← Back to malware index
Driver-assisted kernel R/W toolkits
Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.
3 syscalls cited
- NtAllocateUserPhysicalPages
Allocates physical memory pages for use with Address Windowing Extensions (AWE).
- NtMapUserPhysicalPages
Maps AWE-allocated physical pages into a previously reserved virtual address window.
- NtFreeUserPhysicalPages
Releases physical pages previously allocated via NtAllocateUserPhysicalPages, returning them to the system page pool.