mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,470 @@
|
||||
Project Path: arc_armvirus_DriverDllFInder_iuavn6wl
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_armvirus_DriverDllFInder_iuavn6wl
|
||||
├── DriverDllFinder.cpp
|
||||
├── DriverDllFinder.sln
|
||||
├── DriverDllFinder.vcxproj
|
||||
├── DriverDllFinder.vcxproj.filters
|
||||
├── DriverDllFinder.vcxproj.user
|
||||
├── README.md
|
||||
└── demo.png
|
||||
|
||||
```
|
||||
|
||||
`DriverDllFinder.cpp`:
|
||||
|
||||
```cpp
|
||||
#include <fstream>
|
||||
#include <iostream>
|
||||
#include <windows.h>
|
||||
#include <vector>
|
||||
#include <filesystem>
|
||||
|
||||
inline std::string get_service_path(SC_HANDLE sc_handle, const std::string& service_name)
|
||||
{
|
||||
SC_HANDLE hService(OpenServiceA(sc_handle, service_name.c_str(), SERVICE_QUERY_CONFIG));
|
||||
if (!hService)
|
||||
return "";
|
||||
|
||||
std::vector<BYTE> buffer;
|
||||
DWORD dwBytesNeeded = sizeof(QUERY_SERVICE_CONFIGA);
|
||||
LPQUERY_SERVICE_CONFIGA pConfig;
|
||||
|
||||
do
|
||||
{
|
||||
buffer.resize(dwBytesNeeded);
|
||||
pConfig = (LPQUERY_SERVICE_CONFIGA)&buffer[0];
|
||||
|
||||
if (QueryServiceConfigA(hService, pConfig, buffer.size(), &dwBytesNeeded))
|
||||
return pConfig->lpBinaryPathName;
|
||||
} while (GetLastError() == ERROR_INSUFFICIENT_BUFFER);
|
||||
|
||||
return "";
|
||||
}
|
||||
|
||||
inline std::string get_driver_name(std::string const& path)
|
||||
{
|
||||
return path.substr(path.find_last_of("/\\") + 1);
|
||||
}
|
||||
|
||||
inline std::vector<std::string>get_active_drivers_array()
|
||||
{
|
||||
SC_HANDLE manager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
|
||||
|
||||
if (manager == INVALID_HANDLE_VALUE)
|
||||
{
|
||||
return {};
|
||||
}
|
||||
|
||||
DWORD bytes_needed;
|
||||
DWORD service_count;
|
||||
|
||||
BOOL status = EnumServicesStatusExA(
|
||||
manager,
|
||||
SC_ENUM_PROCESS_INFO,
|
||||
SERVICE_DRIVER,
|
||||
SERVICE_ACTIVE,
|
||||
0,
|
||||
0,
|
||||
&bytes_needed,
|
||||
&service_count,
|
||||
0,
|
||||
0
|
||||
);
|
||||
|
||||
PBYTE bytes_array = (PBYTE)malloc(bytes_needed);
|
||||
|
||||
status = EnumServicesStatusExA(
|
||||
manager,
|
||||
SC_ENUM_PROCESS_INFO,
|
||||
SERVICE_DRIVER,
|
||||
SERVICE_ACTIVE,
|
||||
bytes_array,
|
||||
bytes_needed,
|
||||
&bytes_needed,
|
||||
&service_count,
|
||||
0,
|
||||
0
|
||||
);
|
||||
|
||||
ENUM_SERVICE_STATUS_PROCESSA* service_array = (ENUM_SERVICE_STATUS_PROCESSA*)bytes_array;
|
||||
|
||||
std::vector<std::string>return_array{};
|
||||
|
||||
for (int i = 0; i < service_count; i++)
|
||||
{
|
||||
std::string driver_path = get_service_path(manager, service_array[i].lpServiceName);
|
||||
std::string driver_name = get_driver_name(driver_path);
|
||||
|
||||
if (!driver_path.empty() && !driver_name.empty())
|
||||
{
|
||||
return_array.push_back(driver_name);
|
||||
}
|
||||
}
|
||||
|
||||
free(bytes_array);
|
||||
|
||||
return return_array;
|
||||
}
|
||||
|
||||
inline std::tuple<std::uintptr_t, std::size_t> get_section(std::uintptr_t local_module_base, std::string section_name)
|
||||
{
|
||||
const auto module_dos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(local_module_base);
|
||||
|
||||
if (module_dos_header->e_magic != IMAGE_DOS_SIGNATURE)
|
||||
{
|
||||
return{};
|
||||
}
|
||||
|
||||
const auto module_nt_headers = reinterpret_cast<PIMAGE_NT_HEADERS>(local_module_base + module_dos_header->e_lfanew);
|
||||
|
||||
