mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,852 @@
|
||||
Project Path: arc_Lynnette177_Rigel-Driver_71t6s_ca
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_Lynnette177_Rigel-Driver_71t6s_ca
|
||||
├── LICENSE
|
||||
├── README.md
|
||||
├── definitions.h
|
||||
├── driver.filters
|
||||
├── driver.sln
|
||||
├── driver.user
|
||||
├── driver.vcxproj
|
||||
├── driver.vcxproj.user
|
||||
├── hook.cpp
|
||||
├── hook.h
|
||||
├── main.cpp
|
||||
├── memory.cpp
|
||||
└── memory.h
|
||||
|
||||
```
|
||||
|
||||
`LICENSE`:
|
||||
|
||||
```
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2024 Lynnette
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# Rigel-Driver
|
||||
Kernel Driver used in Rigel to do RPM and WPM
|
||||
You can map it with KDU or other mappers
|
||||
Hooking dxgkrnl.sys.
|
||||
Modified from a project Ive seen on Github.But I cant find it now
|
||||
# Basic Functions:
|
||||
get_system_module_base
|
||||
get_system_module_export
|
||||
write_memory
|
||||
write_to_read_only_memory
|
||||
get_module_base_x64
|
||||
read_kernel_memory
|
||||
write_kernel_memory
|
||||
|
||||
# For Learning Purpose Only
|
||||
Use at your own risk.
|
||||
|
||||
# Buy me a cup of coffee/支持我
|
||||
BTC : 16eXZ8zzSgtepvuNHa6xQCgnXXSYgu87tC
|
||||
|
||||
```
|
||||
|
||||
`definitions.h`:
|
||||
|
||||
```h
|
||||
#include <ntdef.h>
|
||||
#include <ntifs.h>
|
||||
#include <ntddk.h>
|
||||
#include <windef.h>
|
||||
#include <ntstrsafe.h>
|
||||
#include <wdm.h>
|
||||
#pragma comment(lib, "ntoskrnl.lib")
|
||||
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS
|
||||
{
|
||||
SystemBasicInformation,
|
||||
SystemProcessorInformation,
|
||||
SystemPerformanceInformation,
|
||||
SystemTimeOfDayInformation,
|
||||
SystemPathInformation,
|
||||
SystemProcessInformation,
|
||||
SystemCallCountInformation,
|
||||
SystemDeviceInformation,
|
||||
SystemProcessorPerformanceInformation,
|
||||
SystemFlagsInformation,
|
||||
SystemCallTimeInformation,
|
||||
SystemModuleInformation = 0x0B
|
||||
} SYSTEM_INFORMATION_CLASS,
|
||||
* PSYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
||||
{
|
||||
HANDLE Section;
|
||||
PVOID MappedBase;
|
||||
PVOID ImageBase;
|
||||
ULONG ImageSize;
|
||||
ULONG Flags;
|
||||
USHORT LoadOrderIndex;
|
||||
USHORT InitOrderIndex;
|
||||
USHORT LoadCount;
|
||||
USHORT OffsetToFileName;
|
||||
UCHAR FullPathName[256];
|
||||
} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
|
||||
|
||||
typedef struct _RTL_PROCESS_MODULES
|
||||
{
|
||||
ULONG NumberOfModules;
|
||||
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
||||
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
|
||||
|
||||
typedef struct _PEB_LDR_DATA {
|
||||
ULONG Length;
|
||||
BOOLEAN Initialized;
|
||||
PVOID SsHandle;
|
||||
LIST_ENTRY ModuleListLoadOrder;
|
||||
LIST_ENTRY ModuleListMemoryOrder;
|
||||
LIST_ENTRY ModuleListInitOrder;
|
||||
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
LIST_ENTRY InLoadOrderModuleList;
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage; // in bytes
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags; // LDR_*
|
||||
USHORT LoadCount;
|
||||
USHORT TlsIndex;
|
||||
LIST_ENTRY HashLinks;
|
||||
PVOID SectionPointer;
|
||||
ULONG CheckSum;
|
||||
ULONG TimeDateStamp;
|
||||
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
typedef struct _RTL_USER_PROCESS_PARAMETERS {
|
||||
BYTE Reserved1[16];
|
||||
PVOID Reserved2[10];
|
||||
UNICODE_STRING ImagePathName;
|
||||
UNICODE_STRING CommandLine;
|
||||
} RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;
|
||||
|
||||
