mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,815 @@
|
||||
Project Path: arc_gmh5225_NMI-EnumNmiCallback_o5t3o4v_
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_NMI-EnumNmiCallback_o5t3o4v_
|
||||
├── EnumNmiCallback
|
||||
│ ├── EnumNmiCallback.inf
|
||||
│ ├── EnumNmiCallback.vcxproj
|
||||
│ ├── EnumNmiCallback.vcxproj.filters
|
||||
│ ├── Imports.h
|
||||
│ ├── Includes.h
|
||||
│ ├── Utils.cpp
|
||||
│ ├── Utils.hpp
|
||||
│ └── entry.cpp
|
||||
└── EnumNmiCallback.sln
|
||||
|
||||
```
|
||||
|
||||
`EnumNmiCallback.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.33027.164
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnumNmiCallback", "EnumNmiCallback\EnumNmiCallback.vcxproj", "{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Release|x64 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}.Debug|x64.Build.0 = Debug|x64
|
||||
{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}.Release|x64.ActiveCfg = Release|x64
|
||||
{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}.Release|x64.Build.0 = Release|x64
|
||||
{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}.Release|x64.Deploy.0 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {5E046053-98BB-49D9-8458-D1729392DB42}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`EnumNmiCallback/EnumNmiCallback.inf`:
|
||||
|
||||
```inf
|
||||
;
|
||||
; EnumNmiCallback.inf
|
||||
;
|
||||
|
||||
[Version]
|
||||
Signature="$WINDOWS NT$"
|
||||
Class=System
|
||||
ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}
|
||||
Provider=%ManufacturerName%
|
||||
DriverVer=
|
||||
CatalogFile=EnumNmiCallback.cat
|
||||
PnpLockDown=1
|
||||
|
||||
[DestinationDirs]
|
||||
DefaultDestDir = 12
|
||||
|
||||
|
||||
[SourceDisksNames]
|
||||
1 = %DiskName%,,,""
|
||||
|
||||
[SourceDisksFiles]
|
||||
|
||||
|
||||
[Manufacturer]
|
||||
%ManufacturerName%=Standard,NT$ARCH$
|
||||
|
||||
[Standard.NT$ARCH$]
|
||||
|
||||
|
||||
[Strings]
|
||||
ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
|
||||
ClassName=""
|
||||
DiskName="EnumNmiCallback Source Disk"
|
||||
|
||||
```
|
||||
|
||||
`EnumNmiCallback/EnumNmiCallback.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{58D69EDA-DEAB-4D67-BEBA-BAE28E3737AF}</ProjectGuid>
|
||||
<TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>EnumNmiCallback</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
<EnableInf2cat>false</EnableInf2cat>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
<EnableInf2cat>false</EnableInf2cat>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="entry.cpp" />
|
||||
<ClCompile Include="Utils.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Imports.h" />
|
||||
<ClInclude Include="Includes.h" />
|
||||
<ClInclude Include="Utils.hpp" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`EnumNmiCallback/EnumNmiCallback.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="entry.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="Utils.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Includes.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="Imports.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="Utils.hpp">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`EnumNmiCallback/Imports.h`:
|
||||
|
||||
```h
|
||||
/*++
|
||||
|
||||
Copyright (c) 2020-2025, Rog. All rights reserved.
