diff --git a/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/DispatchDeviceControl.cpp b/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/DispatchDeviceControl.cpp index 727c764..82fffc1 100644 --- a/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/DispatchDeviceControl.cpp +++ b/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/DispatchDeviceControl.cpp @@ -1,212 +1,212 @@ __int64 __fastcall DispatchDeviceControl(__int64 a1, IRP *a2) { - unsigned int *p_Information; // rdi - _IO_STACK_LOCATION *CurrentStackLocation; // rdx - unsigned int status; // ebx - unsigned int IOCTL_Code; // eax - _IRP *v7; // rcx - unsigned int v8; // er8 - int v9; // edx - unsigned __int32 v10; // eax - unsigned int v11; // eax - CSHORT v12; // ax - unsigned __int8 v13; // al - unsigned int Options; // ebx - _IRP *v15; // r9 - _IRP *v16; // rcx - int v17; // edx - unsigned int Length; // ebp - ULONG *MasterIrp; // r9 - ULONG BusDataByOffset; // eax - int v21; // eax + unsigned int *p_Information; // rdi + _IO_STACK_LOCATION *CurrentStackLocation; // rdx + unsigned int status; // ebx + unsigned int IOCTL_Code; // eax + _IRP *v7; // rcx + unsigned int v8; // er8 + int v9; // edx + unsigned __int32 v10; // eax + unsigned int v11; // eax + CSHORT v12; // ax + unsigned __int8 v13; // al + unsigned int Options; // ebx + _IRP *v15; // r9 + _IRP *v16; // rcx + int v17; // edx + unsigned int Length; // ebp + ULONG *MasterIrp; // r9 + ULONG BusDataByOffset; // eax + int v21; // eax - p_Information = (unsigned int *)&a2->IoStatus.Information; - CurrentStackLocation = a2->Tail.Overlay.CurrentStackLocation; - *(_QWORD *)p_Information = 0i64; - status = 0xC0000002; // STATUS_NOT_IMPLEMENTED - if (!CurrentStackLocation->MajorFunction) + p_Information = (unsigned int *)&a2->IoStatus.Information; + CurrentStackLocation = a2->Tail.Overlay.CurrentStackLocation; + *(_QWORD *)p_Information = 0i64; + status = 0xC0000002; // STATUS_NOT_IMPLEMENTED + if (!CurrentStackLocation->MajorFunction) + { + if (dword_13110 == -1) + goto exit_ok; + v21 = dword_13110 + 1; + goto pre_exit_ok; + } + if (CurrentStackLocation->MajorFunction == 2) + { + if (dword_13110 == -1) + goto exit_ok; + v21 = dword_13110 - 1; + pre_exit_ok: + dword_13110 = v21; + goto exit_ok; + } + if (CurrentStackLocation->MajorFunction != 14) + goto exit; + IOCTL_Code = CurrentStackLocation->Parameters.Read.ByteOffset.LowPart; + if (IOCTL_Code > 0x9C4060D4) + { + if (IOCTL_Code != 0x9C406104) { - if (dword_13110 == -1) - goto exit_ok; - v21 = dword_13110 + 1; - goto pre_exit_ok; - } - if (CurrentStackLocation->MajorFunction == 2) - { - if (dword_13110 == -1) - goto exit_ok; - v21 = dword_13110 - 1; - pre_exit_ok: - dword_13110 = v21; - goto exit_ok; - } - if (CurrentStackLocation->MajorFunction != 14) - goto exit; - IOCTL_Code = CurrentStackLocation->Parameters.Read.ByteOffset.LowPart; - if (IOCTL_Code > 0x9C4060D4) - { - if (IOCTL_Code != 0x9C406104) + switch (IOCTL_Code) + { + case 0x9C406144: + Length = CurrentStackLocation->Parameters.Read.Length; + if (CurrentStackLocation->Parameters.Create.Options != 8) + goto invalid_parameter; + MasterIrp = (ULONG *)a2->AssociatedIrp.MasterIrp; + BusDataByOffset = HalGetBusDataByOffset( + PCIConfiguration, + (unsigned __int8)BYTE1(*MasterIrp), + (32 * (*MasterIrp & 7)) | ((unsigned __int8)*MasterIrp >> 3), + MasterIrp, + MasterIrp[1], + CurrentStackLocation->Parameters.Read.Length); + if (BusDataByOffset) { - switch (IOCTL_Code) + if (Length == 2 || BusDataByOffset != 2) + { + if (Length == BusDataByOffset) { - case 0x9C406144: - Length = CurrentStackLocation->Parameters.Read.Length; - if (CurrentStackLocation->Parameters.Create.Options != 8) - goto invalid_parameter; - MasterIrp = (ULONG *)a2->AssociatedIrp.MasterIrp; - BusDataByOffset = HalGetBusDataByOffset( - PCIConfiguration, - (unsigned __int8)BYTE1(*MasterIrp), - (32 * (*MasterIrp & 7)) | ((unsigned __int8)*MasterIrp >> 3), - MasterIrp, - MasterIrp[1], - CurrentStackLocation->Parameters.Read.Length); - if (BusDataByOffset) - { - if (Length == 2 || BusDataByOffset != 2) - { - if (Length == BusDataByOffset) - { - *p_Information = Length; - goto exit_ok; - } - status = 0xE0000004; - } - else - { - status = 0xE0000002; - } - } - else - { - status = 0xE0000001; - } - *p_Information = 0; - break; - case 0x9C40A0C8: - case 0x9C40A0D8: - case 0x9C40A0DC: - case 0x9C40A0E0: - v16 = a2->AssociatedIrp.MasterIrp; - v17 = *(_DWORD *)&v16->Type; - switch (IOCTL_Code) - { - case 0x9C40A0D8: - __outbyte(v17, *((_BYTE *)&v16->Size + 2)); - goto exit_ok; - case 0x9C40A0DC: - __outword(v17, *(&v16->Size + 1)); - goto exit_ok; - case 0x9C40A0E0: - __outdword(v17, *(_DWORD *)(&v16->Size + 1)); - goto exit_ok; - } - goto invalid_parameter; - case 0x9C40A108: - goto pre_invalid_param; - case 0x9C40A148: - Options = CurrentStackLocation->Parameters.Create.Options; - if (Options < 8) - { - invalid_parameter: - status = 0xC000000D; // STATUS_INVALID_PARAMETER - goto exit; - } - v15 = a2->AssociatedIrp.MasterIrp; - *p_Information = 0; - status = Options - 8 != HalSetBusDataByOffset( - PCIConfiguration, - (unsigned __int8)BYTE1(*(_DWORD *)&v15->Type), - (32 * (*(_DWORD *)&v15->Type & 7)) | ((unsigned __int8)*(_DWORD *)&v15->Type >> 3), - &v15->MdlAddress, - *(_DWORD *)(&v15->Size + 1), - Options - 8) - ? 0xE0000003 - : 0; - break; + *p_Information = Length; + goto exit_ok; } - goto exit; + status = 0xE0000004; + } + else + { + status = 0xE0000002; + } } - v11 = vuln_MmMapIoSpace( - (__int64)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Create.Options, - a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Read.Length, - p_Information); - pre_exit: - status = v11; - goto exit; - } - switch (IOCTL_Code) - { - case 0x9C4060D4: - write_B_W_DW: - v7 = a2->AssociatedIrp.MasterIrp; - v8 = CurrentStackLocation->Parameters.Create.Options; - v9 = *(_DWORD *)&v7->Type; + else + { + status = 0xE0000001; + } + *p_Information = 0; + break; + case 0x9C40A0C8: + case 0x9C40A0D8: + case 0x9C40A0DC: + case 0x9C40A0E0: + v16 = a2->AssociatedIrp.MasterIrp; + v17 = *(_DWORD *)&v16->Type; switch (IOCTL_Code) { - case 0x9C4060CC: - v13 = __inbyte(v9); - LOBYTE(v7->Type) = v13; - goto pre_exit2; - case 0x9C4060D0: - v12 = __inword(v9); - v7->Type = v12; - goto pre_exit2; - case 0x9C4060D4: - v10 = __indword(v9); - *(_DWORD *)&v7->Type = v10; - pre_exit2: - *p_Information = v8; - goto exit_ok; + case 0x9C40A0D8: + __outbyte(v17, *((_BYTE *)&v16->Size + 2)); + goto exit_ok; + case 0x9C40A0DC: + __outword(v17, *(&v16->Size + 1)); + goto exit_ok; + case 0x9C40A0E0: + __outdword(v17, *(_DWORD *)(&v16->Size + 1)); + goto exit_ok; } - pre_invalid_param: - *p_Information = 0; goto invalid_parameter; - case 0x9C402000: - *(_DWORD *)a2->AssociatedIrp.MasterIrp = 16908293; - goto LABEL1; - case 0x9C402004: - *(_DWORD *)a2->AssociatedIrp.MasterIrp = dword_13110; - LABEL1: - *(_QWORD *)p_Information = 4i64; - exit_ok: - status = 0; + case 0x9C40A108: + goto pre_invalid_param; + case 0x9C40A148: + Options = CurrentStackLocation->Parameters.Create.Options; + if (Options < 8) + { + invalid_parameter: + status = 0xC000000D; // STATUS_INVALID_PARAMETER + goto exit; + } + v15 = a2->AssociatedIrp.MasterIrp; + *p_Information = 0; + status = Options - 8 != HalSetBusDataByOffset( + PCIConfiguration, + (unsigned __int8)BYTE1(*(_DWORD *)&v15->Type), + (32 * (*(_DWORD *)&v15->Type & 7)) | ((unsigned __int8)*(_DWORD *)&v15->Type >> 3), + &v15->MdlAddress, + *(_DWORD *)(&v15->Size + 1), + Options - 8) + ? 