mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
@@ -0,0 +1,194 @@
|
||||
Project Path: arc_gmh5225_Disable-nmi-callbacks_62ekmd51
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_Disable-nmi-callbacks_62ekmd51
|
||||
├── README.md
|
||||
└── driver.cpp
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# Disable_nmi_callbacks
|
||||
# an old code
|
||||
#
|
||||
|
||||
```C
|
||||
|
||||
extern "C"
|
||||
{
|
||||
|
||||
NTSYSAPI BOOLEAN NTAPI KeInterlockedSetProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
|
||||
|
||||
}
|
||||
|
||||
bool disable_nmi_callbacks() {
|
||||
const auto ntoskrnl_base = (PVOID)utils::get_kernel_module(Crypt("ntoskrnl.exe"));
|
||||
|
||||
if (!ntoskrnl_base) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] ntoskrnl_base not found\n"));
|
||||
return 0;
|
||||
}
|
||||
else {
|
||||
DbgPrintEx(0, 0, Crypt("[+] ntoskrnl_base @ 0x%p\n"), ntoskrnl_base);
|
||||
|
||||
}
|
||||
|
||||
auto nmi_in_progress = reinterpret_cast<uint8_t*>(utils::find_pattern((uintptr_t)ntoskrnl_base, Crypt("\x81\x25\x00\x00\x00\x00\x00\x00\x00\x00\xB9\x00\x00\x00\x00"), Crypt("xx????????x????")));
|
||||
|
||||
if (!nmi_in_progress) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] nmi_in_progress not found\n"));
|
||||
return 0;
|
||||
}
|
||||
else {
|
||||
DbgPrintEx(0, 0, Crypt("[+] nmi_in_progress @ 0x%p\n"), nmi_in_progress);
|
||||
}
|
||||
|
||||
if (nmi_in_progress) {
|
||||
|
||||
while (*nmi_in_progress != 0x48) {
|
||||
++nmi_in_progress;
|
||||
}
|
||||
|
||||
nmi_in_progress = impl::resolve_mov(nmi_in_progress);
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] nmi_in_progress (resolved) @ 0x%p\n"), nmi_in_progress);
|
||||
|
||||
if (!nmi_in_progress) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] !nmi_in_progress\n"));
|
||||
}
|
||||
|
||||
auto irql = KfRaiseIrql(0);
|
||||
|
||||
ULONG cores = KeQueryActiveProcessorCount(NULL);
|
||||
|
||||
for (auto i = 0ul; i < cores; ++i) {
|
||||
|
||||
KeInterlockedSetProcessorAffinityEx((PKAFFINITY_EX)nmi_in_progress, i);
|
||||
InterlockedBitTestAndSet64((LONG64*)(nmi_in_progress), i);
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] disabled nmi for proccessor %d\n"), i);
|
||||
|
||||
}
|
||||
|
||||
KeLowerIrql(irql);
|
||||
}
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] Done disabled nmi callback\n"));
|
||||
return true;
|
||||
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
# Example Usage
|
||||
|
||||
```C
|
||||
|
||||
extern "C" NTSTATUS DriverEntry() {
|
||||
|
||||
BOOL status = disable_nmi_callbacks();
|
||||
|
||||
if (status == FALSE) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] Failed disabling nmi callbacks.\n"));
|
||||
}
|
||||
else {
|
||||
DbgPrintEx(0, 0, Crypt("[+] Done disabled nmi callback\n"));
|
||||
}
|
||||
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] Driver loaded!\n"));
|
||||
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
`driver.cpp`:
|
||||
|
||||
```cpp
|
||||
extern "C"
|
||||
{
|
||||
|
||||
NTSYSAPI BOOLEAN NTAPI KeInterlockedSetProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
|
||||
|
||||
}
|
||||
|
||||
bool disable_nmi_callbacks() {
|
||||
const auto ntoskrnl_base = (PVOID)utils::get_kernel_module(Crypt("ntoskrnl.exe"));
|
||||
|
||||