|
||||
|
||||
Author:
|
||||
Rog
|
||||
|
||||
License:
|
||||
MIT
|
||||
|
||||
--*/
|
||||
#pragma once
|
||||
|
||||
|
||||
EXTERN_C_START
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwQuerySystemInformation(
|
||||
IN ULONG64 SystemInformationClass,
|
||||
OUT PVOID SystemInformation,
|
||||
IN ULONG SystemInformationLength,
|
||||
OUT PULONG ReturnLength OPTIONAL
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwSetSystemInformation(
|
||||
IN ULONG64 SystemInformationClass,
|
||||
IN PVOID SystemInformation,
|
||||
IN ULONG SystemInformationLength
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwQueryInformationProcess(
|
||||
IN HANDLE ProcessHandle,
|
||||
IN PROCESSINFOCLASS ProcessInformationClass,
|
||||
OUT PVOID ProcessInformation,
|
||||
IN ULONG ProcessInformationLength,
|
||||
IN PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwQueryInformationThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
OUT PVOID ThreadInformation,
|
||||
IN ULONG ThreadInformationLength,
|
||||
OUT PULONG ReturnLength OPTIONAL
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwQueryVirtualMemory(
|
||||
IN HANDLE ProcessHandle,
|
||||
IN PVOID BaseAddress,
|
||||
IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
|
||||
OUT PVOID MemoryInformation,
|
||||
IN SIZE_T MemoryInformationLength,
|
||||
OUT PSIZE_T ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwTerminateThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN NTSTATUS ExitStatus
|
||||
);
|
||||
|
||||
|
||||
|
||||
NTKERNELAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
MmCopyVirtualMemory(
|
||||
IN PEPROCESS FromProcess,
|
||||
IN PVOID FromAddress,
|
||||
IN PEPROCESS ToProcess,
|
||||
OUT PVOID ToAddress,
|
||||
IN SIZE_T BufferSize,
|
||||
IN KPROCESSOR_MODE PreviousMode,
|
||||
OUT PSIZE_T NumberOfBytesCopied
|
||||
);
|
||||
|
||||
NTKERNELAPI
|
||||
PPEB
|
||||
NTAPI
|
||||
PsGetProcessPeb(IN PEPROCESS Process);
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
PsGetThreadTeb(IN PETHREAD Thread);
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
PsGetProcessWow64Process(IN PEPROCESS Process);
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
PsGetCurrentProcessWow64Process();
|
||||
|
||||
NTKERNELAPI
|
||||
BOOLEAN
|
||||
NTAPI
|
||||
KeTestAlertThread(IN KPROCESSOR_MODE AlertMode);
|
||||
|
||||
NTKERNELAPI
|
||||
BOOLEAN
|
||||
NTAPI
|
||||
PsIsProtectedProcess(IN PEPROCESS Process);
|
||||
|
||||
typedef VOID(NTAPI* PKNORMAL_ROUTINE)(
|
||||
PVOID NormalContext,
|
||||
PVOID SystemArgument1,
|
||||
PVOID SystemArgument2
|
||||
);
|
||||
|
||||
typedef VOID(NTAPI* PKKERNEL_ROUTINE)(
|
||||
PRKAPC Apc,
|
||||
PKNORMAL_ROUTINE* NormalRoutine,
|
||||
PVOID* NormalContext,
|
||||
PVOID* SystemArgument1,
|
||||
PVOID* SystemArgument2
|
||||
);
|
||||
|
||||
