mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
Create SioctlDeviceControl.cpp
This commit is contained in:
@@ -0,0 +1,50 @@
|
||||
char GlobalBuffer[4096];
|
||||
|
||||
NTSTATUS SioctlDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
|
||||
{
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
size_t datalen = strlen("This String is from Device Driver@@@@@ !!!") + 1;
|
||||
PIO_STACK_LOCATION irpSP = IoGetCurrentIrpStackLocation(Irp);
|
||||
ULONG inBufLength = irpSP->Parameters.DeviceIoControl.InputBufferLength;
|
||||
ULONG outBufLength = irpSP->Parameters.DeviceIoControl.OutputBufferLength;
|
||||
|
||||
if (!inBufLength || !outBufLength) {
|
||||
status = STATUS_INVALID_PARAMETER;
|
||||
goto End;
|
||||
}
|
||||
|
||||
switch (irpSP->Parameters.DeviceIoControl.IoControlCode) {
|
||||
case 0x9C402408: // CTL_CODE(40000, 0x902, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
||||
{
|
||||
char* inBuf = (char*)Irp->AssociatedIrp.SystemBuffer;
|
||||
char* outBuf = (char*)Irp->AssociatedIrp.SystemBuffer;
|
||||
|
||||
if (strcmp(inBuf, "AA"))
|
||||
{
|
||||
strncpy(GlobalBuffer, inBuf, inBufLength);
|
||||
}
|
||||
else
|
||||
{
|
||||
inBuf = GlobalBuffer;
|
||||
}
|
||||
|
||||
strncpy(outBuf, inBuf, outBufLength);
|
||||
Irp->IoStatus.Information = outBufLength < datalen ? outBufLength : datalen;
|
||||
break;
|
||||
}
|
||||
|
||||
case 0x9C402401: // CTL_CODE(40000, 0x900, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
|
||||
case 0x9C402406: // CTL_CODE(40000, 0x901, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
|
||||
case 0x9C40240F: // CTL_CODE(40000, 0x903, METHOD_NEITHER, FILE_ANY_ACCESS)
|
||||
break;
|
||||
|
||||
default:
|
||||
status = STATUS_INVALID_DEVICE_REQUEST;
|
||||
break;
|
||||
}
|
||||
|
||||
End:
|
||||
Irp->IoStatus.Status = status;
|
||||
IofCompleteRequest(Irp, 0);
|
||||
return status;
|
||||
}
|
||||
Reference in New Issue
Block a user