init
This commit is contained in:
commit
de531703ab
485
.gitignore
vendored
Normal file
485
.gitignore
vendored
Normal file
@ -0,0 +1,485 @@
|
||||
|
||||
# Created by https://www.gitignore.io/api/c,vim,c++,windows,visualstudio,visualstudiocode
|
||||
# Edit at https://www.gitignore.io/?templates=c,vim,c++,windows,visualstudio,visualstudiocode
|
||||
|
||||
### C ###
|
||||
# Prerequisites
|
||||
*.d
|
||||
|
||||
# Object files
|
||||
*.o
|
||||
*.ko
|
||||
*.obj
|
||||
*.elf
|
||||
|
||||
# Linker output
|
||||
*.ilk
|
||||
*.map
|
||||
*.exp
|
||||
|
||||
# Precompiled Headers
|
||||
*.gch
|
||||
*.pch
|
||||
|
||||
# Libraries
|
||||
*.lib
|
||||
*.a
|
||||
*.la
|
||||
*.lo
|
||||
|
||||
# Shared objects (inc. Windows DLLs)
|
||||
*.dll
|
||||
*.so
|
||||
*.so.*
|
||||
*.dylib
|
||||
|
||||
# Executables
|
||||
*.exe
|
||||
*.out
|
||||
*.app
|
||||
*.i*86
|
||||
*.x86_64
|
||||
*.hex
|
||||
|
||||
# Debug files
|
||||
*.dSYM/
|
||||
*.su
|
||||
*.idb
|
||||
*.pdb
|
||||
|
||||
# Kernel Module Compile Results
|
||||
*.mod*
|
||||
*.cmd
|
||||
.tmp_versions/
|
||||
modules.order
|
||||
Module.symvers
|
||||
Mkfile.old
|
||||
dkms.conf
|
||||
|
||||
### C++ ###
|
||||
# Prerequisites
|
||||
|
||||
# Compiled Object files
|
||||
*.slo
|
||||
|
||||
# Precompiled Headers
|
||||
|
||||
# Compiled Dynamic libraries
|
||||
|
||||
# Fortran module files
|
||||
*.mod
|
||||
*.smod
|
||||
|
||||
# Compiled Static libraries
|
||||
*.lai
|
||||
|
||||
# Executables
|
||||
|
||||
### Vim ###
|
||||
# Swap
|
||||
[._]*.s[a-v][a-z]
|
||||
[._]*.sw[a-p]
|
||||
[._]s[a-rt-v][a-z]
|
||||
[._]ss[a-gi-z]
|
||||
[._]sw[a-p]