if (!ntoskrnl_base) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] ntoskrnl_base not found\n"));
|
||||
return 0;
|
||||
}
|
||||
else {
|
||||
DbgPrintEx(0, 0, Crypt("[+] ntoskrnl_base @ 0x%p\n"), ntoskrnl_base);
|
||||
|
||||
}
|
||||
|
||||
auto nmi_in_progress = reinterpret_cast<uint8_t*>(utils::find_pattern((uintptr_t)ntoskrnl_base, Crypt("\x81\x25\x00\x00\x00\x00\x00\x00\x00\x00\xB9\x00\x00\x00\x00"), Crypt("xx????????x????")));
|
||||
|
||||
if (!nmi_in_progress) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] nmi_in_progress not found\n"));
|
||||
return 0;
|
||||
}
|
||||
else {
|
||||
DbgPrintEx(0, 0, Crypt("[+] nmi_in_progress @ 0x%p\n"), nmi_in_progress);
|
||||
}
|
||||
|
||||
if (nmi_in_progress) {
|
||||
|
||||
while (*nmi_in_progress != 0x48) {
|
||||
++nmi_in_progress;
|
||||
}
|
||||
|
||||
nmi_in_progress = impl::resolve_mov(nmi_in_progress);
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] nmi_in_progress (resolved) @ 0x%p\n"), nmi_in_progress);
|
||||
|
||||
if (!nmi_in_progress) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] !nmi_in_progress\n"));
|
||||
}
|
||||
|
||||
auto irql = KfRaiseIrql(0);
|
||||
|
||||
ULONG cores = KeQueryActiveProcessorCount(NULL);
|
||||
|
||||
for (auto i = 0ul; i < cores; ++i) {
|
||||
|
||||
KeInterlockedSetProcessorAffinityEx((PKAFFINITY_EX)nmi_in_progress, i);
|
||||
InterlockedBitTestAndSet64((LONG64*)(nmi_in_progress), i);
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] disabled nmi for proccessor %d\n"), i);
|
||||
|
||||
}
|
||||
|
||||
KeLowerIrql(irql);
|
||||
}
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] Done disabled nmi callback\n"));
|
||||
return true;
|
||||
|
||||
}
|
||||
|
||||
|
||||
extern "C" NTSTATUS DriverEntry() {
|
||||
|
||||
BOOL status = disable_nmi_callbacks();
|
||||
|
||||
if (status == FALSE) {
|
||||
DbgPrintEx(0, 0, Crypt("[-] Failed disabling nmi callbacks.\n"));
|
||||
}
|
||||
else {
|
||||
DbgPrintEx(0, 0, Crypt("[+] Done disabled nmi callback\n"));
|
||||
}
|
||||
|
||||
|
||||
DbgPrintEx(0, 0, Crypt("[+] Driver loaded!\n"));
|
||||
|
||||
}
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,551 @@
|
||||
Project Path: arc_gmh5225_NMI-nmi_callback_u7pp70ld
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_NMI-nmi_callback_u7pp70ld
|
||||
├── README.md
|
||||
├── demo.PNG
|
||||
├── nmi_callback
|
||||
│ ├── nmi_callback.inf
|
||||
│ ├── nmi_callback.vcxproj
|
||||
│ ├── nmi_callback.vcxproj.filters
|
||||
│ └── src
|
||||
│ ├── hal.c
|
||||
│ ├── helper.c
|
||||
│ ├── main.c
|
||||
│ └── stuff.h
|
||||
└── nmi_callback.sln
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# nmi_callback
|
||||
This driver will fire a non-maskable interrupt (NMI) on your 1st cpu core and attempt to handle it using an NMI callback.
|
||||
If it succeeds, you will see following result in WinDbg:
|
||||
|
||||
|
||||
|
||||
In order to get this done, i am doing the following:
|
||||
1. Allocate KAFFINITY_EX structure.
|
||||
2. Pass it to KeInitializeAffinityEx.
|
||||
3. Add the CPU core the NMI should be run at to the affinity, by calling KeAddProcessorAffinityEx.
|
||||
4. Finally calling HalSendNMI to send it. parameter is the affinity of course.
|
||||
|
||||
Note that all of these APIs listed above are not publicly documented so there might be inconsistencies on return value, prototype etc...