typedef VOID(NTAPI* PKRUNDOWN_ROUTINE)(PRKAPC Apc);
|
||||
|
||||
NTKERNELAPI
|
||||
BOOLEAN
|
||||
NTAPI
|
||||
KeInsertQueueApc(
|
||||
PKAPC Apc,
|
||||
PVOID SystemArgument1,
|
||||
PVOID SystemArgument2,
|
||||
KPRIORITY Increment
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
PIMAGE_NT_HEADERS
|
||||
NTAPI
|
||||
RtlImageNtHeader(PVOID Base);
|
||||
|
||||
NTSYSAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
RtlImageDirectoryEntryToData(
|
||||
PVOID ImageBase,
|
||||
BOOLEAN MappedAsImage,
|
||||
USHORT DirectoryEntry,
|
||||
PULONG Size
|
||||
);
|
||||
|
||||
NTKERNELAPI
|
||||
VOID
|
||||
FASTCALL
|
||||
ExfUnblockPushLock(
|
||||
IN OUT PEX_PUSH_LOCK PushLock,
|
||||
IN OUT PVOID WaitBlock
|
||||
);
|
||||
|
||||
NTKERNELAPI
|
||||
PCHAR
|
||||
PsGetProcessImageFileName(
|
||||
__in PEPROCESS Process
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtTraceControl(
|
||||
_In_ ULONG FunctionCode,
|
||||
_In_reads_bytes_opt_(InBufferLen) PVOID InBuffer,
|
||||
_In_ ULONG InBufferLen,
|
||||
_Out_writes_bytes_opt_(OutBufferLen) PVOID OutBuffer,
|
||||
_In_ ULONG OutBufferLen,
|
||||
_Out_ PULONG ReturnLength);
|
||||
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
RtlFindExportedRoutineByName(
|
||||
PVOID ImageBase,
|
||||
PCCH RoutineNam);
|
||||
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
PsGetCurrentThreadWin32Thread();
|
||||
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwGetNextThread(
|
||||
__in HANDLE ProcessHandle,
|
||||
__in HANDLE ThreadHandle,
|
||||
__in ACCESS_MASK DesiredAccess,
|
||||
__in ULONG HandleAttributes,
|
||||
__in ULONG Flags,
|
||||
__out PHANDLE NewThreadHandle);
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
PsGetThreadWin32Thread(
|
||||
_In_ PETHREAD Thread
|
||||
);
|
||||
|
||||
NTKERNELAPI
|
||||
VOID
|
||||
PsSetThreadWin32Thread(
|
||||
IN OUT PETHREAD Thread,
|
||||
IN PVOID Win32Thread,
|
||||
IN PVOID PrevWin32Thread
|
||||
);
|
||||
|
||||
NTKERNELAPI
|
||||
VOID
|
||||
MmUnlockPagedPool(
|
||||
IN PVOID Address,
|
||||
IN SIZE_T Size
|
||||
);
|
||||
|
||||
NTKERNELAPI
|
||||
PVOID
|
||||
PsGetProcessSectionBaseAddress(
|
||||
__in PEPROCESS Process
|
||||
);
|
||||
|
||||
EXTERN_C_END
|
||||
```
|
||||
|
||||
`EnumNmiCallback/Includes.h`:
|
||||
|
||||
```h
|
||||
/*++
|
||||
|
||||
Copyright (c) 2020-2025, Rog. All rights reserved.
|
||||
|
||||
Author:
|
||||
Rog
|
||||
|
||||
License:
|
||||
MIT
|
||||
|
||||
--*/
|
||||
#pragma once
|
||||
#include <ntifs.h>
|
||||
#include <ntddk.h>
|
||||
#include <intrin.h>
|
||||
#include <emmintrin.h>
|
||||
//#include <stdint.h>
|
||||
#include <WinDef.h>
|
||||
#include <ntddmou.h>
|
||||
#include <ntimage.h>
|
||||
|
||||
|
||||
```
|
||||
|
||||
`EnumNmiCallback/Utils.cpp`:
|
||||
|
||||
```cpp
|
||||
/*++
|
||||
|
||||
Copyright (c) 2020-2025, Rog. All rights reserved.