|
||||
|
||||
# Session
|
||||
Session.vim
|
||||
Sessionx.vim
|
||||
|
||||
# Temporary
|
||||
.netrwhist
|
||||
*~
|
||||
|
||||
# Auto-generated tag files
|
||||
tags
|
||||
|
||||
# Persistent undo
|
||||
[._]*.un~
|
||||
|
||||
# Coc configuration directory
|
||||
.vim
|
||||
|
||||
### VisualStudioCode ###
|
||||
.vscode/*
|
||||
!.vscode/settings.json
|
||||
!.vscode/tasks.json
|
||||
!.vscode/launch.json
|
||||
!.vscode/extensions.json
|
||||
|
||||
### VisualStudioCode Patch ###
|
||||
# Ignore all local history of files
|
||||
.history
|
||||
|
||||
### Windows ###
|
||||
# Windows thumbnail cache files
|
||||
Thumbs.db
|
||||
Thumbs.db:encryptable
|
||||
ehthumbs.db
|
||||
ehthumbs_vista.db
|
||||
|
||||
# Dump file
|
||||
*.stackdump
|
||||
|
||||
# Folder config file
|
||||
[Dd]esktop.ini
|
||||
|
||||
# Recycle Bin used on file shares
|
||||
$RECYCLE.BIN/
|
||||
|
||||
# Windows Installer files
|
||||
*.cab
|
||||
*.msi
|
||||
*.msix
|
||||
*.msm
|
||||
*.msp
|
||||
|
||||
# Windows shortcuts
|
||||
*.lnk
|
||||
|
||||
### VisualStudio ###
|
||||
## Ignore Visual Studio temporary files, build results, and
|
||||
## files generated by popular Visual Studio add-ons.
|
||||
##
|
||||
## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
|
||||
|
||||
# User-specific files
|
||||
*.rsuser
|
||||
*.suo
|
||||
*.user
|
||||
*.userosscache
|
||||
*.sln.docstates
|
||||
|
||||
# User-specific files (MonoDevelop/Xamarin Studio)
|
||||
*.userprefs
|
||||
|
||||
# Mono auto generated files
|
||||
mono_crash.*
|
||||
|
||||
# Build results
|
||||
[Dd]ebug/
|
||||
[Dd]ebugPublic/
|
||||
[Rr]elease/
|
||||
[Rr]eleases/
|
||||
x64/
|
||||
x86/
|
||||
[Aa][Rr][Mm]/
|
||||
[Aa][Rr][Mm]64/
|
||||
bld/
|
||||
[Bb]in/
|
||||
[Oo]bj/
|
||||
[Ll]og/
|
||||
|
||||
# Visual Studio 2015/2017 cache/options directory
|
||||
.vs/
|
||||
# Uncomment if you have tasks that create the project's static files in wwwroot
|
||||
#wwwroot/
|
||||
|
||||
# Visual Studio 2017 auto generated files
|
||||
Generated\ Files/
|
||||
|
||||
# MSTest test Results
|
||||
[Tt]est[Rr]esult*/
|
||||
[Bb]uild[Ll]og.*
|
||||
|
||||
# NUnit
|
||||
*.VisualState.xml
|
||||
TestResult.xml
|
||||
nunit-*.xml
|
||||
|
||||
# Build Results of an ATL Project
|
||||
[Dd]ebugPS/
|
||||
[Rr]eleasePS/
|
||||
dlldata.c
|
||||
|
||||
# Benchmark Results
|
||||
BenchmarkDotNet.Artifacts/
|
||||
|
||||
# .NET Core
|
||||
project.lock.json
|
||||
project.fragment.lock.json
|
||||
artifacts/
|
||||
|
||||
# StyleCop
|
||||
StyleCopReport.xml
|
||||
|
||||
# Files built by Visual Studio
|
||||
*_i.c
|
||||
*_p.c
|
||||
*_h.h
|
||||
*.iobj
|
||||
*.ipdb
|
||||
*.pgc
|
||||
*.pgd
|
||||
*.rsp
|
||||
*.sbr
|
||||
*.tlb
|
||||
*.tli
|
||||
*.tlh
|
||||
*.tmp
|
||||
*.tmp_proj
|
||||
*_wpftmp.csproj
|
||||
*.log
|
||||
*.vspscc
|
||||
*.vssscc
|
||||
.builds
|
||||
*.pidb
|
||||
*.svclog
|
||||
*.scc
|
||||
|
||||
# Chutzpah Test files
|
||||
_Chutzpah*
|
||||
|
||||
# Visual C++ cache files
|
||||
ipch/
|
||||
*.aps
|
||||
*.ncb
|
||||
*.opendb
|
||||
*.opensdf
|
||||
*.sdf
|
||||
*.cachefile
|
||||
*.VC.db
|
||||
*.VC.VC.opendb
|
||||
|
||||
# Visual Studio profiler
|
||||
*.psess
|
||||
*.vsp
|
||||
*.vspx
|
||||
*.sap
|
||||
|
||||
# Visual Studio Trace Files
|
||||
*.e2e
|
||||
|
||||
# TFS 2012 Local Workspace
|
||||
$tf/
|
||||
|
||||
# Guidance Automation Toolkit
|
||||
*.gpState
|
||||
|
||||
# ReSharper is a .NET coding add-in
|
||||
_ReSharper*/
|
||||
*.[Rr]e[Ss]harper
|
||||
*.DotSettings.user
|
||||
|
||||
# JustCode is a .NET coding add-in
|
||||
.JustCode
|
||||
|
||||
# TeamCity is a build add-in
|
||||
_TeamCity*
|
||||
|
||||
# DotCover is a Code Coverage Tool
|
||||
*.dotCover
|
||||
|
||||
# AxoCover is a Code Coverage Tool
|
||||
.axoCover/*
|
||||
!.axoCover/settings.json
|
||||
|
||||
# Visual Studio code coverage results
|
||||
*.coverage
|
||||
*.coveragexml
|
||||
|
||||
# NCrunch
|
||||
_NCrunch_*
|
||||
.*crunch*.local.xml
|
||||
nCrunchTemp_*
|
||||
|
||||
# MightyMoose
|
||||
*.mm.*
|
||||
AutoTest.Net/
|
||||
|
||||
# Web workbench (sass)
|
||||
.sass-cache/
|
||||
|
||||
# Installshield output folder
|
||||
[Ee]xpress/
|
||||
|
||||
# DocProject is a documentation generator add-in
|
||||
DocProject/buildhelp/
|
||||
DocProject/Help/*.HxT
|
||||
DocProject/Help/*.HxC
|
||||
DocProject/Help/*.hhc
|
||||
DocProject/Help/*.hhk
|
||||
DocProject/Help/*.hhp
|
||||
DocProject/Help/Html2
|
||||
DocProject/Help/html
|
||||
|
||||
# Click-Once directory
|
||||
publish/
|
||||
|
||||
# Publish Web Output
|
||||
*.[Pp]ublish.xml
|
||||
*.azurePubxml
|
||||
# Note: Comment the next line if you want to checkin your web deploy settings,
|
||||
# but database connection strings (with potential passwords) will be unencrypted
|
||||
*.pubxml
|
||||
*.publishproj
|
||||
|
||||
# Microsoft Azure Web App publish settings. Comment the next line if you want to
|
||||
# checkin your Azure Web App publish settings, but sensitive information contained
|
||||
# in these scripts will be unencrypted
|
||||
PublishScripts/
|
||||
|
||||
# NuGet Packages
|
||||
*.nupkg
|
||||
# NuGet Symbol Packages
|
||||
*.snupkg
|
||||
# The packages folder can be ignored because of Package Restore
|
||||
**/[Pp]ackages/*
|
||||
# except build/, which is used as an MSBuild target.
|
||||
!**/[Pp]ackages/build/
|
||||
# Uncomment if necessary however generally it will be regenerated when needed
|
||||
#!**/[Pp]ackages/repositories.config
|
||||
# NuGet v3's project.json files produces more ignorable files
|
||||
*.nuget.props
|
||||
*.nuget.targets
|
||||
|
||||
# Microsoft Azure Build Output
|
||||
csx/
|
||||
*.build.csdef
|
||||
|
||||
# Microsoft Azure Emulator
|
||||
ecf/
|
||||
rcf/
|
||||
|
||||
# Windows Store app package directories and files
|
||||
AppPackages/
|
||||
BundleArtifacts/
|
||||
Package.StoreAssociation.xml
|
||||
_pkginfo.txt
|
||||
*.appx
|
||||
*.appxbundle
|
||||
*.appxupload
|
||||
|
||||
# Visual Studio cache files
|
||||
# files ending in .cache can be ignored
|
||||
*.[Cc]ache
|
||||
# but keep track of directories ending in .cache
|
||||
!?*.[Cc]ache/
|
||||
|
||||
# Others
|
||||
ClientBin/
|
||||
~$*
|
||||
*.dbmdl
|
||||
*.dbproj.schemaview
|
||||
*.jfm
|
||||
*.pfx
|
||||
*.publishsettings
|
||||
orleans.codegen.cs
|
||||
|
||||
# Including strong name files can present a security risk
|
||||
# (https://github.com/github/gitignore/pull/2483#issue-259490424)
|
||||
#*.snk
|
||||
|
||||
# Since there are multiple workflows, uncomment next line to ignore bower_components
|
||||
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
|
||||
#bower_components/
|
||||
|
||||
# RIA/Silverlight projects
|
||||
Generated_Code/
|
||||
|
||||
# Backup & report files from converting an old project file
|
||||
# to a newer Visual Studio version. Backup files are not needed,
|
||||
# because we have git ;-)
|
||||
_UpgradeReport_Files/
|
||||
Backup*/
|
||||
UpgradeLog*.XML
|
||||
UpgradeLog*.htm
|
||||
ServiceFabricBackup/
|
||||
*.rptproj.bak
|
||||
|
||||
# SQL Server files
|
||||
*.mdf
|
||||
*.ldf
|
||||
*.ndf
|
||||
|
||||
# Business Intelligence projects
|
||||
*.rdl.data
|
||||
*.bim.layout
|
||||
*.bim_*.settings
|
||||
*.rptproj.rsuser
|
||||
*- [Bb]ackup.rdl
|
||||
*- [Bb]ackup ([0-9]).rdl
|
||||
*- [Bb]ackup ([0-9][0-9]).rdl
|
||||
|
||||
# Microsoft Fakes
|
||||
FakesAssemblies/
|
||||
|
||||
# GhostDoc plugin setting file
|
||||
*.GhostDoc.xml
|
||||
|
||||
# Node.js Tools for Visual Studio
|
||||
.ntvs_analysis.dat
|
||||
node_modules/
|
||||
|
||||
# Visual Studio 6 build log
|
||||
*.plg
|
||||
|
