admin/gmh5225-awesome-game-security
1
0
Fork 0
mirror of https://github.com/gmh5225/awesome-game-security synced 2026-06-21 13:56:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

archive: add 5 repo prompt(s) [skip ci]

Browse Source
This commit is contained in:
github-actions[bot]
2026-02-24 13:58:07 +00:00
parent 93857664be
commit b9be4432d4
3 changed files with 9569 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
archive/gmh5225/cheat-attack-thread-slemu.txt
+513
View File
@@ -0,0 +1,513 @@
Project Path: arc_gmh5225_cheat-attack-thread-slemu_rgp01uhf
Source Tree:
```txt
arc_gmh5225_cheat-attack-thread-slemu_rgp01uhf
├── README.md
├── bytes.h
├── emulator.h
├── entry.cpp
├── imports.h
├── process.h
├── slemu.vcxproj
├── slemu.vcxproj.filters
├── slemu.vcxproj.user
├── thread.h
└── utils.h
```
`README.md`:
```md
# slemu
A simple SCP-SL Anti-cheat usermode emulator
https://www.unknowncheats.me/forum/anti-cheat-bypass/507676-scp-sl-anti-cheat-emulator.html#post3481160
```
`bytes.h`:
```h
namespace bytes
{
unsigned char loop[] =
{
0x48, 0x83, 0xEC, 0x28,
0xB9, 0x64, 0x00, 0x00, 0x00,
0xFF, 0x15, 0x02, 0x00, 0x00, 0x00, 0xEB, 0x08,
0xA0, 0xAD, 0x3B, 0x74, 0xFB, 0x7F, 0x00, 0x00,
0xEB, 0xEE
};
}
```
`emulator.h`:
```h
namespace emulator
{
auto emulate( const wchar_t* process_name, const wchar_t* module_name ) -> bool
{
const auto process = utils::get_process( process_name );
if ( !process )
{
dbg( "%S not found", process_name );
return false;
}
dbg( "%S: %i", process_name, process->get_id( ) );
const auto module = process->get_module_entry( module_name );
if ( !module.modBaseAddr )
{
dbg( "%S not found", module_name );
return false;
}
dbg( "%S base: 0x%llx", module_name, module.modBaseAddr );
for ( auto &thread : process->get_threads( ) )
{
const auto win32_start_address = thread->get_win32_start_address( );
if ( win32_start_address > reinterpret_cast< std::uintptr_t > ( module.modBaseAddr ) + module.modBaseSize ||
win32_start_address < reinterpret_cast< std::uintptr_t > ( module.modBaseAddr ) )
{
continue;
}
dbg( "%S thread found 0x%llx", module_name, win32_start_address );
const auto local_kernel_base = utils::get_module( L"KERNELBASE.dll" );
const auto local_sleep_ex = reinterpret_cast< std::uintptr_t > ( GetProcAddress( local_kernel_base, "SleepEx" ) );
const auto remote_kernel_base = process->get_module_entry( L"KERNELBASE.dll" ).modBaseAddr;
dbg( "%S's kernelbase.dll: 0x%llx", process_name, remote_kernel_base );
const auto remote_sleep_ex = remote_kernel_base + local_sleep_ex - reinterpret_cast< std::uintptr_t > ( local_kernel_base );
*reinterpret_cast< void ** >( &bytes::loop[17] ) = remote_sleep_ex;
dbg( "prepared shellcode [SleepEx: 0x%llx]", remote_sleep_ex );
const auto shellcode = process->allocate( sizeof( bytes::loop ), PAGE_EXECUTE_READWRITE );
process->write( shellcode, bytes::loop, sizeof( bytes::loop ) );
dbg( "shellcode created: 0x%llx", shellcode );
auto ctx = thread->get_ctx( );
ctx.Rip = shellcode;
thread->set_ctx( ctx );
dbg( "shellcode executed" );
thread->close( );
dbg( "thread trapped" );
}
process->close( );
return true;
}
}
```
`entry.cpp`:
```cpp
#include "imports.h"
auto main( ) -> int
{
dbg ( "emuation status: %d", emulator::emulate( L"SCPSL.exe", L"SL-AC.dll" ) );
return std::cin.get( );
}
```
`imports.h`:
```h
#include <windows.h>
#include <tlhelp32.h>
#include <string>
#include <vector>
#include <thread>
#include <iostream>
#include <winternl.h>
#include <windef.h>
#define dbg(content, ...) printf( "[+] " content "\n", __VA_ARGS__)
#include "thread.h"
#include "process.h"
#include "utils.h"
#include "bytes.h"
#include "emulator.h"
```
`process.h`:
```h
class c_process
{
public:
auto get_id( ) -> std::uint32_t
{
return GetProcessId( reinterpret_cast< HANDLE >( this ) );
}
auto get_module_entry( const wchar_t* name ) -> MODULEENTRY32
{
const auto snapshot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, this->get_id( ) );
MODULEENTRY32 module_entry = { 0 };
