring and shellcode detector w/ manual zydis stackwalking, improved NMI stackwalking code, refactored client, fixes, etc.

Full Changelog: v0.3.1...v0.3.6

Instructions:

• You need to disable VDBL (Vulnerable Driver BlockList)
• Open cmd (as admin), type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Note: KDMapper and our kernel driver are now separated.

Key Changes:

• Implemented anomalous page table mapping detection in user processes

Full Changelog: v0.3.0...v0.3.1

Instructions:

• You need to disable VDBL (Vulnerable Driver BlockList)
• Open cmd (as admin), type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Note: KDMapper and our kernel driver are now separated.

Key Changes:

• Added CR3 validation routine (check for CR3s not belonging to any process)

Full Changelog: v0.2.9...v0.3.0

Instructions:

• You need to disable VDBL (Vulnerable Driver BlockList)
• Open cmd, type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Note: KDMapper and our kernel driver are now separated.

Key Changes

• Fixed CR3 Thrash PF handling, added Zydis, fixed NMI stackwalking, fixed unwinding PF handling, added serial logging, ...

Full Changelog: v0.2.6...v0.2.9

Instructions:

• You need to disable VDBL (Vulnerable Driver BlockList)
• Open cmd, type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Note: KDMapper and our kernel driver are now separated.

Key Changes:

• Refactored constant macros and added NMI max count (NMI spamming to all cores)
• Refactored code, added kernel module signature check, other improvements...

Full Changelog: v0.2.5...v0.2.6

Instructions:

• You need to disable VDBL (Vulnerable Driver BlockList)
• Open cmd, type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Note: KDMapper and our kernel driver are now separated.

Full Changelog: v0.2.0...v0.2.5

• You need to disable VDBL (Vulnerable Driver BlockList)
• Open cmd, type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Full Changelog: v0.1.0...v0.2.0

• You need to disable VDBL (Vulnerable Driver BlockList).
• Open cmd, type: kdmapper_Release.exe OAC.sys
• Then, open OAC-Client.exe

Full Changelog: https://github.com/lauralex/OAC/commits/v0.1.0

• You need to disable VDBL (Vulnerable Driver BlockList).
• Open cmd, type "kdmapper_Release.exe OAC.sys"
• Then, open "OAC-Client.exe"