||||
# Visual Studio 6 workspace options file
|
||||
*.opt
|
||||
|
||||
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
|
||||
*.vbw
|
||||
|
||||
# Visual Studio LightSwitch build output
|
||||
**/*.HTMLClient/GeneratedArtifacts
|
||||
**/*.DesktopClient/GeneratedArtifacts
|
||||
**/*.DesktopClient/ModelManifest.xml
|
||||
**/*.Server/GeneratedArtifacts
|
||||
**/*.Server/ModelManifest.xml
|
||||
_Pvt_Extensions
|
||||
|
||||
# Paket dependency manager
|
||||
.paket/paket.exe
|
||||
paket-files/
|
||||
|
||||
# FAKE - F# Make
|
||||
.fake/
|
||||
|
||||
# CodeRush personal settings
|
||||
.cr/personal
|
||||
|
||||
# Python Tools for Visual Studio (PTVS)
|
||||
__pycache__/
|
||||
*.pyc
|
||||
|
||||
# Cake - Uncomment if you are using it
|
||||
# tools/**
|
||||
# !tools/packages.config
|
||||
|
||||
# Tabs Studio
|
||||
*.tss
|
||||
|
||||
# Telerik's JustMock configuration file
|
||||
*.jmconfig
|
||||
|
||||
# BizTalk build output
|
||||
*.btp.cs
|
||||
*.btm.cs
|
||||
*.odx.cs
|
||||
*.xsd.cs
|
||||
|
||||
# OpenCover UI analysis results
|
||||
OpenCover/
|
||||
|
||||
# Azure Stream Analytics local run output
|
||||
ASALocalRun/
|
||||
|
||||
# MSBuild Binary and Structured Log
|
||||
*.binlog
|
||||
|
||||
# NVidia Nsight GPU debugger configuration file
|
||||
*.nvuser
|
||||
|
||||
# MFractors (Xamarin productivity tool) working folder
|
||||
.mfractor/
|
||||
|
||||
# Local History for Visual Studio
|
||||
.localhistory/
|
||||
|
||||
# BeatPulse healthcheck temp database
|
||||
healthchecksdb
|
||||
|
||||
# Backup folder for Package Reference Convert tool in Visual Studio 2017
|
||||
MigrationBackup/
|
||||
|
||||
# End of https://www.gitignore.io/api/c,vim,c++,windows,visualstudio,visualstudiocode
|
||||
51
KMDF Driver2.sln
Normal file
51
KMDF Driver2.sln
Normal file
@ -0,0 +1,51 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.29409.12
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "KMDF Driver2", "KMDF Driver2\KMDF Driver2.vcxproj", "{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM = Debug|ARM
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|ARM = Release|ARM
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|ARM.ActiveCfg = Debug|ARM
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|ARM.Build.0 = Debug|ARM
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|ARM.Deploy.0 = Debug|ARM
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|ARM64.Deploy.0 = Debug|ARM64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|x64.Build.0 = Debug|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|x86.ActiveCfg = Debug|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|x86.Build.0 = Debug|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Debug|x86.Deploy.0 = Debug|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|ARM.ActiveCfg = Release|ARM
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|ARM.Build.0 = Release|ARM
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|ARM.Deploy.0 = Release|ARM
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|ARM64.Deploy.0 = Release|ARM64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|x64.ActiveCfg = Release|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|x64.Build.0 = Release|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|x64.Deploy.0 = Release|x64
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|x86.ActiveCfg = Release|Win32
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|x86.Build.0 = Release|Win32
|
||||
{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}.Release|x86.Deploy.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {BEF2B030-38D0-445E-8EE8-6A31B825389D}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
307
KMDF Driver2/Driver.cpp
Normal file
307
KMDF Driver2/Driver.cpp
Normal file
@ -0,0 +1,307 @@
|
||||
#include <ntddk.h>
|
||||
#include <wdf.h>
|
||||
#include <ntdef.h>
|
||||
|
||||
#include "sioctl.h"
|
||||
#include "Driver.h"
|
||||
// #include "peformat.h"
|
||||
|
||||
extern "C" DRIVER_INITIALIZE DriverEntry;
|
||||
extern "C" DRIVER_UNLOAD UnloadRoutine;
|
||||
extern "C" PDBGKD_GET_VERSION64 FindKdVersionBlock(void);
|
||||
|
||||
#define NT_DEVICE_NAME L"\\Device\\poolscanner"
|
||||
#define DOS_DEVICE_NAME L"\\DosDevices\\poolscanner"
|
||||
|
||||
#define F_DbgPrint(...) \
|
||||
DbgPrint("[NAK] :: ");\
|
||||
DbgPrint(__VA_ARGS__);
|
||||
|
||||
#define POOL_HEADER_SIZE 0x10 // windows 10
|
||||
#define CHUNK_SIZE 16 // 64 bit
|
||||
// #define PAGE_SIZE 4096 // 4KB
|
||||
|
||||
PVOID SelfAllocKernelBuffer = nullptr;
|
||||
PVOID ChunkAddr = nullptr;
|
||||
constexpr ULONG POOL_TAG = 'NakD';
|
||||
|
||||
NTSTATUS
|
||||
DriverEntry(
|
||||
_In_ PDRIVER_OBJECT DriverObject,
|
||||
_In_ PUNICODE_STRING /* RegistryPath */
|
||||
) {
|
||||
DbgPrint("[NAK] :: [+] Hello from Kernel\n");
|
||||
NTSTATUS returnStatus = STATUS_SUCCESS;
|
||||
UNICODE_STRING ntUnicodeString;
|
||||
UNICODE_STRING ntWin32NameString;
|
||||
PDEVICE_OBJECT deviceObject = nullptr;
|
||||
constexpr SIZE_T POOL_BUFFER_SIZE = 0x100; // a small chunk
|
||||
|
||||
// PVOID kernelBuffer = nullptr;
|
||||
|
||||
DriverObject->DriverUnload = UnloadRoutine;
|
||||
|
||||
RtlInitUnicodeString(&ntUnicodeString, NT_DEVICE_NAME);
|
||||
returnStatus = IoCreateDevice(
|
||||
DriverObject, // Our Driver Object
|
||||
0, // We don't use a device extension
|
||||
&ntUnicodeString, // Device name "\Device\poolscanner"
|
||||
FILE_DEVICE_UNKNOWN, // Device type
|
||||
FILE_DEVICE_SECURE_OPEN, // Device characteristics
|
||||
FALSE, // Not an exclusive device
|
||||
&deviceObject); // Returned ptr to Device Object
|
||||
if (!NT_SUCCESS(returnStatus)) {
|
||||
DbgPrint(("[NAK] :: [-] Couldn't create the device object\n"));
|
||||
return returnStatus;
|
||||
}
|
||||
|
||||
RtlInitUnicodeString(&ntWin32NameString, DOS_DEVICE_NAME);
|
||||
returnStatus = IoCreateSymbolicLink(&ntWin32NameString, &ntUnicodeString);
|
||||
if (!NT_SUCCESS(returnStatus)) {
|
||||
DbgPrint("[NAK] :: [-] Couldn't create symbolic link for driver\n");
|
||||
IoDeleteDevice(deviceObject);
|
||||
}
|
||||
|
||||
DbgPrint("[NAK] :: [+] GO GO GO !");
|
||||
|
||||
// DbgPrint("[NAK] :: [+] Allocating a chunk in NonPagedPool...\n");
|
||||
SelfAllocKernelBuffer = ExAllocatePoolWithTag(NonPagedPool, POOL_BUFFER_SIZE, POOL_TAG);
|
||||
PVOID kernelBuffer = SelfAllocKernelBuffer;
|
||||
|
||||
// if (!kernelBuffer) {
|
||||
// DbgPrint("[NAK] :: [-] Unable to allocate Pool chunk\n");
|
||||
// returnStatus = STATUS_NO_MEMORY;
|
||||
// return returnStatus;
|
||||
// }
|
||||
|
||||
// DbgPrint("[NAK] :: [+] Successfully allocated a chunk in NonPagedPool");
|
||||
ChunkAddr = (PVOID)((long long int)kernelBuffer - POOL_HEADER_SIZE);
|
||||
POOL_HEADER p; // use one POOL_HEADER to index
|
||||
toPoolHeader(&p, ChunkAddr);
|
||||
printChunkInfo(&p);
|
||||
|
||||
// if (p.tag == 'NakD') {
|
||||
// DbgPrint("[NAK] :: [+] tag == 'NakD'");
|
||||
// }
|
||||
// else if (p.tag == 'DkaN') {
|
||||
// DbgPrint("[NAK] :: [+] tag == 'DkaN'");
|
||||
// }
|
||||
// else {
|
||||
// DbgPrint("[NAK] :: [-] tag equals something else");
|
||||
// }
|
||||
|
||||
// Try to find `MmNonPagedPoolStart` and `MmNonPagedPoolEnd`
|
||||
// https://web.archive.org/web/20061110120809/http://www.rootkit.com/newsread.php?newsid=153
|
||||
// KPCR->Version Data->Debugger Data List Entry->Flink
|
||||
ULONG64 nonPagedPoolStart = 0;
|
||||
ULONG64 nonPagedPoolEnd = 0;
|
||||
|
||||
PDBGKD_GET_VERSION64 kdVersionBlock = nullptr;
|
||||
// PKDDEBUGGER_DATA64 dbgBlock = nullptr;
|
||||
|
||||