|
||||
|
||||
```
|
||||
|
||||
`nmi_callback.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.32510.428
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "nmi_callback", "nmi_callback\nmi_callback.vcxproj", "{9180B6D2-48AE-42D1-A651-2324A16AF74A}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM = Debug|ARM
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|ARM = Release|ARM
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|ARM.ActiveCfg = Debug|ARM
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|ARM.Build.0 = Debug|ARM
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|ARM.Deploy.0 = Debug|ARM
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|ARM64.Deploy.0 = Debug|ARM64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|x64.Build.0 = Debug|x64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|x86.Build.0 = Debug|Win32
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Debug|x86.Deploy.0 = Debug|Win32
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|ARM.ActiveCfg = Release|ARM
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|ARM.Build.0 = Release|ARM
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|ARM.Deploy.0 = Release|ARM
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|ARM64.Deploy.0 = Release|ARM64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|x64.ActiveCfg = Release|x64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|x64.Build.0 = Release|x64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|x64.Deploy.0 = Release|x64
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|x86.ActiveCfg = Release|Win32
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|x86.Build.0 = Release|Win32
|
||||
{9180B6D2-48AE-42D1-A651-2324A16AF74A}.Release|x86.Deploy.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {052123F8-9C27-47D0-BD07-5857F363FB09}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`nmi_callback/nmi_callback.inf`:
|
||||
|
||||
```inf
|
||||
;
|
||||
; nmi_callback.inf
|
||||
;
|
||||
|
||||
[Version]
|
||||
Signature="$WINDOWS NT$"
|
||||
Class=Sample ; TODO: edit Class
|
||||
ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid
|
||||
Provider=%ManufacturerName%
|
||||
CatalogFile=nmi_callback.cat
|
||||
DriverVer= ; TODO: set DriverVer in stampinf property pages
|
||||
|
||||
[DestinationDirs]
|
||||
DefaultDestDir = 12
|
||||
nmi_callback_Device_CoInstaller_CopyFiles = 11
|
||||
|
||||
; ================= Class section =====================
|
||||
|
||||
[ClassInstall32]
|
||||
Addreg=SampleClassReg
|
||||
|
||||
[SampleClassReg]
|
||||
HKR,,,0,%ClassName%
|
||||
HKR,,Icon,,-5
|
||||
|
||||
[SourceDisksNames]
|
||||
1 = %DiskName%,,,""
|
||||
|
||||
[SourceDisksFiles]
|
||||
nmi_callback.sys = 1,,
|
||||
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames
|
||||
|
||||
;*****************************************
|
||||
; Install Section
|
||||
;*****************************************
|
||||
|
||||
[Manufacturer]
|
||||
%ManufacturerName%=Standard,NT$ARCH$
|
||||
|
||||
[Standard.NT$ARCH$]
|
||||
%nmi_callback.DeviceDesc%=nmi_callback_Device, Root\nmi_callback ; TODO: edit hw-id
|
||||
|
||||
[nmi_callback_Device.NT]
|
||||
CopyFiles=Drivers_Dir
|
||||
|
||||
[Drivers_Dir]
|
||||
nmi_callback.sys
|
||||
|
||||
;-------------- Service installation
|
||||
[nmi_callback_Device.NT.Services]
|
||||
AddService = nmi_callback,%SPSVCINST_ASSOCSERVICE%, nmi_callback_Service_Inst
|
||||
|
||||
; -------------- nmi_callback driver install sections
|
||||
[nmi_callback_Service_Inst]
|
||||
DisplayName = %nmi_callback.SVCDESC%
|
||||
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
|
||||
StartType = 3 ; SERVICE_DEMAND_START
|
||||
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
|
||||
ServiceBinary = %12%\nmi_callback.sys
|
||||
|
||||
;
|
||||
;--- nmi_callback_Device Coinstaller installation ------
|
||||
;
|
||||
|
||||
[nmi_callback_Device.NT.CoInstallers]