module_entry.dwSize = sizeof( module_entry );
Module32First( snapshot, &module_entry );
do
{
if ( wcscmp( module_entry.szModule, name ) )
{
continue;
}
CloseHandle( snapshot );
return module_entry;
} while ( Module32Next( snapshot, &module_entry ) );
CloseHandle( snapshot );
return { 0 };
}
auto close( ) -> bool
{
return CloseHandle( reinterpret_cast< HANDLE >( this ) );
}
auto get_threads( ) -> std::vector<c_thread *>
{
std::vector<c_thread *> threads;
threads.clear( );
THREADENTRY32 thread_entry;
thread_entry.dwSize = sizeof( thread_entry );
const auto snapshot = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
Thread32First( snapshot, &thread_entry );
do
{
if ( thread_entry.dwSize < FIELD_OFFSET( THREADENTRY32, th32OwnerProcessID ) + sizeof( thread_entry.th32OwnerProcessID ) || GetProcessId(reinterpret_cast<HANDLE>( this ) ) != thread_entry.th32OwnerProcessID )
{
continue;
}
threads.push_back( reinterpret_cast< c_thread * > ( OpenThread( THREAD_ALL_ACCESS, 0, thread_entry.th32ThreadID ) ) );
thread_entry.dwSize = sizeof( thread_entry );
} while ( Thread32Next( snapshot, &thread_entry ) );
CloseHandle( snapshot );
return threads;
}
auto write( std::uintptr_t address, void* buffer, std::size_t size ) -> bool
{
std::size_t bytes;
if ( !WriteProcessMemory( reinterpret_cast< HANDLE >( this ), ( void * )address, buffer, size, &bytes ) || bytes != size )
{
return false;
}
return true;
}
auto allocate( const std::size_t size, unsigned long protection ) -> std::uintptr_t
{
return reinterpret_cast< std::uintptr_t> ( VirtualAllocEx( reinterpret_cast<HANDLE> ( this ), 0, size, MEM_COMMIT | MEM_RESERVE, protection ) );
}
};
```
`slemu.vcxproj`:
```vcxproj
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<ItemGroup>
<ClCompile Include="entry.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="bytes.h" />
<ClInclude Include="emulator.h" />
<ClInclude Include="imports.h" />
<ClInclude Include="process.h" />
<ClInclude Include="thread.h" />
<ClInclude Include="utils.h" />
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{1d563729-318f-4414-8973-6e6216efc458}</ProjectGuid>
<RootNamespace>emu</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
<OutDir>$(SolutionDir)bin\</OutDir>
<IntDir>$(SolutionDir)bin\intermediates\</IntDir>
<TargetName>$(ProjectName)_x64</TargetName>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>false</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpp20</LanguageStandard>
<LanguageStandard_C>stdc17</LanguageStandard_C>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>false</GenerateDebugInformation>
<UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
<AdditionalDependencies>ntdll.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>
```
`slemu.vcxproj.filters`:
```filters
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<ClCompile Include="entry.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="utils.h" />
<ClInclude Include="process.h" />
<ClInclude Include="imports.h" />
<ClInclude Include="thread.h" />
<ClInclude Include="bytes.h" />
<ClInclude Include="emulator.h" />
</ItemGroup>
</Project>
```
`slemu.vcxproj.user`:
```user
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup />
</Project>
```
`thread.h`:
```h
class c_thread
{
public:
auto get_id( ) -> uint32_t
{
return GetThreadId( reinterpret_cast< HANDLE >( this ) );
}
auto get_ctx( ) -> CONTEXT
{
CONTEXT ctx { 0 };
ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext( reinterpret_cast< HANDLE >( this ), &ctx );
return ctx;
}
auto close( ) -> bool
{
return CloseHandle( reinterpret_cast< HANDLE >( this ) );
}
auto set_ctx( CONTEXT ctx ) -> bool
{
return SetThreadContext( reinterpret_cast< HANDLE >( this ), &ctx );
}
auto get_win32_start_address( ) -> uintptr_t
{
uintptr_t win32_start_address;
NtQueryInformationThread( reinterpret_cast< HANDLE > ( this ), static_cast<THREADINFOCLASS> ( 9 ), &win32_start_address, sizeof( DWORD64 ), 0 );
return win32_start_address;