kdVersionBlock = (PDBGKD_GET_VERSION64) FindKdVersionBlock();
|
||||
DbgPrint("[NAK] :: [ ] KdVersionBlock : 0x%p\n", kdVersionBlock);
|
||||
|
||||
if (kdVersionBlock == nullptr) {
|
||||
// The below can be summarized in these few lines of this README
|
||||
// https://github.com/nganhkhoa/pdb_for_nonpagedpool
|
||||
DbgPrint("[NAK] :: [ ] Cannot get KdVersionBlock try ntoskrnl+pdb\n");
|
||||
|
||||
// https://www.unknowncheats.me/forum/general-programming-and-reversing/259921-finding-kernel-function-address-user-mode.html
|
||||
|
||||
// seems like this shellcode is wrong for Windows insider Feb 2020 upgrade
|
||||
// shellcode: https://gist.github.com/Barakat/34e9924217ed81fd78c9c92d746ec9c6
|
||||
static const UCHAR shellcode[] = {
|
||||
0x65, 0x48, 0x8B, 0x04, 0x25, 0x38, 0x00, 0x00, 0x00, 0xB9, 0x4D, 0x5A, 0x00, 0x00, 0x48, 0x8B,
|
||||
0x40, 0x04, 0x48, 0x25, 0x00, 0xF0, 0xFF, 0xFF, 0xEB, 0x06, 0x48, 0x2D, 0x00, 0x10, 0x00, 0x00,
|
||||
0x66, 0x39, 0x08, 0x75, 0xF5, 0xC3
|
||||
};
|
||||
const auto shellPool = ExAllocatePoolWithTag(NonPagedPoolExecute, sizeof(getNtoskrnlBaseShellcode), 'NakD');
|
||||
RtlCopyMemory(shellPool, getNtoskrnlBaseShellcode, sizeof(getNtoskrnlBaseShellcode));
|
||||
const auto get_ntoskrnl_base_address = reinterpret_cast<void *(*)()>(shellPool);
|
||||
PVOID ntosbase = get_ntoskrnl_base_address();
|
||||
DbgPrint("[NAK] :: [ ] ntoskrnl.exe : 0x%p\n", ntosbase);
|
||||
ExFreePoolWithTag(shellPool, 'NakD');
|
||||
|
||||
// parsing PE file
|
||||
// https://stackoverflow.com/a/4316804
|
||||
// https://stackoverflow.com/a/47898643
|
||||
// https://github.com/Reetus/RazorRE/blob/42f441093bd85443b39fcff5d2a02069b524b114/Crypt/Misc.cpp#L63
|
||||
// if (ntosbase->e_magic == IMAGE_DOS_SIGNATURE) {
|
||||
// DbgPrint("[NAK] :: [ ] DOS Signature (MZ) Matched \n");
|
||||
// const PIMAGE_NT_HEADERS32 peHeader = (PIMAGE_NT_HEADERS32) ((unsigned char*)ntosbase+ntosbase->e_lfanew);
|
||||
// if(peHeader->Signature == IMAGE_NT_SIGNATURE) {
|
||||
// DbgPrint("[NAK] :: [ ] PE Signature (PE) Matched \n");
|
||||
// // yeah we really got ntoskrnl.exe base
|
||||
// }
|
||||
// }
|
||||
|
||||
// In Windows 10, the global debug is MiState
|
||||
// dt (_MI_SYSTEM_NODE_NONPAGED_POOL*) (<nt!MiState> + <HARDWHARE_OFFSET> + <NODE_INFO_OFFSET>)
|
||||
// Sample output
|
||||
|
||||
// +0x000 DynamicBitMapNonPagedPool : _MI_DYNAMIC_BITMAP
|
||||
// +0x048 CachedNonPagedPoolCount : 0
|
||||
// +0x050 NonPagedPoolSpinLock : 0
|
||||
// +0x058 CachedNonPagedPool : (null)
|
||||
// +0x060 NonPagedPoolFirstVa : 0xffffe580`00000000 Void
|
||||
// +0x068 NonPagedPoolLastVa : 0xfffff580`00000000 Void
|
||||
// +0x070 SystemNodeInformation : 0xffffe58f`9283b050 _MI_SYSTEM_NODE_INFORMATION
|
||||
|
||||
PVOID miState = (PVOID)((ULONG64)ntosbase + 0xc4f200);
|
||||
_MI_SYSTEM_NODE_NONPAGED_POOL* systemNonPageInfo =
|
||||
(_MI_SYSTEM_NODE_NONPAGED_POOL*)((ULONG64)miState + 0x1580 + 0x20);
|
||||
DbgPrint("[NAK] :: [ ] MiState : 0x%p\n", miState);
|
||||
DbgPrint("[NAK] :: [ ] systemNonPageInfo : 0x%p\n", systemNonPageInfo);
|
||||
DbgPrint("[NAK] :: [ ] NonPagedPoolFirstVa : 0x%p\n", systemNonPageInfo->NonPagedPoolFirstVa);
|
||||
DbgPrint("[NAK] :: [ ] NonPagedPoolLastVa : 0x%p\n", systemNonPageInfo->NonPagedPoolLastVa);
|
||||
// nonPagedPoolStart = *(ULONG64*)(systemNonPageInfo->NonPagedPoolFirstVa);
|
||||
// nonPagedPoolEnd = *(ULONG64*)(systemNonPageInfo->NonPagedPoolLastVa);
|
||||
} else {
|
||||
// x32 windows, KdVersionBlock get is usable
|
||||
DbgPrint("[NAK] :: [ ] Successfully get KdVersionBlock, not sure whether this works\n");
|
||||
// dbgBlock = (PKDDEBUGGER_DATA64) ((PLIST_ENTRY)kdVersionBlock->DebuggerDataList)->Flink;
|
||||
}
|
||||
|
||||
DbgPrint("[NAK] :: [ ] MmNonPagedPoolStart : 0x%llx\n", nonPagedPoolStart);
|
||||
DbgPrint("[NAK] :: [ ] MmNonPagedPoolEnd : 0x%llx\n", nonPagedPoolEnd);
|
||||
|
||||
// now wait for user call to scan
|
||||
// current debug mode, scan now
|
||||
// scan(&p, nonPagedPoolStart, nonPagedPoolEnd);
|
||||
|
||||
return returnStatus;
|
||||
}
|
||||
|
||||
VOID
|
||||
UnloadRoutine(_In_ PDRIVER_OBJECT DriverObject) {
|
||||
PDEVICE_OBJECT deviceObject = DriverObject->DeviceObject;
|
||||
UNICODE_STRING uniWin32NameString;
|
||||
|
||||
if (SelfAllocKernelBuffer != nullptr) {
|
||||
ExFreePoolWithTag(SelfAllocKernelBuffer, POOL_TAG);
|
||||
}
|
||||
|
||||
RtlInitUnicodeString(&uniWin32NameString, DOS_DEVICE_NAME);
|
||||
IoDeleteSymbolicLink(&uniWin32NameString);
|
||||
|
||||
if (deviceObject != nullptr) {
|
||||
IoDeleteDevice(deviceObject);
|
||||
}
|
||||
|
||||
DbgPrint("[NAK] :: [+] Goodbye from Kernel\n");
|
||||
}
|
||||
|
||||
PPOOL_HEADER
|
||||
toPoolHeader(PPOOL_HEADER p, PVOID chunkAddr) {
|
||||
p->addr = chunkAddr;
|
||||
__try {
|
||||
p->prevBlockSize = *(USHORT*)((long long int) chunkAddr + 0x0) & 0xff;
|
||||
p->poolIndex = *(USHORT*)((long long int) chunkAddr + 0x0) >> 8;
|
||||
p->blockSize = *(USHORT*)((long long int) chunkAddr + 0x2) & 0xff;
|
||||
p->poolType = *(USHORT*)((long long int) chunkAddr + 0x2) >> 8;
|
||||
p->tag = *(ULONG*)((long long int) chunkAddr + 0x4);
|
||||
}
|
||||
__except(EXCEPTION_EXECUTE_HANDLER) {
|
||||
p->prevBlockSize = 0;
|
||||
p->poolIndex = 0;
|
||||
p->poolType = 0;
|
||||
p->tag = 0;
|
||||
}
|
||||
return p;
|
||||
}
|
||||
|
||||
PPOOL_HEADER
|
||||
tryNextChunk(PPOOL_HEADER p) {
|
||||
return toPoolHeader(p, (PVOID)((long long int)p->addr + CHUNK_SIZE));
|
||||
}
|
||||
|
||||
bool
|
||||
validTag(PPOOL_HEADER p) {
|
||||
// I know the compiler will optimize for me, so meeh :)
|
||||
__try {
|
||||
const char a = (char)(p->tag & 0xff);
|
||||
const char b = (char)((p->tag & 0xff00) >> 8);
|
||||
const char c = (char)((p->tag & 0xff0000) >> 16);
|
||||
const char d = (char)(p->tag >> 24);
|
||||
|
||||
// https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-exallocatepoolwithtag
|
||||
// > Each ASCII character in the tag must be a value in the range 0x20 (space) to 0x7E (tilde)
|
||||
if (!(a >= 0x20 && a <= 0x7e) ||
|
||||
!(b >= 0x20 && b <= 0x7e) ||
|
||||
!(c >= 0x20 && c <= 0x7e) ||
|
||||
!(d >= 0x20 && d <= 0x7e))
|
||||
return false;
|
||||
}
|
||||
__except(EXCEPTION_EXECUTE_HANDLER) {
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
bool
|
||||
checkValidPool(PPOOL_HEADER /* p */) {
|
||||
// https://subs.emis.de/LNI/Proceedings/Proceedings97/GI-Proceedings-97-9.pdf
|
||||
// long long int offsetInPage = (long long int)p->addr % PAGE_SIZE; // OffsetInPage = addr % pagesize
|
||||
// (offsetInPage % CHUNK_SIZE == 0) && // rule 1
|
||||
// (p->blockSize > 0) && // rule 2
|
||||
// (p->blockSize * CHUNK_SIZE + offsetInPage == PAGE_SIZE) && // rule 3
|
||||
// (p->prevBlockSize * CHUNK_SIZE <= offsetInPage) // rule 5
|
||||
return true;
|
||||
}
|
||||
|
||||
VOID
|
||||
printChunkInfo(PPOOL_HEADER p) {
|
||||
DbgPrint("[NAK] :: [+] ==== PoolStart 0x%p ====\n", p->addr);
|
||||
DbgPrint("[NAK] :: [|] \tPreviousSize : 0x%x\n", p->prevBlockSize);
|
||||
DbgPrint("[NAK] :: [|] \tPoolIndex : 0x%x\n", p->poolIndex);
|
||||
DbgPrint("[NAK] :: [|] \tBlockSize : 0x%x\n", p->blockSize * CHUNK_SIZE);
|
||||
DbgPrint("[NAK] :: [|] \tPoolType : 0x%x\n", p->poolType);
|
||||
DbgPrint("[NAK] :: [|] \tPoolTag : 0x%lx [%c%c%c%c]\n", p->tag, p->tag, p->tag >> 8, p->tag >> 16, p->tag >> 24);
|
||||
DbgPrint("[NAK] :: [+] ==== PoolEnd 0x%p ====\n", p->addr);
|
||||
}
|
||||
|
||||
VOID
|
||||
scan(PPOOL_HEADER p, ULONG64 /* nonPagedPoolStart */, ULONG64 /* nonPagedPoolEnd */) {
|
||||
DbgPrint("[NAK] :: [+] Scanning\n");
|
||||
|
||||
// scan by moving up and down 16 bytes?