if (module_nt_headers->Signature != IMAGE_NT_SIGNATURE)
|
||||
{
|
||||
return{};
|
||||
}
|
||||
|
||||
const auto section_count = module_nt_headers->FileHeader.NumberOfSections;
|
||||
const auto section_headers = IMAGE_FIRST_SECTION(module_nt_headers);
|
||||
|
||||
for (WORD i = 0; i < section_count; ++i)
|
||||
{
|
||||
if (strcmp(reinterpret_cast<char*>(section_headers[i].Name), section_name.c_str()) == 0)
|
||||
{
|
||||
return { section_headers[i].VirtualAddress, section_headers[i].Misc.VirtualSize };
|
||||
}
|
||||
}
|
||||
|
||||
return {};
|
||||
}
|
||||
|
||||
int main(int argument_count, char** argument_array)
|
||||
{
|
||||
if (argument_count != 3)
|
||||
{
|
||||
std::printf("[-] usage: driverdllfinder.exe driver.sys/module.dll .section_name\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (std::filesystem::exists(argument_array[1]) == false)
|
||||
{
|
||||
std::printf("[-] file [%s] does not exist\n", argument_array[1]);
|
||||
return -1;
|
||||
}
|
||||
|
||||
std::ifstream drv_buffer_str(argument_array[1], std::ios::binary);
|
||||
std::vector<std::uint8_t>drv_buffer(std::istreambuf_iterator<char>(drv_buffer_str), {});
|
||||
|
||||
auto dos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(drv_buffer.data());
|
||||
auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(drv_buffer.data() + dos_header->e_lfanew);
|
||||
|
||||
if (nt_header->Signature != IMAGE_NT_SIGNATURE)
|
||||
{
|
||||
std::printf("[-] invalid nt signature of target file\n");
|
||||
|
||||
return -1;
|
||||
}
|
||||
|
||||
bool dll = strcmp(std::filesystem::path(argument_array[1]).extension().string().c_str(), ".dll") == 0;
|
||||
std::uint32_t image_size = nt_header->OptionalHeader.SizeOfImage;
|
||||
|
||||
std::printf("searching for potential [%s] files with section [%s] image size [0x%x]\n", dll == true ? ".dll" : ".sys", argument_array[2], image_size);
|
||||
|
||||
std::vector<std::string>active_drivers = get_active_drivers_array();
|
||||
|
||||
int result_count = 0;
|
||||
|
||||
for (const auto& current_driver : std::filesystem::directory_iterator(dll == true ? "C:\\Windows\\System32" : "C:\\Windows\\System32\\drivers"))
|
||||
{
|
||||
if (strcmp(current_driver.path().extension().string().c_str(), std::filesystem::path(argument_array[1]).extension().string().c_str()) != 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (dll == false)
|
||||
{
|
||||
bool skip = false;
|
||||
for (auto active_driver_it : active_drivers)
|
||||
{
|
||||
if (!_strcmpi(current_driver.path().filename().string().c_str(), active_driver_it.c_str()))
|
||||
{
|
||||
skip = true;
|
||||
}
|
||||
}
|
||||
if (skip == true) continue;
|
||||
}
|
||||
|
||||
std::ifstream input(current_driver.path().string(), std::ios::binary);
|
||||
std::vector<std::uint8_t>file_buffer(std::istreambuf_iterator<char>(input), {});
|
||||
|
||||
auto dos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(file_buffer.data());
|
||||
if (dos_header->e_magic != IMAGE_DOS_SIGNATURE) continue;
|
||||
|
||||
auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(file_buffer.data() + dos_header->e_lfanew);
|
||||
if (nt_header->Signature != IMAGE_NT_SIGNATURE) continue;
|
||||
|
||||
const auto& [section_offset, section_size] = get_section(reinterpret_cast<std::uintptr_t>(file_buffer.data()), argument_array[2]);
|
||||
|
||||
if (image_size < section_size)
|
||||
{
|
||||
std::printf("[+] [%s] [%s] > [0x%x]\n", current_driver.path().string().c_str(), argument_array[2], section_size);
|
||||