|
||||
AddReg=nmi_callback_Device_CoInstaller_AddReg
|
||||
CopyFiles=nmi_callback_Device_CoInstaller_CopyFiles
|
||||
|
||||
[nmi_callback_Device_CoInstaller_AddReg]
|
||||
HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"
|
||||
|
||||
[nmi_callback_Device_CoInstaller_CopyFiles]
|
||||
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll
|
||||
|
||||
[nmi_callback_Device.NT.Wdf]
|
||||
KmdfService = nmi_callback, nmi_callback_wdfsect
|
||||
[nmi_callback_wdfsect]
|
||||
KmdfLibraryVersion = $KMDFVERSION$
|
||||
|
||||
[Strings]
|
||||
SPSVCINST_ASSOCSERVICE= 0x00000002
|
||||
ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
|
||||
ClassName="Samples" ; TODO: edit ClassName
|
||||
DiskName = "nmi_callback Installation Disk"
|
||||
nmi_callback.DeviceDesc = "nmi_callback Device"
|
||||
nmi_callback.SVCDESC = "nmi_callback Service"
|
||||
|
||||
```
|
||||
|
||||
`nmi_callback/nmi_callback.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{9180B6D2-48AE-42D1-A651-2324A16AF74A}</ProjectGuid>
|
||||
<TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>nmi_callback</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<SpectreMitigation>false</SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<SpectreMitigation>false</SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
<Optimization>Disabled</Optimization>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="nmi_callback.inf" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="src\hal.c" />
|
||||
<ClCompile Include="src\helper.c" />
|
||||
<ClCompile Include="src\main.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="src\stuff.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`nmi_callback/nmi_callback.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="nmi_callback.inf">
|
||||
<Filter>Driver Files</Filter>
|
||||
</Inf>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="src\main.c" />
|
||||
<ClCompile Include="src\hal.c" />
|
||||
<ClCompile Include="src\helper.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="src\stuff.h" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`nmi_callback/src/hal.c`:
|
||||
|
||||
```c
|
||||
#include "stuff.h"
|
||||
|
||||
VOID HalSendNMI(PKAFFINITY_EX affinity)
|
||||
{
|
||||
PVOID addr;
|
||||
UNICODE_STRING routineName;
|
||||
|
||||
RtlInitUnicodeString(&routineName, L"HalSendNMI");
|
||||
addr = MmGetSystemRoutineAddress(&routineName);
|
||||
|
||||
if (!addr) __debugbreak();
|
||||
|
||||
( (VOID(__fastcall*)(PKAFFINITY_EX))addr )(affinity);
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`nmi_callback/src/helper.c`:
|
||||
|
||||
```c
|
||||
#include "stuff.h"
|
||||
|
||||
INT64 HLP_SecInNs(INT64 nSec)
|
||||
{
|
||||
return (nSec * 10000000);
|
||||
}
|
||||
|
||||
VOID HLP_DelayExecutionThread(INT64 nSeconds)
|
||||
{
|
||||
LARGE_INTEGER nDelay;
|
||||
memset(&nDelay, 0, sizeof(nDelay));
|
||||
|
||||
nDelay.QuadPart -= HLP_SecInNs(nSeconds);
|
||||
|
||||
KeDelayExecutionThread(KernelMode, FALSE, &nDelay);
|
||||
}
|
||||
|
||||
BOOLEAN HLP_FireNMI(INT core, PKAFFINITY_EX affinity)
|
||||
{
|
||||
KeInitializeAffinityEx(affinity);
|
||||
KeAddProcessorAffinityEx(affinity, core);
|
||||
|
||||
HalSendNMI(affinity);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`nmi_callback/src/main.c`:
|
||||
|
||||
```c
|
||||
#include "stuff.h"
|
||||
|
||||
PVOID g_NmiCallbackHandle;
|
||||
PKAFFINITY_EX g_NmiAffinity;
|
||||
PNMI_CONTEXT g_NmiContext;
|
||||
|
||||
BOOLEAN NmiCallback(PVOID context, BOOLEAN handled)
|
||||
{
|
||||
PNMI_CONTEXT cpuContext = &((PNMI_CONTEXT)context)[KeGetCurrentProcessorNumberEx(NULL)];
|
||||
|
||||
++cpuContext->NumFired;
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
VOID DriverUnload(PDRIVER_OBJECT drvObj)
|
||||
{
|
||||
DbgPrint("[nmi_cb] unload\n");
|
||||
|
||||
if (g_NmiCallbackHandle) KeDeregisterNmiCallback(g_NmiCallbackHandle);
|
||||