|
||||
// Or by moving by BlockSize and PreviousBlockSize?
|
||||
|
||||
// Also, when to stop?
|
||||
|
||||
// int i = 0;
|
||||
for (p = tryNextChunk(p);
|
||||
(long long int)p->addr < 0xFFFFFFFFFFFFFFFF;
|
||||
p = tryNextChunk(p))
|
||||
{
|
||||
// if (i++ >= 100000) break;
|
||||
if (p->tag == 0) continue;
|
||||
if (!validTag(p)) continue;
|
||||
|
||||
printChunkInfo(p);
|
||||
|
||||
// if (p->poolIndex == 0) {
|
||||
// DbgPrint("[NAK] :: [+] Seems like we hit the first pool chunk");
|
||||
// break;
|
||||
// }
|
||||
if (p->tag != 'Proc' && p->tag != 'corP')
|
||||
continue;
|
||||
DbgPrint("[NAK] :: [+] HEY EPROCESS POOL CHUNK");
|
||||
break;
|
||||
}
|
||||
|
||||
DbgPrint("[NAK] :: [+] Finish scanning");
|
||||
|
||||
// go up
|
||||
// for (;
|
||||
// KernelBuffer = (PVOID)((long long int)chunk_addr + blockSize);
|
||||
// ) {
|
||||
// }
|
||||
|
||||
// go down
|
||||
// for (;
|
||||
// KernelBuffer = (PVOID)((long long int)chunk_addr - prevBlockSize);
|
||||
// ) {
|
||||
// }
|
||||
}
|
||||
241
KMDF Driver2/Driver.h
Normal file
241
KMDF Driver2/Driver.h
Normal file
@ -0,0 +1,241 @@
|
||||
#ifndef _DRIVER_H
|
||||
#define _DRIVER_H
|
||||
|
||||
typedef struct _POOL_HEADER {
|
||||
PVOID addr;
|
||||
USHORT prevBlockSize;
|
||||
USHORT poolIndex;
|
||||
USHORT blockSize;
|
||||
USHORT poolType;
|
||||
ULONG tag;
|
||||
} POOL_HEADER, *PPOOL_HEADER;
|
||||
|
||||
struct _MI_SYSTEM_NODE_NONPAGED_POOL {
|
||||
char reserved[0x60];
|
||||
PVOID NonPagedPoolFirstVa;
|
||||
PVOID NonPagedPoolLastVa;
|
||||
};
|
||||
|
||||
typedef struct _DBGKD_GET_VERSION64 {
|
||||
USHORT MajorVersion;
|
||||
USHORT MinorVersion;
|
||||
UCHAR ProtocolVersion;
|
||||
UCHAR KdSecondaryVersion;
|
||||
USHORT Flags;
|
||||
USHORT MachineType;
|
||||
UCHAR MaxPacketType;
|
||||
UCHAR MaxStateChange;
|
||||
UCHAR MaxManipulate;
|
||||
UCHAR Simulation;
|
||||
USHORT Unused[1];
|
||||
ULONG64 KernBase;
|
||||
ULONG64 PsLoadedModuleList;
|
||||
ULONG64 DebuggerDataList;
|
||||
} DBGKD_GET_VERSION64, *PDBGKD_GET_VERSION64;
|
||||
|
||||
typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
|
||||
LIST_ENTRY64 List;
|
||||
ULONG OwnerTag;
|
||||
ULONG Size;
|
||||
} DBGKD_DEBUG_DATA_HEADER64, *PDBGKD_DEBUG_DATA_HEADER64;
|
||||
|
||||
typedef struct _KDDEBUGGER_DATA64 {
|
||||
DBGKD_DEBUG_DATA_HEADER64 Header;
|
||||
ULONG64 KernBase;
|
||||
ULONG64 BreakpointWithStatus;
|
||||
ULONG64 SavedContext;
|
||||
USHORT ThCallbackStack;
|
||||
USHORT NextCallback;
|
||||
USHORT FramePointer;
|
||||
USHORT PaeEnabled:1;
|
||||
|
||||
// https://web.archive.org/web/20061110120809/http://www.rootkit.com/newsread.php?newsid=153
|
||||
ULONG64 KiCallUserMode;
|
||||
ULONG64 KeUserCallbackDispatcher;
|
||||
ULONG64 PsLoadedModuleList;
|
||||
ULONG64 PsActiveProcessHead;
|
||||
ULONG64 PspCidTable;
|
||||
|
||||
ULONG64 ExpSystemResourcesList;
|
||||
ULONG64 ExpPagedPoolDescriptor;
|
||||
ULONG64 ExpNumberOfPagedPools;
|
||||
|
||||
ULONG64 KeTimeIncrement;
|
||||
ULONG64 KeBugCheckCallbackListHead;
|
||||
ULONG64 KiBugcheckData;
|
||||
|
||||
ULONG64 IopErrorLogListHead;
|
||||
|
||||
ULONG64 ObpRootDirectoryObject;
|
||||
ULONG64 ObpTypeObjectType;
|
||||
|
||||
ULONG64 MmSystemCacheStart;
|
||||
ULONG64 MmSystemCacheEnd;
|
||||
ULONG64 MmSystemCacheWs;
|
||||
|
||||
ULONG64 MmPfnDatabase;
|
||||
ULONG64 MmSystemPtesStart;
|
||||
ULONG64 MmSystemPtesEnd;
|
||||
ULONG64 MmSubsectionBase;
|
||||
ULONG64 MmNumberOfPagingFiles;
|
||||
|
||||
ULONG64 MmLowestPhysicalPage;
|
||||
ULONG64 MmHighestPhysicalPage;
|
||||
ULONG64 MmNumberOfPhysicalPages;
|
||||
|
||||
ULONG64 MmMaximumNonPagedPoolInBytes;
|
||||
ULONG64 MmNonPagedSystemStart;
|
||||
ULONG64 MmNonPagedPoolStart;
|
||||
ULONG64 MmNonPagedPoolEnd;
|
||||
|
||||
ULONG64 MmPagedPoolStart;
|
||||
ULONG64 MmPagedPoolEnd;
|
||||
ULONG64 MmPagedPoolInformation;
|
||||
ULONG64 MmPageSize;
|
||||
|
||||
ULONG64 MmSizeOfPagedPoolInBytes;
|
||||
|
||||
ULONG64 MmTotalCommitLimit;
|
||||
ULONG64 MmTotalCommittedPages;
|
||||
ULONG64 MmSharedCommit;
|
||||
ULONG64 MmDriverCommit;
|
||||
ULONG64 MmProcessCommit;
|
||||
ULONG64 MmPagedPoolCommit;
|
||||
ULONG64 MmExtendedCommit;
|
||||
|
||||
ULONG64 MmZeroedPageListHead;
|
||||
ULONG64 MmFreePageListHead;
|
||||
ULONG64 MmStandbyPageListHead;
|
||||
ULONG64 MmModifiedPageListHead;
|
||||
ULONG64 MmModifiedNoWritePageListHead;
|
||||
ULONG64 MmAvailablePages;
|
||||
ULONG64 MmResidentAvailablePages;
|
||||
|
||||
ULONG64 PoolTrackTable;
|
||||
ULONG64 NonPagedPoolDescriptor;
|
||||
|
||||
ULONG64 MmHighestUserAddress;
|
||||
ULONG64 MmSystemRangeStart;
|
||||
ULONG64 MmUserProbeAddress;
|
||||
|
||||
ULONG64 KdPrintCircularBuffer;
|
||||
ULONG64 KdPrintCircularBufferEnd;
|
||||
ULONG64 KdPrintWritePointer;
|
||||
ULONG64 KdPrintRolloverCount;
|
||||
|
||||
ULONG64 MmLoadedUserImageList;
|
||||
|
||||
// NT 5.1 Addition
|
||||
|
||||
ULONG64 NtBuildLab;
|
||||
ULONG64 KiNormalSystemCall;
|
||||
|
||||
// NT 5.0 QFE addition
|
||||
|
||||
ULONG64 KiProcessorBlock;
|
||||
ULONG64 MmUnloadedDrivers;
|
||||
ULONG64 MmLastUnloadedDriver;
|
||||
ULONG64 MmTriageActionTaken;
|
||||
ULONG64 MmSpecialPoolTag;
|
||||
ULONG64 KernelVerifier;
|
||||
ULONG64 MmVerifierData;
|
||||
ULONG64 MmAllocatedNonPagedPool;
|
||||
ULONG64 MmPeakCommitment;
|
||||
ULONG64 MmTotalCommitLimitMaximum;
|
||||
ULONG64 CmNtCSDVersion;
|
||||
|
||||
// NT 5.1 Addition
|
||||
|
||||
ULONG64 MmPhysicalMemoryBlock;
|
||||
ULONG64 MmSessionBase;
|
||||
ULONG64 MmSessionSize;
|
||||
ULONG64 MmSystemParentTablePage;
|
||||
|
||||
// Server 2003 addition
|
||||
|
||||
ULONG64 MmVirtualTranslationBase;
|
||||
|
||||
USHORT OffsetKThreadNextProcessor;
|
||||
USHORT OffsetKThreadTeb;
|
||||