result_count++;
|
||||
}
|
||||
}
|
||||
|
||||
std::printf("[+] found [%i] potential results\n", result_count);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`DriverDllFinder.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.31229.75
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DriverDllFinder", "DriverDllFinder.vcxproj", "{41D48970-0805-4BF4-BAAE-F2DD57640BF4}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Debug|x64.Build.0 = Debug|x64
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Debug|x86.Build.0 = Debug|Win32
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Release|x64.ActiveCfg = Release|x64
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Release|x64.Build.0 = Release|x64
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Release|x86.ActiveCfg = Release|Win32
|
||||
{41D48970-0805-4BF4-BAAE-F2DD57640BF4}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {E74D7452-9324-4FF1-A685-F1430E7E6061}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`DriverDllFinder.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{41d48970-0805-4bf4-baae-f2dd57640bf4}</ProjectGuid>
|
||||
<RootNamespace>DriverDllFinder</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<LanguageStandard>stdcpp17</LanguageStandard>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="DriverDllFinder.cpp" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`DriverDllFinder.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="DriverDllFinder.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`DriverDllFinder.vcxproj.user`:
|
||||
|
||||
```user
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# DriverDllFInder
|
||||
search for a driver/dll module that has a wanted section bigger than the size of your image
|
||||
|
||||
## Procedure
|
||||
1. The usermode program enumeratres system32\drivers based on if the wanted file is a module/driver
|
||||
2. If wanted file is a driver it checks if the enumerated driver is loaded in the system and if it is it skips it
|
||||
3. Retrieves size of wanted section of enumerated module/driver
|
||||
4. Checks if size of the section is bigger than the size of image
|
||||
5. Prints information about the enumerated potential module/driver
|
||||
|
||||
|
||||
|
||||
Note: this project was coded in less than an hour so it might have some bugs and the code is a mess
|
||||
|
||||
## Usage
|
||||
```driverdllfinder.exe driver.sys/module.dll .section_name```
|
||||
|
||||
```
|
||||
@@ -0,0 +1,60 @@
|
||||
Project Path: arc_gmh5225_MSSymbolsCollection_bmnnpmyv
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_MSSymbolsCollection_bmnnpmyv
|
||||
├── LICENSE
|
||||
├── README.md
|
||||
└── ntkrnlmp.pdb
|
||||
├── 15B12C74F0E177581B6B27DD4C5022C21
|
||||
│ └── ntkrnlmp.pdb
|
||||
├── 1D9CD02E95982257EA62A9E0F0E00AFD1
|
||||
│ └── ntkrnlmp.pdb
|
||||
├── 3177D31000BA7590DED335936C93E3741
|
||||
│ └── ntkrnlmp.pdb
|
||||
├── 69247313056076BBCB3411FD964287141
|
||||
│ └── ntkrnlmp.pdb
|
||||
├── 733830ECAFA1A3073FFA9CC3A38FE93C1
|
||||
│ └── ntkrnlmp.pdb
|
||||
├── 992A9A48F30EC2C58B01A5934DCE2D9C1
|
||||
│ └── ntkrnlmp.pdb
|
||||
└── CF19666CBAC23B3F2DF46BE6185C46A41
|
||||
└── ntkrnlmp.pdb
|
||||
|
||||
```
|
||||
|
||||
`LICENSE`:
|
||||
|
||||
```
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2022 gmh5225
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# MSSymbolsCollection
|
||||
MS symbols collection
|
||||
|
||||
```
|
||||
Reference in New Issue
Block a user