}
};
```
`utils.h`:
```h
namespace utils
{
auto get_process( const wchar_t *name ) -> c_process *
{
PROCESSENTRY32 process_info;
process_info.dwSize = sizeof( process_info );
const auto snapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
Process32First( snapshot, &process_info );
do
{
if ( wcscmp( process_info.szExeFile, name ) == 0 )
{
CloseHandle( snapshot );
return reinterpret_cast<c_process*>( OpenProcess( PROCESS_ALL_ACCESS, 0, process_info.th32ProcessID ) );
}
} while ( Process32Next( snapshot, &process_info ) );
CloseHandle( snapshot );
return nullptr;
}
auto get_module( const wchar_t* name ) -> HMODULE
{
const auto handle = GetModuleHandle( name );
return ( handle ? handle : LoadLibrary( name ) );
}
}
```
archive/liors619/TtdAntiDebugging.txt
+8491
View File
File diff suppressed because it is too large Load Diff
archive/nkga/cheat-driver.txt
+565
View File
@@ -0,0 +1,565 @@
Project Path: arc_nkga_cheat-driver_tcye1wo3
Source Tree:
```txt
arc_nkga_cheat-driver_tcye1wo3
├── LICENSE.txt
├── README.MD
├── cheat-driver.sln
└── src
├── driver.c
├── driver.vcxproj
├── driver.vcxproj.filters
├── driver_codes.h
└── driver_config.h
```
`LICENSE.txt`:
```txt
Copyright (c) 2016 nkga
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
`README.MD`:
```MD
# cheat-driver
Simple WDM kernel mode driver for handling read/write memory requests into
arbitrary processes.
### Background
Kernel based anti-cheat drivers (EAC, BattleEye) block or monitor requests for
interfacing with the memory from the game process. The simplest way to bypass anti-cheat protections from the kernel is to use your own kernel mode driver.
### Building
1. Install [Visual Studio](https://www.visualstudio.com/).
2. Install the [Windows Driver Kit](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk).
3. Set the solution configuration to `x64` and `Release` and build the solution.
### Usage
For practical use you will need a driver signing certificate. For development
purposes you can enable [test-signing mode](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option).
You will need to either install and run the driver as a service with `CreateService` or use a function like `NtLoadDriver`.
Once the driver is loaded, you can open a handle to the driver:
```cpp
#include "driver_config.h"
#include "driver_codes.h"
HANDLE driver = CreateFileW(
DRIVER_DEVICE_PATH,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
0,
OPEN_EXISTING,
0, 0);
```
To issue read or write requests, you send the driver a control code:
```cpp
DRIVER_COPY_MEMORY copy = {};
copy.ProcessId = processId;
copy.Source = sourceBufferPtr;
copy.Target = targetAddressPtr;
copy.Size = bytesToRead;
copy.Write = FALSE;
DeviceIoControl(
driver,
IOCTL_DRIVER_COPY_MEMORY,
&copy,
sizeof(copy),
&copy,
sizeof(copy),
0, 0)
```
The target and source parameters should be reversed if issuing a write request.
```
`cheat-driver.sln`:
```sln
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.27703.2000
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "driver", "src\driver.vcxproj", "{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Release|x64 = Release|x64
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Debug|x64.ActiveCfg = Debug|x64
{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Debug|x64.Build.0 = Debug|x64
{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Debug|x64.Deploy.0 = Debug|x64
{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Release|x64.ActiveCfg = Release|x64
{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Release|x64.Build.0 = Release|x64
{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Release|x64.Deploy.0 = Release|x64
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {569B6580-CAF4-4273-BFF7-EC37D6538BF5}
EndGlobalSection
EndGlobal
```
`src/driver.c`:
```c
#include <ntifs.h>
#include <ntstrsafe.h>
#include "driver_codes.h"
#include "driver_config.h"
// Copies virtual memory from one process to another.