|
||||
|
||||
Author:
|
||||
Rog
|
||||
|
||||
License:
|
||||
MIT
|
||||
|
||||
--*/
|
||||
#include "Utils.hpp"
|
||||
#include "Imports.h"
|
||||
#include "Includes.h"
|
||||
|
||||
|
||||
ULONG64 Utils::FindPattern(ULONG64 base, SIZE_T size, PCHAR pattern, PCHAR mask)
|
||||
{
|
||||
const auto patternSize = strlen(mask);
|
||||
|
||||
for (size_t i = 0; i < size - patternSize; i++) {
|
||||
for (size_t j = 0; j < patternSize; j++) {
|
||||
if (mask[j] != '?' && *reinterpret_cast<PBYTE>(base + i + j) != static_cast<BYTE>(pattern[j]))
|
||||
break;
|
||||
|
||||
if (j == patternSize - 1)
|
||||
return (ULONG64)base + i;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
ULONG64 Utils::FindPattern(ULONG64 base, SIZE_T size, PCHAR pattern)
|
||||
{
|
||||
//find pattern utils
|
||||
#define InRange(x, a, b) (x >= a && x <= b)
|
||||
#define GetBits(x) (InRange(x, '0', '9') ? (x - '0') : ((x - 'A') + 0xA))
|
||||
#define GetByte(x) ((BYTE)(GetBits(x[0]) << 4 | GetBits(x[1])))
|
||||
|
||||
//get module range
|
||||
PBYTE ModuleStart = (PBYTE)base;
|
||||
PBYTE ModuleEnd = (PBYTE)(ModuleStart + size);
|
||||
|
||||
//scan pattern main
|
||||
PBYTE FirstMatch = nullptr;
|
||||
const char* CurPatt = pattern;
|
||||
for (; ModuleStart < ModuleEnd; ++ModuleStart)
|
||||
{
|
||||
bool SkipByte = (*CurPatt == '\?');
|
||||
if (SkipByte || *ModuleStart == GetByte(CurPatt)) {
|
||||
if (!FirstMatch) FirstMatch = ModuleStart;
|
||||
SkipByte ? CurPatt += 2 : CurPatt += 3;
|
||||
if (CurPatt[-1] == 0) return (ULONG64)FirstMatch;
|
||||
}
|
||||
|
||||
else if (FirstMatch) {
|
||||
ModuleStart = FirstMatch;
|
||||
FirstMatch = nullptr;
|
||||
CurPatt = pattern;
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
typedef struct _SYSTEM_MODULE
|
||||
{
|
||||
ULONG64 Reserved[2];
|
||||
PVOID Base;
|
||||
ULONG Size;
|
||||
ULONG Flags;
|
||||
USHORT Index;
|
||||
USHORT Unknown;
|
||||
USHORT LoadCount;
|
||||
USHORT ModuleNameOffset;
|
||||
CHAR ImageName[256];
|
||||
} SYSTEM_MODULE, * PSYSTEM_MODULE;
|
||||
typedef struct _SYSTEM_MODULE_INFORMATION
|
||||
{
|
||||
ULONG64 ulModuleCount;
|
||||
SYSTEM_MODULE Modules[1];
|
||||
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
|
||||
|
||||
PVOID Utils::GetModuleBase(PCHAR szModuleName)
|
||||
{
|
||||
PVOID result = 0;
|
||||
ULONG length = 0;
|
||||
|
||||
ZwQuerySystemInformation(0xb, &length, 0, &length); //SystemModuleInformation
|
||||
if (!length) return result;
|
||||
|
||||
const unsigned long tag = 'MEM';
|
||||
PSYSTEM_MODULE_INFORMATION system_modules = (PSYSTEM_MODULE_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, length, tag);
|
||||
if (!system_modules) return result;
|
||||
|
||||
NTSTATUS status = ZwQuerySystemInformation(0xb, system_modules, length, 0);
|
||||
if (NT_SUCCESS(status))
|
||||
{
|
||||
for (size_t i = 0; i < system_modules->ulModuleCount; i++)
|
||||
{
|
||||
char* fileName = (char*)system_modules->Modules[i].ImageName + system_modules->Modules[i].ModuleNameOffset;
|
||||
if (!strcmp(fileName, szModuleName))
|
||||
{
|
||||
result = system_modules->Modules[i].Base;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
ExFreePoolWithTag(system_modules, tag);
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