typedef void(__stdcall* PPS_POST_PROCESS_INIT_ROUTINE)(void); // not exported
|
||||
|
||||
typedef struct _PEB {
|
||||
BYTE Reserved1[2];
|
||||
BYTE BeingDebugged;
|
||||
BYTE Reserved2[1];
|
||||
PVOID Reserved3[2];
|
||||
PPEB_LDR_DATA Ldr;
|
||||
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
||||
PVOID Reserved4[3];
|
||||
PVOID AtlThunkSListPtr;
|
||||
PVOID Reserved5;
|
||||
ULONG Reserved6;
|
||||
PVOID Reserved7;
|
||||
ULONG Reserved8;
|
||||
ULONG AtlThunkSListPtr32;
|
||||
PVOID Reserved9[45];
|
||||
BYTE Reserved10[96];
|
||||
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
|
||||
BYTE Reserved11[128];
|
||||
PVOID Reserved12[1];
|
||||
ULONG SessionId;
|
||||
} PEB, * PPEB;
|
||||
|
||||
extern "C" __declspec(dllimport)
|
||||
NTSTATUS NTAPI ZwProtectVirtualMemory(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID * BaseAddress,
|
||||
PULONG ProtectSize,
|
||||
ULONG NewProtect,
|
||||
PULONG OldProtect
|
||||
);
|
||||
|
||||
extern "C" NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
RtlFindExportedRoutineByName(
|
||||
_In_ PVOID ImageBase,
|
||||
_In_ PCCH RoutineNam
|
||||
);
|
||||
|
||||
extern "C" NTSTATUS ZwQuerySystemInformation(ULONG InfoClass, PVOID Buffer, ULONG Length, PULONG ReturnLength);
|
||||
|
||||
extern "C" NTKERNELAPI
|
||||
PPEB
|
||||
PsGetProcessPeb(
|
||||
IN PEPROCESS Process
|
||||
);
|
||||
|
||||
extern "C" NTSTATUS NTAPI MmCopyVirtualMemory
|
||||
(
|
||||
PEPROCESS SourceProcess,
|
||||
PVOID SourceAddress,
|
||||
PEPROCESS TargetProcess,
|
||||
PVOID TargetAddress,
|
||||
SIZE_T BufferSize,
|
||||
KPROCESSOR_MODE PreviousMode,
|
||||
PSIZE_T ReturnSize
|
||||
);
|
||||
```
|
||||
|
||||
`driver.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="KernelCheatYT.inf">
|
||||
<Filter>Driver Files</Filter>
|
||||
</Inf>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="definitions.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="memory.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="hook.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="memory.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="hook.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`driver.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.1.32228.430
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "driver-detected", "driver.vcxproj", "{59AD331E-D3D4-46C4-8759-4A02AB42353A}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM = Debug|ARM
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|ARM = Release|ARM
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM.ActiveCfg = Debug|ARM
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM.Build.0 = Debug|ARM
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x64.Build.0 = Debug|x64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Debug|x86.Build.0 = Debug|Win32
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM.ActiveCfg = Release|ARM
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM.Build.0 = Release|ARM
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x64.ActiveCfg = Release|x64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x64.Build.0 = Release|x64
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x86.ActiveCfg = Release|Win32
|
||||
{59AD331E-D3D4-46C4-8759-4A02AB42353A}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {8F8D07B1-1C54-4914-80FE-4F42A8C79116}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`driver.user`:
|
||||
|
||||
```user
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<SignMode>Off</SignMode>
|
||||
</PropertyGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`driver.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{59AD331E-D3D4-46C4-8759-4A02AB42353A}</ProjectGuid>
