Kevin Church/BBC News
(aa|bb)* and {a}..{b}
，更多细节参见搜狗输入法
2026-02-28 — Autonomous agent identifies SQL injection and begins enumeration of Lilli's production database
Maintaining their own shadow copy of expected MmUnloadedDrivers entries.Detecting anomalous zero-filled entries in the middle of the circular buffer (a signature of deliberate erasure).Cross-referencing MmUnloadedDrivers against other kernel timestamps and logs.BigPool AllocationsWhen a kernel allocation exceeds approximately 4KB (more precisely, when it exceeds a threshold managed by the pool allocator), it is managed as a “big pool allocation” tracked in the PoolBigPageTable. Anti-cheats scan this table to find memory allocations that were made by manually mapped drivers. A manually mapped driver typically makes large allocations for its code and data sections; these show up in the big pool table with the allocation address but without a corresponding loaded driver.
:first-child]:h-full [&:first-child]:w-full [&:first-child]:mb-0 [&:first-child]:rounded-[inherit] h-full w-full