ULONG64 Utils::GetImageSectionByName(ULONG64 imageBase, PCHAR sectionName, SIZE_T* sizeOut)
|
||||
{
|
||||
if (reinterpret_cast<PIMAGE_DOS_HEADER>(imageBase)->e_magic != 0x5A4D)
|
||||
return 0;
|
||||
|
||||
const auto ntHeader = reinterpret_cast<PIMAGE_NT_HEADERS64>(
|
||||
imageBase + reinterpret_cast<PIMAGE_DOS_HEADER>(imageBase)->e_lfanew);
|
||||
const auto sectionCount = ntHeader->FileHeader.NumberOfSections;
|
||||
|
||||
auto sectionHeader = IMAGE_FIRST_SECTION(ntHeader);
|
||||
for (size_t i = 0; i < sectionCount; ++i, ++sectionHeader) {
|
||||
if (!strcmp(sectionName, reinterpret_cast<const char*>(sectionHeader->Name))) {
|
||||
if (sizeOut)
|
||||
*sizeOut = sectionHeader->Misc.VirtualSize;
|
||||
return imageBase + sectionHeader->VirtualAddress;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
ULONG64 Utils::FindPatternImage(PCHAR module, PCHAR section, PCHAR pattern, PCHAR mask)
|
||||
{
|
||||
uintptr_t ModuleBase = 0;
|
||||
SIZE_T SectionSize = 0;
|
||||
|
||||
ModuleBase = (uintptr_t)GetModuleBase(module);
|
||||
if (!ModuleBase)
|
||||
return 0;
|
||||
|
||||
const auto SectionBase = GetImageSectionByName(ModuleBase, section, &SectionSize);
|
||||
if (!SectionBase)
|
||||
return 0;
|
||||
|
||||
return FindPattern(SectionBase, SectionSize, pattern, mask);
|
||||
}
|
||||
|
||||
ULONG64 Utils::FindPatternImage(PCHAR module, PCHAR section, PCHAR pattern)
|
||||
{
|
||||
uintptr_t ModuleBase = 0;
|
||||
SIZE_T SectionSize = 0;
|
||||
|
||||
ModuleBase = (uintptr_t)GetModuleBase(module);
|
||||
if (!ModuleBase)
|
||||
return 0;
|
||||
|
||||
const auto SectionBase = GetImageSectionByName(ModuleBase, section, &SectionSize);
|
||||
if (!SectionBase)
|
||||
return 0;
|
||||
|
||||
return FindPattern(SectionBase, SectionSize, pattern);
|
||||
}
|
||||
|
||||
VOID Utils::Sleep(ULONG Milliseconds)
|
||||
{
|
||||
LARGE_INTEGER Timeout;
|
||||
Timeout.QuadPart = -1 * 10000LL * (LONGLONG)Milliseconds;
|
||||
KeDelayExecutionThread(KernelMode, FALSE, &Timeout);
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`EnumNmiCallback/Utils.hpp`:
|
||||
|
||||
```hpp
|
||||
/*++
|
||||
|
||||
Copyright (c) 2020-2025, Rog. All rights reserved.
|
||||
|
||||
Author:
|
||||
Rog
|
||||
|
||||
License:
|
||||
MIT
|
||||
|
||||
--*/
|
||||
#pragma once
|
||||
#include <ntifs.h>
|
||||
|
||||
namespace Utils
|
||||
{
|
||||
PVOID GetModuleBase(
|
||||
PCHAR szModuleName);
|
||||
|
||||
ULONG64 GetImageSectionByName(
|
||||
ULONG64 imageBase,
|
||||
PCHAR sectionName,
|
||||
SIZE_T* sizeOut);
|
||||
|
||||
ULONG64 FindPattern(
|
||||
ULONG64 base,
|
||||
SIZE_T size,
|
||||
PCHAR pattern,
|
||||
PCHAR mask);
|
||||
|
||||
ULONG64 FindPatternImage(
|
||||
PCHAR module,
|
||||
PCHAR section,
|
||||
PCHAR pattern,
|
||||
PCHAR mask);
|
||||
|
||||
ULONG64 FindPattern(
|
||||
ULONG64 base,
|
||||
SIZE_T size,
|
||||
PCHAR pattern);
|
||||
|
||||
ULONG64 FindPatternImage(
|
||||
PCHAR module,
|
||||
PCHAR section,
|
||||
PCHAR pattern);
|
||||
|
||||
VOID Sleep(
|
||||
ULONG Milliseconds);
|
||||
};
|
||||
|
||||
```
|
||||
|
||||
`EnumNmiCallback/entry.cpp`:
|
||||
|
||||
```cpp
|
||||
/*++
|
||||
|
||||
Copyright (c) 2020-2025, Rog. All rights reserved.