|
||||
<TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>KernelCheatYT</RootNamespace>
|
||||
<ProjectName>RigelDriver</ProjectName>
|
||||
<WindowsTargetPlatformVersion>10.0.22621.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
<EnableInf2cat>false</EnableInf2cat>
|
||||
<OutDir>$(SolutionDir)\build\</OutDir>
|
||||
<IntDir>$(SolutionDir)\build\intermediate\driver\</IntDir>
|
||||
<TargetName>$(TargetName.Replace(' ',''))</TargetName>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
<LanguageStandard>stdcpp17</LanguageStandard>
|
||||
<LanguageStandard_C>stdc17</LanguageStandard_C>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="definitions.h" />
|
||||
<ClInclude Include="hook.h" />
|
||||
<ClInclude Include="memory.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="hook.cpp" />
|
||||
<ClCompile Include="main.cpp" />
|
||||
<ClCompile Include="memory.cpp" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`driver.vcxproj.user`:
|
||||
|
||||
```user
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<SignMode>Off</SignMode>
|
||||
</PropertyGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`hook.cpp`:
|
||||
|
||||
```cpp
|
||||
#include "hook.h"
|
||||
|
||||
bool nullhook::call_kernel_function(void* kernel_function_address)
|
||||
{
|
||||
if (!kernel_function_address)
|
||||
return false;
|
||||
|
||||
PVOID* function = reinterpret_cast<PVOID*>(get_system_module_export("\\SystemRoot\\System32\\drivers\\dxgkrnl.sys", "NtGdiDdDDINetDispGetNextChunkInfo"));
|
||||
|
||||
if (!function)
|
||||
return false;
|
||||
|
||||
BYTE orig[] = { 0xCF, 0xDF, 0xFF, 0xFD, 0xFC, 0xCD, 0xDC, 0xCC, 0xDD, 0xFE, 0xEF, 0xEE };
|
||||
|
||||
BYTE shell_code[] = { 0x48, 0xB8 }; // mov rax, xxx
|
||||
BYTE shell_code_end[] = { 0xFF, 0xE0 }; //jmp rax
|
||||
|
||||
RtlSecureZeroMemory(&orig, sizeof(orig));
|
||||
memcpy((PVOID)((ULONG_PTR)orig), &shell_code, sizeof(shell_code));
|
||||
uintptr_t hook_address = reinterpret_cast<uintptr_t>(kernel_function_address);
|
||||
memcpy((PVOID)((ULONG_PTR)orig + sizeof(shell_code)), &hook_address, sizeof(void*));
|
||||
memcpy((PVOID)((ULONG_PTR)orig + sizeof(shell_code) + sizeof(void*)), &shell_code_end, sizeof(shell_code_end));
|
||||
|
||||
write_to_read_only_memory(function, &orig, sizeof(orig));
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
NTSTATUS nullhook::hook_handler(PVOID called_param)
|
||||
{
|
||||
NULL_MEMORY* instructions = (NULL_MEMORY*)called_param;
|
||||
|
||||
if (instructions->req_base != FALSE)
|
||||
{
|
||||
ANSI_STRING AS;
|
||||
UNICODE_STRING ModuleName;
|
||||
|
||||
RtlInitAnsiString(&AS, instructions->module_name);
|
||||
RtlAnsiStringToUnicodeString(&ModuleName, &AS, TRUE);
|
||||
|
||||
PEPROCESS process;
|
||||
PsLookupProcessByProcessId((HANDLE)instructions->pid, &process);
|
||||
ULONG64 base_address64 = NULL;
|
||||
base_address64 = get_module_base_x64(process, ModuleName);
|
||||
instructions->base_address = base_address64;
|
||||
RtlFreeUnicodeString(&ModuleName);
|
||||
}
|
||||
|
||||
if (instructions->write != FALSE)
|
||||
{
|
||||
if (instructions->address < 0x7FFFFFFFFFFF && instructions->address > 0)
|
||||
{
|
||||
PVOID kernelBuff = ExAllocatePool(NonPagedPool, instructions->size);
|
||||
|
||||
if (!kernelBuff)
|
||||
{
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
if (!memcpy(kernelBuff, instructions->buffer_address, instructions->size))
|
||||
{
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
PEPROCESS process;
|
||||
PsLookupProcessByProcessId((HANDLE)instructions->pid, &process);
|
||||