0xE0000003 + : 0; break; - case 0x9C402084: - v11 = readmsr( - (unsigned int *)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Create.Options, - (unsigned __int64 *)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Read.Length, - p_Information); - goto pre_exit; - case 0x9C402088: - v11 = writemsr( - (__int64)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Create.Options, - (__int64)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Read.Length, - p_Information); - goto pre_exit; - case 0x9C40208C: - v11 = readpmc( - (unsigned int *)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Create.Options, - (unsigned __int64 *)a2->AssociatedIrp.MasterIrp, - CurrentStackLocation->Parameters.Read.Length, - p_Information); - goto pre_exit; - case 0x9C402090: - __halt(); - case 0x9C4060C4: - case 0x9C4060CC: - case 0x9C4060D0: - goto write_B_W_DW; + } + goto exit; } + v11 = MapPhisicalMemory( + (__int64)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Create.Options, + a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Read.Length, + p_Information); + pre_exit: + status = v11; + goto exit; + } + switch (IOCTL_Code) + { + case 0x9C4060D4: + read_write_B_W_DW: + v7 = a2->AssociatedIrp.MasterIrp; + v8 = CurrentStackLocation->Parameters.Create.Options; + v9 = *(_DWORD *)&v7->Type; + switch (IOCTL_Code) + { + case 0x9C4060CC: + v13 = __inbyte(v9); + LOBYTE(v7->Type) = v13; + goto pre_exit2; + case 0x9C4060D0: + v12 = __inword(v9); + v7->Type = v12; + goto pre_exit2; + case 0x9C4060D4: + v10 = __indword(v9); + *(_DWORD *)&v7->Type = v10; + pre_exit2: + *p_Information = v8; + goto exit_ok; + } + pre_invalid_param: + *p_Information = 0; + goto invalid_parameter; + case 0x9C402000: + *(_DWORD *)a2->AssociatedIrp.MasterIrp = 16908293; + goto LABEL1; + case 0x9C402004: + *(_DWORD *)a2->AssociatedIrp.MasterIrp = dword_13110; + LABEL1: + *(_QWORD *)p_Information = 4i64; + exit_ok: + status = 0; + break; + case 0x9C402084: + v11 = readmsr( + (unsigned int *)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Create.Options, + (unsigned __int64 *)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Read.Length, + p_Information); + goto pre_exit; + case 0x9C402088: + v11 = writemsr( + (__int64)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Create.Options, + (__int64)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Read.Length, + p_Information); + goto pre_exit; + case 0x9C40208C: + v11 = readpmc( + (unsigned int *)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Create.Options, + (unsigned __int64 *)a2->AssociatedIrp.MasterIrp, + CurrentStackLocation->Parameters.Read.Length, + p_Information); + goto pre_exit; + case 0x9C402090: + __halt(); + case 0x9C4060C4: + case 0x9C4060CC: + case 0x9C4060D0: + goto read_write_B_W_DW; + } exit: - a2->IoStatus.Status = status; - IofCompleteRequest(a2, 0); - return status; + a2->IoStatus.Status = status; + IofCompleteRequest(a2, 0); + return status; } \ No newline at end of file diff --git a/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/MODAPI.sys.i64 b/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/MODAPI.sys.i64 index bb90021..da89c02 100644 Binary files a/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/MODAPI.sys.i64 and b/windows/x64/kernel/crucial_Ballistix_MOD_Utility_v.2.0.2.5/Reverse Engineering/MODAPI.sys.i64 differ