USHORT OffsetKThreadKernelStack;
|
||||
USHORT OffsetKThreadInitialStack;
|
||||
|
||||
USHORT OffsetKThreadApcProcess;
|
||||
USHORT OffsetKThreadState;
|
||||
USHORT OffsetKThreadBStore;
|
||||
USHORT OffsetKThreadBStoreLimit;
|
||||
|
||||
USHORT SizeEProcess;
|
||||
USHORT OffsetEprocessPeb;
|
||||
USHORT OffsetEprocessParentCID;
|
||||
USHORT OffsetEprocessDirectoryTableBase;
|
||||
|
||||
USHORT SizePrcb;
|
||||
USHORT OffsetPrcbDpcRoutine;
|
||||
USHORT OffsetPrcbCurrentThread;
|
||||
USHORT OffsetPrcbMhz;
|
||||
|
||||
USHORT OffsetPrcbCpuType;
|
||||
USHORT OffsetPrcbVendorString;
|
||||
USHORT OffsetPrcbProcStateContext;
|
||||
USHORT OffsetPrcbNumber;
|
||||
|
||||
USHORT SizeEThread;
|
||||
|
||||
ULONG64 KdPrintCircularBufferPtr;
|
||||
ULONG64 KdPrintBufferSize;
|
||||
|
||||
ULONG64 KeLoaderBlock;
|
||||
|
||||
USHORT SizePcr;
|
||||
USHORT OffsetPcrSelfPcr;
|
||||
USHORT OffsetPcrCurrentPrcb;
|
||||
USHORT OffsetPcrContainedPrcb;
|
||||
|
||||
USHORT OffsetPcrInitialBStore;
|
||||
USHORT OffsetPcrBStoreLimit;
|
||||
USHORT OffsetPcrInitialStack;
|
||||
USHORT OffsetPcrStackLimit;
|
||||
|
||||
USHORT OffsetPrcbPcrPage;
|
||||
USHORT OffsetPrcbProcStateSpecialReg;
|
||||
USHORT GdtR0Code;
|
||||
USHORT GdtR0Data;
|
||||
|
||||
USHORT GdtR0Pcr;
|
||||
USHORT GdtR3Code;
|
||||
USHORT GdtR3Data;
|
||||
USHORT GdtR3Teb;
|
||||
|
||||
USHORT GdtLdt;
|
||||
USHORT GdtTss;
|
||||
USHORT Gdt64R3CmCode;
|
||||
USHORT Gdt64R3CmTeb;
|
||||
|
||||
ULONG64 IopNumTriageDumpDataBlocks;
|
||||
ULONG64 IopTriageDumpDataBlocks;
|
||||
|
||||
// Longhorn addition
|
||||
|
||||
ULONG64 VfCrashDataBlock;
|
||||
} KDDEBUGGER_DATA64, *PKDDEBUGGER_DATA64;
|
||||
|
||||
PPOOL_HEADER
|
||||
toPoolHeader(PPOOL_HEADER p, PVOID chunkAddr);
|
||||
|
||||
PPOOL_HEADER
|
||||
tryNextChunk(PPOOL_HEADER p);
|
||||
|
||||
bool
|
||||
validTag(PPOOL_HEADER p);
|
||||
|
||||
bool
|
||||
checkValidPool(PPOOL_HEADER p);
|
||||
|
||||
VOID
|
||||
printChunkInfo(PPOOL_HEADER p);
|
||||
|
||||
VOID
|
||||
scan(PPOOL_HEADER p, ULONG64 nonPagedPoolStart, ULONG64 nonPagedPoolEnd);
|
||||
|
||||
#endif
|
||||
163
KMDF Driver2/KMDF Driver2.vcxproj
Normal file
163
KMDF Driver2/KMDF Driver2.vcxproj
Normal file
@ -0,0 +1,163 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{905D3C7D-3EAD-4977-975E-B1FFD3E6FBE4}</ProjectGuid>
|
||||
<TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>KMDF_Driver2</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="KMDFDriver2.inf" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Driver.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Driver.h" />
|
||||
<ClInclude Include="peformat.h" />
|
||||
<ClInclude Include="sioctl.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="kpcr.asm" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
47
KMDF Driver2/KMDF Driver2.vcxproj.filters
Normal file
47
KMDF Driver2/KMDF Driver2.vcxproj.filters
Normal file
@ -0,0 +1,47 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="KMDFDriver2.inf">
|
||||
<Filter>Driver Files</Filter>
|
||||
</Inf>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Driver.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="sioctl.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="Driver.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="peformat.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="kpcr.asm">
|
||||
<Filter>Source Files</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
86
KMDF Driver2/KMDFDriver2.inf
Normal file
86
KMDF Driver2/KMDFDriver2.inf
Normal file
@ -0,0 +1,86 @@
|
||||
;
|
||||
; KMDFDriver2.inf
|
||||
;
|
||||
|
||||
[Version]
|
||||
Signature="$WINDOWS NT$"
|
||||
Class=Sample ; TODO: edit Class
|
||||
ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid
|
||||
Provider=%ManufacturerName%
|
||||
CatalogFile=KMDFDriver2.cat
|
||||
DriverVer= ; TODO: set DriverVer in stampinf property pages
|
||||
|
||||
[DestinationDirs]
|
||||
DefaultDestDir = 12
|
||||
KMDFDriver2_Device_CoInstaller_CopyFiles = 11
|
||||
|
||||
; ================= Class section =====================
|
||||
|
||||
[ClassInstall32]
|
||||
Addreg=SampleClassReg
|
||||
|
||||
[SampleClassReg]
|
||||
HKR,,,0,%ClassName%
|
||||
HKR,,Icon,,-5
|
||||
|
||||
[SourceDisksNames]
|
||||
1 = %DiskName%,,,""
|
||||
|
||||
[SourceDisksFiles]
|
||||
KMDFDriver2.sys = 1,,
|
||||
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames
|
||||
|
||||
;*****************************************
|
||||
; Install Section
|
||||
;*****************************************
|
||||
|
||||
[Manufacturer]
|
||||
%ManufacturerName%=Standard,NT$ARCH$
|
||||
|
||||
[Standard.NT$ARCH$]
|
||||
%KMDFDriver2.DeviceDesc%=KMDFDriver2_Device, Root\KMDFDriver2 ; TODO: edit hw-id
|
||||
|
||||
[KMDFDriver2_Device.NT]
|
||||
CopyFiles=Drivers_Dir
|
||||
|
||||
[Drivers_Dir]
|
||||
KMDFDriver2.sys
|
||||
|
||||
;-------------- Service installation
|
||||
[KMDFDriver2_Device.NT.Services]
|
||||
AddService = KMDFDriver2,%SPSVCINST_ASSOCSERVICE%, KMDFDriver2_Service_Inst
|
||||
|
||||
; -------------- KMDFDriver2 driver install sections
|
||||
[KMDFDriver2_Service_Inst]
|
||||
DisplayName = %KMDFDriver2.SVCDESC%
|
||||
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
|
||||
StartType = 3 ; SERVICE_DEMAND_START
|
||||
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
|
||||
ServiceBinary = %12%\KMDFDriver2.sys
|
||||
|
||||
;
|
||||
;--- KMDFDriver2_Device Coinstaller installation ------
|
||||
;
|
||||
|
||||
[KMDFDriver2_Device.NT.CoInstallers]
|
||||
AddReg=KMDFDriver2_Device_CoInstaller_AddReg
|
||||
CopyFiles=KMDFDriver2_Device_CoInstaller_CopyFiles
|
||||
|
||||
[KMDFDriver2_Device_CoInstaller_AddReg]
|
||||
HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"