write_kernel_memory((HANDLE)instructions->pid, instructions->address, kernelBuff, instructions->size);
|
||||
ExFreePool(kernelBuff);
|
||||
}
|
||||
}
|
||||
|
||||
if (instructions->read != FALSE)
|
||||
{
|
||||
if (instructions->address < 0x7FFFFFFFFFFF && instructions->address > 0)
|
||||
{
|
||||
read_kernel_memory((HANDLE)instructions->pid, instructions->address, instructions->output, instructions->size);
|
||||
}
|
||||
}
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
```
|
||||
|
||||
`hook.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
#include "memory.h"
|
||||
|
||||
namespace nullhook
|
||||
{
|
||||
bool call_kernel_function(void* kernel_function_address);
|
||||
NTSTATUS hook_handler(PVOID called_param);
|
||||
}
|
||||
```
|
||||
|
||||
`main.cpp`:
|
||||
|
||||
```cpp
|
||||
#include "hook.h"
|
||||
|
||||
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT driver_object, PUNICODE_STRING reg_path)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(driver_object);
|
||||
UNREFERENCED_PARAMETER(reg_path);
|
||||
|
||||
nullhook::call_kernel_function(&nullhook::hook_handler);
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
```
|
||||
|
||||
`memory.cpp`:
|
||||
|
||||
```cpp
|
||||
#include "memory.h"
|
||||
|
||||
PVOID get_system_module_base(const char* module_name)
|
||||
{
|
||||
ULONG bytes = 0;
|
||||
NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, NULL, bytes, &bytes);
|
||||
|
||||
if (!bytes)
|
||||
return NULL;
|
||||
|
||||
PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x4e554c4c);
|
||||
|
||||
status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes);
|
||||
|
||||
if (!NT_SUCCESS(status))
|
||||
return NULL;
|
||||
|
||||
|
||||
|
||||
PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;
|
||||
PVOID module_base = 0, module_size = 0;
|
||||
|
||||
for (ULONG i = 0; i < modules->NumberOfModules; i++)
|
||||
{
|
||||
if (strcmp((char*)module[i].FullPathName, module_name) == NULL)
|
||||
{
|
||||
module_base = module[i].ImageBase;
|
||||
module_size = (PVOID)module[i].ImageSize;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (modules)
|
||||
ExFreePoolWithTag(modules, NULL);
|
||||
|
||||
if (module_base <= NULL)
|
||||
return NULL;
|
||||
|
||||
return module_base;
|
||||
}
|
||||
|
||||
PVOID get_system_module_export(const char* module_name, LPCSTR routine_name)
|
||||
{
|
||||
PVOID lpModule = get_system_module_base(module_name);
|
||||
|
||||
if (!lpModule)
|
||||
return NULL;
|
||||
|
||||
return RtlFindExportedRoutineByName(lpModule, routine_name);
|
||||
}
|
||||
|
||||
bool write_memory(void* address, void* buffer, size_t size)
|
||||
{
|
||||
if (!RtlCopyMemory(address, buffer, size))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
bool write_to_read_only_memory(void* address, void* buffer, size_t size)
|
||||
{
|
||||
PMDL Mdl = IoAllocateMdl(address, size, FALSE, FALSE, NULL);
|
||||
|
||||
if (!Mdl)
|
||||
return false;
|
||||
|
||||
MmProbeAndLockPages(Mdl, KernelMode, IoReadAccess);
|
||||
PVOID Mapping = MmMapLockedPagesSpecifyCache(Mdl, KernelMode, MmNonCached, NULL, FALSE, NormalPagePriority);
|
||||
MmProtectMdlSystemAddress(Mdl, PAGE_READWRITE);
|
||||
|
||||
write_memory(Mapping, buffer, size);
|
||||
|
||||
MmUnmapLockedPages(Mapping, Mdl);
|
||||
MmUnlockPages(Mdl);
|
||||
IoFreeMdl(Mdl);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
ULONG64 get_module_base_x64(PEPROCESS proc, UNICODE_STRING module_name)
|
||||
{
|
||||
PPEB pPeb = PsGetProcessPeb(proc);
|
||||
|
||||
if (!pPeb)
|
||||
{
|
||||
return NULL;
|
||||
}
|
||||
|
||||
KAPC_STATE state;
|
||||
|
||||
KeStackAttachProcess(proc, &state);
|
||||