NTKERNELAPI NTSTATUS NTAPI MmCopyVirtualMemory(
IN PEPROCESS FromProcess,
IN PVOID FromAddress,
IN PEPROCESS ToProcess,
OUT PVOID ToAddress,
IN SIZE_T BufferSize,
IN KPROCESSOR_MODE PreviousMode,
OUT PSIZE_T NumberOfBytesCopied
);
// Forward declaration for suppressing code analysis warnings.
DRIVER_INITIALIZE DriverEntry;
// Dispatch function.
_Dispatch_type_(IRP_MJ_CREATE)
_Dispatch_type_(IRP_MJ_CLOSE)
_Dispatch_type_(IRP_MJ_DEVICE_CONTROL)
DRIVER_DISPATCH DriverDispatch;
// Performs a memory copy request.
NTSTATUS DriverCopy(IN PDRIVER_COPY_MEMORY copy) {
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS process;
status = PsLookupProcessByProcessId((HANDLE)copy->ProcessId, &process);
if (NT_SUCCESS(status)) {
PEPROCESS sourceProcess, targetProcess;
PVOID sourcePtr, targetPtr;
if (copy->Write == FALSE) {
sourceProcess = process;
targetProcess = PsGetCurrentProcess();
sourcePtr = (PVOID)copy->Target;
targetPtr = (PVOID)copy->Source;
} else {
sourceProcess = PsGetCurrentProcess();
targetProcess = process;
sourcePtr = (PVOID)copy->Source;
targetPtr = (PVOID)copy->Target;
}
SIZE_T bytes;
status = MmCopyVirtualMemory(sourceProcess, sourcePtr, targetProcess, targetPtr, copy->Size, KernelMode, &bytes);
ObDereferenceObject(process);
}
return status;
}
// Handles a IRP request.
NTSTATUS DriverDispatch(_In_ PDEVICE_OBJECT DeviceObject, _Inout_ PIRP Irp) {
UNREFERENCED_PARAMETER(DeviceObject);
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0;
PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
PVOID ioBuffer = Irp->AssociatedIrp.SystemBuffer;
ULONG inputLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;
if (irpStack->MajorFunction == IRP_MJ_DEVICE_CONTROL) {
ULONG ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
if (ioControlCode == IOCTL_DRIVER_COPY_MEMORY) {
if (ioBuffer && inputLength >= sizeof(DRIVER_COPY_MEMORY)) {
Irp->IoStatus.Status = DriverCopy((PDRIVER_COPY_MEMORY)ioBuffer);
Irp->IoStatus.Information = sizeof(DRIVER_COPY_MEMORY);
} else {
Irp->IoStatus.Status = STATUS_INFO_LENGTH_MISMATCH;
}
} else {
Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
}
}
NTSTATUS status = Irp->IoStatus.Status;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return status;
}
// Unloads the driver.
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject) {
UNICODE_STRING dosDeviceName;
RtlUnicodeStringInit(&dosDeviceName, DRIVER_DOS_DEVICE_NAME);
IoDeleteSymbolicLink(&dosDeviceName);
IoDeleteDevice(DriverObject->DeviceObject);
}
// Entry point for the driver.