|
||||
|
||||
[KMDFDriver2_Device_CoInstaller_CopyFiles]
|
||||
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll
|
||||
|
||||
[KMDFDriver2_Device.NT.Wdf]
|
||||
KmdfService = KMDFDriver2, KMDFDriver2_wdfsect
|
||||
[KMDFDriver2_wdfsect]
|
||||
KmdfLibraryVersion = $KMDFVERSION$
|
||||
|
||||
[Strings]
|
||||
SPSVCINST_ASSOCSERVICE= 0x00000002
|
||||
ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
|
||||
ClassName="Samples" ; TODO: edit ClassName
|
||||
DiskName = "KMDFDriver2 Installation Disk"
|
||||
KMDFDriver2.DeviceDesc = "KMDFDriver2 Device"
|
||||
KMDFDriver2.SVCDESC = "KMDFDriver2 Service"
|
||||
BIN
KMDF Driver2/findglobalkernelvars.png
Normal file
BIN
KMDF Driver2/findglobalkernelvars.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 193 KiB |
11
KMDF Driver2/kpcr.asm
Normal file
11
KMDF Driver2/kpcr.asm
Normal file
@ -0,0 +1,11 @@
|
||||
PUBLIC FindKdVersionBlock
|
||||
.code _text
|
||||
|
||||
|
||||
FindKdVersionBlock PROC PUBLIC
|
||||
mov rax, gs:[108h]
|
||||
ret
|
||||
FindKdVersionBlock ENDP
|
||||
|
||||
|
||||
END
|
||||
53
KMDF Driver2/note.md
Normal file
53
KMDF Driver2/note.md
Normal file
@ -0,0 +1,53 @@
|
||||
Scanning the memory is not working well, we go with Pool tag quick scanning
|
||||
|
||||
[address in kernel space](https://www.codemachine.com/article_x64kvas.html)
|
||||
|
||||
find `MmNonPagedPoolStart` and `MmNonPagedPoolEnd` values in kernel variable.
|
||||
|
||||
These two variables located inside `KdDebuggerDataBlock` of type `_KDDEBUGGER_DATA64`. `KdDebuggerDataBlock` can be found somewhere in `KdVersionBlock`. `KdVersionBlock` is a member of `KPCR`. `KPCR` pointer can be get through `gs:[0x0]`
|
||||
|
||||
> Unfortunately this method stopped working in recent versions of Windows. Recently the KdVersionBlock member is always 0 and does not link to the kernel debugger block.
|
||||
|
||||
[kdbg.c](https://raw.githubusercontent.com/libvmi/libvmi/master/libvmi/os/windows/kdbg.c)
|
||||
|
||||
[KPCR at gs:[0x0]](https://sizzop.github.io/2016/07/07/kernel-hacking-with-hevd-part-3.html)
|
||||
|
||||
[finding kdbg](http://scudette.blogspot.com/2012/11/finding-kernel-debugger-block.html)
|
||||
|
||||
[finding kernel variables](http://moyix.blogspot.com/2008/04/finding-kernel-global-variables-in.html)
|
||||
|
||||
[get kernel shellcode](https://github.com/FuzzySecurity/PSKernel-Primitives/blob/master/Get-KernelShellCode.ps1)
|
||||
|
||||
[www.rootkit.com artifacts](https://github.com/fdiskyou/www.rootkit.com)
|
||||
- GetVarXP.pdf
|
||||
|
||||
[ghidra on fs/gs and kdbg](https://github.com/NationalSecurityAgency/ghidra/issues/1339)
|
||||
|
||||
[big ram kdbg](https://laserkittens.com/big-ram-kernel-debugger-data-block/)
|
||||
|
||||
[](blackstormsecurity.com/docs/NO_HAT_2019.pdf)
|
||||
|
||||
> KPCR -> KdVersionBlock -> `_DBGKD_GET_VERSION64` -> `LIST_ENTRY _KDDEBUGGER_DATA64` (`GetDebuggerData()`) -> `_KDDEBUGGER_DATA64 KdDebuggerDataBlock` -> kernel variables
|
||||
|
||||
|
||||
|
||||
> `_KPCR gs:[0]` -> `_DBGKD_GET_VERSION64 KdVersionBlock` -> `PLIST_ENTRY DebuggerDataList` -> `PLIST_ENTRY Flink` -> `Debugger block`
|
||||
|
||||
This only works with windows x86, x64 Windows KdVersionBlock is always null.
|
||||
|
||||
[KdVersionBlock](https://web.archive.org/web/20061110120809/http://www.rootkit.com/newsread.php?newsid=153)
|
||||
|
||||
```
|
||||
_DBGKD_GET_VERSION64* KdVersionBlock;
|
||||
__asm {
|
||||
mov eax, gs:[0x108]
|
||||
mov KdVersionBlock, eax
|
||||
}
|
||||
PLIST_ENTRY dbglist = KdVersionBlock->DebuggerDataList;
|
||||
DebuggerBlock dbgBlock = (DebuggerBlock)*(dbglist->Flink);
|
||||
```
|
||||
|
||||
|
||||
|
||||
`AuxKlibQueryModuleInformation` to get all `PsActiveProcessModules`
|
||||
[Sample](https://correy.webs.com/articles/computer/c/AuxKlibQueryModuleInformation.C.txt)
|
||||
209
KMDF Driver2/peformat.h
Normal file
209
KMDF Driver2/peformat.h
Normal file
@ -0,0 +1,209 @@
|
||||
// Copyright Ric Vieler, 2006
|
||||
// Support header for hookManager.c
|
||||
// Contains required PE file format data structures used by GetFunctionAddress()
|
||||
|
||||
#ifndef _PE_FORMAT_HEADER_
|
||||
#define _PE_FORMAT_HEADER_
|
||||
|
||||
|
||||
typedef unsigned short WORD;
|
||||
typedef unsigned long DWORD;
|
||||
typedef long LONG;
|
||||
typedef unsigned char BYTE;
|
||||
typedef unsigned long ULONG;
|
||||
typedef unsigned short USHORT;
|
||||
typedef unsigned char UCHAR;
|
||||
typedef unsigned __int64 ULONGLONG;
|
||||
|
||||
|
||||
//
|
||||
// Image Format
|
||||
//
|
||||
|
||||
#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
|
||||
#define IMAGE_NT_SIGNATURE 0x00004550 // PE00
|
||||
|
||||
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
|
||||
WORD e_magic; // Magic number
|
||||
WORD e_cblp; // Bytes on last page of file
|
||||
WORD e_cp; // Pages in file
|
||||
WORD e_crlc; // Relocations
|
||||
WORD e_cparhdr; // Size of header in paragraphs
|
||||
WORD e_minalloc; // Minimum extra paragraphs needed
|
||||
WORD e_maxalloc; // Maximum extra paragraphs needed
|
||||
WORD e_ss; // Initial (relative) SS value
|
||||
WORD e_sp; // Initial SP value
|
||||
WORD e_csum; // Checksum
|
||||
WORD e_ip; // Initial IP value
|
||||
WORD e_cs; // Initial (relative) CS value
|
||||
WORD e_lfarlc; // File address of relocation table
|
||||
WORD e_ovno; // Overlay number
|
||||
WORD e_res[4]; // Reserved words
|
||||
WORD e_oemid; // OEM identifier (for e_oeminfo)
|
||||
WORD e_oeminfo; // OEM information; e_oemid specific
|
||||
WORD e_res2[10]; // Reserved words
|
||||
LONG e_lfanew; // File address of new exe header
|
||||
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
|
||||
|
||||
|
||||
//
|
||||
// File header format.