|
||||
PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)pPeb->Ldr;
|
||||
|
||||
if (!pLdr)
|
||||
{
|
||||
KeUnstackDetachProcess(&state);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
for (PLIST_ENTRY list = (PLIST_ENTRY)pLdr->ModuleListLoadOrder.Flink; list != &pLdr->ModuleListLoadOrder; list = (PLIST_ENTRY)list->Flink)
|
||||
{
|
||||
PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(list, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
|
||||
|
||||
if (RtlCompareUnicodeString(&pEntry->BaseDllName, &module_name, TRUE) == NULL)
|
||||
{
|
||||
ULONG64 baseAddr = (ULONG64)pEntry->DllBase;
|
||||
KeUnstackDetachProcess(&state);
|
||||
return baseAddr;
|
||||
}
|
||||
}
|
||||
|
||||
KeUnstackDetachProcess(&state);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
bool read_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size)
|
||||
{
|
||||
if (!address || !buffer || !size)
|
||||
return false;
|
||||
|
||||
SIZE_T bytes = 0;
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
PEPROCESS process;
|
||||
PsLookupProcessByProcessId((HANDLE)pid, &process);
|
||||
|
||||
status = MmCopyVirtualMemory(process, (void*)address, (PEPROCESS)PsGetCurrentProcess(), (void*)buffer, size, KernelMode, &bytes);
|
||||
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
bool write_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size)
|
||||
{
|
||||
if (!address || !buffer || !size)
|
||||
return false;
|
||||
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
PEPROCESS process;
|
||||
PsLookupProcessByProcessId((HANDLE)pid, &process);
|
||||
|
||||
KAPC_STATE state;
|
||||
KeStackAttachProcess((PEPROCESS)process, &state);
|
||||
|
||||
MEMORY_BASIC_INFORMATION info;
|
||||
|
||||
status = ZwQueryVirtualMemory(ZwCurrentProcess(), (PVOID)address, MemoryBasicInformation, &info, sizeof(info), NULL);
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
KeUnstackDetachProcess(&state);
|
||||
return false;
|
||||
}
|
||||
|
||||
if (((uintptr_t)info.BaseAddress + info.RegionSize) < (address + size))
|
||||
{
|
||||
KeUnstackDetachProcess(&state);
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!(info.State & MEM_COMMIT) || (info.Protect & (PAGE_GUARD | PAGE_NOACCESS)))
|
||||
{
|
||||
KeUnstackDetachProcess(&state);
|
||||
return false;
|
||||
}
|
||||
|
||||
if ((info.Protect & PAGE_EXECUTE_READWRITE) || (info.Protect & PAGE_EXECUTE_WRITECOPY)
|
||||
|| (info.Protect & PAGE_READWRITE) || (info.Protect & PAGE_WRITECOPY))
|
||||
{
|
||||
RtlCopyMemory((void*)address, buffer, size);
|
||||
}
|
||||
KeUnstackDetachProcess(&state);
|
||||
return true;
|
||||
}
|
||||
```
|
||||
|
||||
`memory.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
#include "definitions.h"
|
||||
|
||||
PVOID get_system_module_base(const char* module_name);
|
||||
PVOID get_system_module_export(const char* module_name, LPCSTR routine_name);
|
||||
bool write_memory(void* address, void* buffer, size_t size);
|
||||
bool write_to_read_only_memory(void* address, void* buffer, size_t size);
|
||||
ULONG64 get_module_base_x64(PEPROCESS proc, UNICODE_STRING module_name);
|
||||
bool read_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size);
|
||||
bool write_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size);
|
||||
|
||||
typedef struct _NULL_MEMORY
|
||||
{
|
||||
void* buffer_address;
|
||||
UINT_PTR address;
|
||||
ULONGLONG size;
|
||||
ULONG pid;
|
||||
BOOLEAN write;
|
||||
BOOLEAN read;
|
||||
BOOLEAN req_base;
|
||||
void* output;
|
||||
const char* module_name;
|
||||
ULONG64 base_address;
|
||||
}NULL_MEMORY;
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user