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) {
NTSTATUS status = STATUS_SUCCESS;
UNREFERENCED_PARAMETER(RegistryPath);
UNICODE_STRING deviceName;
RtlUnicodeStringInit(&deviceName, DRIVER_DEVICE_NAME);
PDEVICE_OBJECT deviceObject = NULL;
status = IoCreateDevice(DriverObject, 0, &deviceName, DRIVER_DEVICE_TYPE, 0, FALSE, &deviceObject);
if (!NT_SUCCESS(status)) {
return status;
}
DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverDispatch;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDispatch;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverDispatch;
DriverObject->DriverUnload = DriverUnload;
UNICODE_STRING dosDeviceName;
RtlUnicodeStringInit(&dosDeviceName, DRIVER_DOS_DEVICE_NAME);
status = IoCreateSymbolicLink(&dosDeviceName, &deviceName);
if (!NT_SUCCESS(status)) {
IoDeleteDevice(deviceObject);
}
return status;
}
```
`src/driver.vcxproj`:
```vcxproj
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|ARM">
<Configuration>Debug</Configuration>
<Platform>ARM</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|ARM">
<Configuration>Release</Configuration>
<Platform>ARM</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|ARM64">
<Configuration>Debug</Configuration>
<Platform>ARM64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|ARM64">
<Configuration>Release</Configuration>
<Platform>ARM64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<ProjectGuid>{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}</ProjectGuid>
<TemplateGuid>{497e31cb-056b-4f31-abb8-447fd55ee5a5}</TemplateGuid>
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
<Configuration>Debug</Configuration>
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
<RootNamespace>driver</RootNamespace>
<WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>WDM</DriverType>
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>WDM</DriverType>
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<CodeAnalysisRuleSet>..\..\..\Program Files (x86)\Windows Kits\10\CodeAnalysis\DriverMinimumRules.ruleset</CodeAnalysisRuleSet>
<RunCodeAnalysis>false</RunCodeAnalysis>
<OutDir>$(SolutionDir)bin\$(Configuration)\</OutDir>
<IntDir>$(SolutionDir)tmp\$(ProjectName)\$(Configuration)\</IntDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<CodeAnalysisRuleSet>..\..\..\Program Files (x86)\Windows Kits\10\CodeAnalysis\DriverMinimumRules.ruleset</CodeAnalysisRuleSet>
<RunCodeAnalysis>false</RunCodeAnalysis>
<OutDir>$(SolutionDir)bin\$(Configuration)\</OutDir>
<IntDir>$(SolutionDir)tmp\$(ProjectName)\$(Configuration)\</IntDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<WppEnabled>true</WppEnabled>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<WppEnabled>true</WppEnabled>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
<LanguageStandard>stdcpplatest</LanguageStandard>
<EnablePREfast>false</EnablePREfast>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
<Optimization>MaxSpeed</Optimization>
<InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
<FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
<LanguageStandard>stdcpplatest</LanguageStandard>
<EnablePREfast>false</EnablePREfast>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
<ClCompile>
<WppEnabled>true</WppEnabled>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
<ClCompile>
<WppEnabled>true</WppEnabled>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
<ClCompile>
<WppEnabled>true</WppEnabled>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
<ClCompile>
<WppEnabled>true</WppEnabled>
<WppRecorderEnabled>true</WppRecorderEnabled>
<WppScanConfigurationData Condition="'%(ClCompile.ScanConfigurationData)' == ''">trace.h</WppScanConfigurationData>
<WppKernelMode>true</WppKernelMode>
</ClCompile>
</ItemDefinitionGroup>
<ItemGroup>
<FilesToPackage Include="$(TargetPath)" />
</ItemGroup>
<ItemGroup>
<ClCompile Include="driver.c" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="driver_codes.h" />
<ClInclude Include="driver_config.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>
```
`src/driver.vcxproj.filters`:
```filters
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="include">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
</Filter>
<Filter Include="source">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="driver.c">
<Filter>source</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="driver_codes.h">
<Filter>include</Filter>
</ClInclude>
<ClInclude Include="driver_config.h">
<Filter>include</Filter>
</ClInclude>
</ItemGroup>
</Project>
```
`src/driver_codes.h`:
```h
#pragma once
// #include <ntifs.h>
#include "driver_codes.h"
// Request for read/writing memory from/to a process.
#define IOCTL_DRIVER_COPY_MEMORY ((ULONG)CTL_CODE(DRIVER_DEVICE_TYPE, 0x808, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS))
// Copy requeest data.
typedef struct _DRIVER_COPY_MEMORY {
ULONGLONG Source; // Source buffer address.
ULONGLONG Target; // Target buffer address.
ULONGLONG Size; // Buffer size.
ULONG ProcessId; // Target process ID.
BOOLEAN Write; // TRUE if writing, FALSE if reading.
} DRIVER_COPY_MEMORY, *PDRIVER_COPY_MEMORY;
```
`src/driver_config.h`:
```h
#pragma once
#define DRIVER_NAME L"MemoryDriver"
#define DRIVER_DEVICE_NAME L"\\Device\\MemoryDriver"
#define DRIVER_DOS_DEVICE_NAME L"\\DosDevices\\MemoryDriver"
#define DRIVER_DEVICE_PATH L"\\\\.\\MemoryDriver"
#define DRIVER_DEVICE_TYPE 0x00000022
```