|
||||
//
|
||||
|
||||
typedef struct _IMAGE_FILE_HEADER {
|
||||
WORD Machine;
|
||||
WORD NumberOfSections;
|
||||
DWORD TimeDateStamp;
|
||||
DWORD PointerToSymbolTable;
|
||||
DWORD NumberOfSymbols;
|
||||
WORD SizeOfOptionalHeader;
|
||||
WORD Characteristics;
|
||||
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
|
||||
|
||||
|
||||
//
|
||||
// Directory format.
|
||||
//
|
||||
|
||||
typedef struct _IMAGE_DATA_DIRECTORY {
|
||||
DWORD VirtualAddress;
|
||||
DWORD Size;
|
||||
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
|
||||
|
||||
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
|
||||
|
||||
//
|
||||
// Optional header format.
|
||||
//
|
||||
|
||||
typedef struct _IMAGE_OPTIONAL_HEADER {
|
||||
//
|
||||
// Standard fields.
|
||||
//
|
||||
|
||||
WORD Magic;
|
||||
BYTE MajorLinkerVersion;
|
||||
BYTE MinorLinkerVersion;
|
||||
DWORD SizeOfCode;
|
||||
DWORD SizeOfInitializedData;
|
||||
DWORD SizeOfUninitializedData;
|
||||
DWORD AddressOfEntryPoint;
|
||||
DWORD BaseOfCode;
|
||||
DWORD BaseOfData;
|
||||
|
||||
//
|
||||
// NT additional fields.
|
||||
//
|
||||
|
||||
DWORD ImageBase;
|
||||
DWORD SectionAlignment;
|
||||
DWORD FileAlignment;
|
||||
WORD MajorOperatingSystemVersion;
|
||||
WORD MinorOperatingSystemVersion;
|
||||
WORD MajorImageVersion;
|
||||
WORD MinorImageVersion;
|
||||
WORD MajorSubsystemVersion;
|
||||
WORD MinorSubsystemVersion;
|
||||
DWORD Win32VersionValue;
|
||||
DWORD SizeOfImage;
|
||||
DWORD SizeOfHeaders;
|
||||
DWORD CheckSum;
|
||||
WORD Subsystem;
|
||||
WORD DllCharacteristics;
|
||||
DWORD SizeOfStackReserve;
|
||||
DWORD SizeOfStackCommit;
|
||||
DWORD SizeOfHeapReserve;
|
||||
DWORD SizeOfHeapCommit;
|
||||
DWORD LoaderFlags;
|
||||
DWORD NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
||||
} IMAGE_OPTIONAL_HEADER, *PIMAGE_OPTIONAL_HEADER;
|
||||
|
||||
typedef struct _IMAGE_OPTIONAL_HEADER64 {
|
||||
WORD Magic;
|
||||
BYTE MajorLinkerVersion;
|
||||
BYTE MinorLinkerVersion;
|
||||
DWORD SizeOfCode;
|
||||
DWORD SizeOfInitializedData;
|
||||
DWORD SizeOfUninitializedData;
|
||||
DWORD AddressOfEntryPoint;
|
||||
DWORD BaseOfCode;
|
||||
ULONGLONG ImageBase;
|
||||
DWORD SectionAlignment;
|
||||
DWORD FileAlignment;
|
||||
WORD MajorOperatingSystemVersion;
|
||||
WORD MinorOperatingSystemVersion;
|
||||
WORD MajorImageVersion;
|
||||
WORD MinorImageVersion;
|
||||
WORD MajorSubsystemVersion;
|
||||
WORD MinorSubsystemVersion;
|
||||
DWORD Win32VersionValue;
|
||||
DWORD SizeOfImage;
|
||||
DWORD SizeOfHeaders;
|
||||
DWORD CheckSum;
|
||||
WORD Subsystem;
|
||||
WORD DllCharacteristics;
|
||||
ULONGLONG SizeOfStackReserve;
|
||||
ULONGLONG SizeOfStackCommit;
|
||||
ULONGLONG SizeOfHeapReserve;
|
||||
ULONGLONG SizeOfHeapCommit;
|
||||
DWORD LoaderFlags;
|
||||
DWORD NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
||||
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
|
||||
|
||||
typedef struct _IMAGE_NT_HEADERS {
|
||||
ULONG Signature;
|
||||
IMAGE_FILE_HEADER FileHeader;
|
||||
IMAGE_OPTIONAL_HEADER OptionalHeader;
|
||||
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
|
||||
|
||||
typedef struct _IMAGE_NT_HEADER64 {
|
||||
DWORD Signature;
|
||||
IMAGE_FILE_HEADER FileHeader;
|
||||
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||||
} IMAGE_NT_HEADER64, *PIMAGE_NT_HEADER64;
|
||||
|
||||
#define IMAGE_SIZEOF_SHORT_NAME 8
|
||||
|
||||
typedef struct _IMAGE_SECTION_HEADER {
|
||||
UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
|
||||
union {
|
||||
ULONG PhysicalAddress;
|
||||
ULONG VirtualSize;
|
||||
} Misc;
|
||||
ULONG VirtualAddress;
|
||||
ULONG SizeOfRawData;
|
||||
ULONG PointerToRawData;
|
||||
ULONG PointerToRelocations;
|
||||
ULONG PointerToLinenumbers;
|
||||
USHORT NumberOfRelocations;
|
||||
USHORT NumberOfLinenumbers;
|
||||
ULONG Characteristics;
|
||||
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
|
||||
|
||||
//
|
||||
// Export Format
|
||||
//
|
||||
|
||||
typedef struct _IMAGE_EXPORT_DIRECTORY {
|
||||
DWORD Characteristics;
|
||||
DWORD TimeDateStamp;
|
||||
WORD MajorVersion;
|
||||
WORD MinorVersion;
|
||||
DWORD Name;
|
||||
DWORD Base;
|
||||
DWORD NumberOfFunctions;
|
||||
DWORD NumberOfNames;
|
||||
DWORD AddressOfFunctions; // RVA from base of image
|
||||
DWORD AddressOfNames; // RVA from base of image
|
||||
DWORD AddressOfNameOrdinals; // RVA from base of image
|
||||
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
|
||||
|
||||
// Directory Entries
|
||||
|
||||
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
47
KMDF Driver2/sioctl.h
Normal file
47
KMDF Driver2/sioctl.h
Normal file
@ -0,0 +1,47 @@
|
||||
/*++
|
||||
|
||||
Copyright (c) 1997 Microsoft Corporation
|
||||
|
||||
Module Name:
|
||||
|
||||
SIOCTL.H
|
||||
|
||||
Abstract:
|
||||
|
||||
|
||||
Defines the IOCTL codes that will be used by this driver. The IOCTL code
|
||||
contains a command identifier, plus other information about the device,
|
||||
the type of access with which the file must have been opened,
|
||||
and the type of buffering.
|
||||
|
||||
Environment:
|
||||
|
||||
Kernel mode only.
|
||||
|
||||
--*/
|
||||
|
||||
//
|
||||
// Device type -- in the "User Defined" range."
|
||||
//
|
||||
#define SIOCTL_TYPE 40000
|
||||
//
|
||||
// The IOCTL function codes from 0x800 to 0xFFF are for customer use.
|
||||
//
|
||||
#define IOCTL_SIOCTL_METHOD_IN_DIRECT \
|
||||
CTL_CODE( SIOCTL_TYPE, 0x900, METHOD_IN_DIRECT, FILE_ANY_ACCESS )
|
||||
|
||||
#define IOCTL_SIOCTL_METHOD_OUT_DIRECT \
|
||||
CTL_CODE( SIOCTL_TYPE, 0x901, METHOD_OUT_DIRECT , FILE_ANY_ACCESS )
|
||||
|
||||
#define IOCTL_SIOCTL_METHOD_BUFFERED \
|
||||
CTL_CODE( SIOCTL_TYPE, 0x902, METHOD_BUFFERED, FILE_ANY_ACCESS )
|
||||
|
||||
#define IOCTL_SIOCTL_METHOD_NEITHER \
|
||||
CTL_CODE( SIOCTL_TYPE, 0x903, METHOD_NEITHER , FILE_ANY_ACCESS )
|
||||
|
||||
|
||||
#define DRIVER_FUNC_INSTALL 0x01
|
||||
#define DRIVER_FUNC_REMOVE 0x02
|
||||
|
||||
#define DRIVER_NAME "poolscanner"
|
||||
|
||||
Loading…
Reference in New Issue
Block a user