|
||||
|
||||
Author:
|
||||
Rog
|
||||
|
||||
License:
|
||||
MIT
|
||||
|
||||
--*/
|
||||
#include "Includes.h"
|
||||
#include "Utils.hpp"
|
||||
|
||||
#define tova(loc) *(PLONG)(loc) + ((loc) + 4)
|
||||
|
||||
typedef struct _KNMI_HANDLER_CALLBACK {
|
||||
struct _KNMI_HANDLER_CALLBACK* Next;
|
||||
PNMI_CALLBACK Callback;
|
||||
PVOID Context;
|
||||
PVOID Handle;
|
||||
}KNMI_HANDLER_CALLBACK, * PKNMI_HANDLER_CALLBACK;
|
||||
|
||||
|
||||
//Tested on Windows 10 build 19044
|
||||
BOOLEAN EnumNmiCallback()
|
||||
{
|
||||
UNICODE_STRING uKeDeregisterNmiCallback = RTL_CONSTANT_STRING(L"KeDeregisterNmiCallback");
|
||||
|
||||
ULONG64 KeDeregisterNmiCallbackAddress = (ULONG64)MmGetSystemRoutineAddress(&uKeDeregisterNmiCallback);
|
||||
|
||||
ULONG64 KiDeregisterNmiSxCallback = Utils::FindPattern(KeDeregisterNmiCallbackAddress, 0x20, "48 83 EC 28 E8 ? ? ? ? 48 83 C4 28 C3");
|
||||
|
||||
if (!KiDeregisterNmiSxCallback) {
|
||||
return FALSE;
|
||||
}
|
||||
KiDeregisterNmiSxCallback = tova(KiDeregisterNmiSxCallback + 5);
|
||||
|
||||
//DbgPrint("KiDeregisterNmiSxCallback = %llX\n", KiDeregisterNmiSxCallback);
|
||||
|
||||
ULONG64 KiNmiCallbackListHead = Utils::FindPattern(KiDeregisterNmiSxCallback, 0x200, "48 8D 0D ? ? ? ? 0F B6 F8 48 85 DB 0F 84");
|
||||
|
||||
if (!KiNmiCallbackListHead) {
|
||||
return FALSE;
|
||||
}
|
||||
KiNmiCallbackListHead = tova(KiNmiCallbackListHead + 3);
|
||||
|
||||
DbgPrint("KiNmiCallbackListHead = %llX\n", KiNmiCallbackListHead);
|
||||
|
||||
for (PKNMI_HANDLER_CALLBACK NmiCallbackInfo = PKNMI_HANDLER_CALLBACK(KiNmiCallbackListHead)->Next;
|
||||
NmiCallbackInfo != NULL;
|
||||
NmiCallbackInfo = NmiCallbackInfo->Next) {
|
||||
|
||||
DbgPrint("[NmiCallbackInfo] Enumerating...\n");
|
||||
DbgPrint("[NmiCallbackInfo] Callback = %p\n", NmiCallbackInfo->Callback);
|
||||
DbgPrint("[NmiCallbackInfo] Context = %p\n", NmiCallbackInfo->Context);
|
||||
DbgPrint("[NmiCallbackInfo] Handle = %p\n", NmiCallbackInfo->Handle);
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(RegistryPath);
|
||||
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
|
||||
DriverObject->DriverUnload = [](PDRIVER_OBJECT DriverObject)->VOID {
|
||||
UNREFERENCED_PARAMETER(DriverObject);
|
||||
};
|
||||
|
||||
EnumNmiCallback();
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user