if (g_NmiAffinity) ExFreePoolWithTag(g_NmiAffinity, NMI_CB_POOL_TAG);
|
||||
if (g_NmiContext) ExFreePoolWithTag(g_NmiContext, NMI_CB_POOL_TAG);
|
||||
}
|
||||
|
||||
NTSTATUS DriverEntry(PDRIVER_OBJECT drvObj, PUNICODE_STRING regPath)
|
||||
{
|
||||
DbgPrint("\n[nmi_cb] entry\n");
|
||||
|
||||
ULONG numCores = KeQueryActiveProcessorCountEx(NULL);
|
||||
|
||||
drvObj->DriverUnload = DriverUnload;
|
||||
|
||||
ULONG nmiContextLength = numCores * sizeof(NMI_CONTEXT);
|
||||
|
||||
g_NmiAffinity = ExAllocatePoolWithTag(NonPagedPool, sizeof(KAFFINITY_EX), NMI_CB_POOL_TAG);
|
||||
g_NmiContext = (PNMI_CONTEXT)ExAllocatePoolWithTag(NonPagedPool, nmiContextLength, NMI_CB_POOL_TAG);
|
||||
g_NmiCallbackHandle = KeRegisterNmiCallback(NmiCallback, g_NmiContext);
|
||||
|
||||
if (!g_NmiAffinity || !g_NmiContext || !g_NmiCallbackHandle)
|
||||
return STATUS_FAILED_DRIVER_ENTRY;
|
||||
|
||||
memset(g_NmiContext, 0, nmiContextLength);
|
||||
|
||||
HLP_FireNMI(0, g_NmiAffinity); /* this will fire an NMI on CPU #0 */
|
||||
HLP_DelayExecutionThread(2); /* can adjust this delay, it's been arbitrarily chosen. */
|
||||
|
||||
for (ULONG i = 0; i < numCores; i++)
|
||||
{
|
||||
PNMI_CONTEXT cpuContext = &g_NmiContext[i];
|
||||
|
||||
DbgPrint("[nmi_cb] CPU#%i NmiCallbackInvokes=%i\n", i, cpuContext->NumFired);
|
||||
}
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`nmi_callback/src/stuff.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
|
||||
#include <intrin.h>
|
||||
#include <ntddk.h>
|
||||
|
||||
#define NMI_CB_POOL_TAG 'BCmN'
|
||||
|
||||
//0xa8 bytes (sizeof)
|
||||
typedef struct _KAFFINITY_EX
|
||||
{
|
||||
USHORT Count; //0x0
|
||||
USHORT Size; //0x2
|
||||
ULONG Reserved; //0x4
|
||||
ULONGLONG Bitmap[20]; //0x8
|
||||
} KAFFINITY_EX, *PKAFFINITY_EX;
|
||||
|
||||
typedef struct _NMI_CONTEXT
|
||||
{
|
||||
INT NumFired;
|
||||
} NMI_CONTEXT, *PNMI_CONTEXT;
|
||||
|
||||
EXTERN_C INT64 HLP_SecInNs(INT64 nSec);
|
||||
EXTERN_C VOID HLP_DelayExecutionThread(INT64 nSeconds);
|
||||
EXTERN_C BOOLEAN HLP_FireNMI(INT core, PKAFFINITY_EX affinity);
|
||||
|
||||
EXTERN_C VOID KeInitializeAffinityEx(PKAFFINITY_EX affinity);
|
||||
EXTERN_C VOID KeAddProcessorAffinityEx(PKAFFINITY_EX affinity, INT num);
|
||||
|
||||
EXTERN_C VOID HalSendNMI(PKAFFINITY_EX affinity);
|
||||
|
||||
```
|
||||
@@ -0,0 +1,216 @@
|
||||
Project Path: arc_gmh5225_NMICallbackBlocker2_reb2phrj
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_NMICallbackBlocker2_reb2phrj
|
||||
├── LICENSE
|
||||
├── README.md
|
||||
└── nmi.cpp
|
||||
|
||||
```
|
||||
|
||||
`LICENSE`:
|
||||
|
||||
```
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2024 ENV
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# NMICallbackBlocker2
|
||||
This is a POC Test project for INTEL CPUs on blocking NMI Entries through the IDT Handler.
|
||||
|
||||
```cpp
|
||||
typedef struct _KNMI_HANDLER_CALLBACK
|
||||
{
|
||||
struct _KNMI_HANDLER_CALLBACK* Next;
|
||||
void(*Callback)();
|
||||
void* Context;
|
||||
void* Handle;
|
||||
} KNMI_HANDLER_CALLBACK, * PKNMI_HANDLER_CALLBACK;
|
||||
|
||||
typedef struct _KAFFINITY_EX
|
||||
{
|
||||
USHORT Count; //0x0
|
||||
USHORT Size; //0x2
|
||||
ULONG Reserved; //0x4
|
||||
ULONGLONG Bitmap[20]; //0x8
|
||||
} KAFFINITY_EX, * PKAFFINITY_EX;
|
||||
|
||||
void PreventNMIExecution() {
|
||||
void* ntoskrnl_base = reinterpret_cast<void*>((uintptr_t)get_ntos_base_address());
|
||||
if (ntoskrnl_base == NULL) {
|
||||
DbgPrint("[NMI] Failed to get ntoskrnl_base");
|
||||
}
|
||||
|
||||
// Perform the pattern scanning to locate nmi_in_progress
|
||||
char* pattern = _("\xE8\x00\x00\x00\x00\x83\xCB\xFF\x48\x8B\xD6");
|
||||
char* mask = _("x????xxxxxx");
|
||||
|
||||
char* NtoskrnlStr = _("ntoskrnl.exe");
|
||||
|
||||
void* ModuleSig = static_cast<void*>(FindPatternImage((PCHAR)GetKernelModuleBase(NtoskrnlStr), pattern, mask));
|
||||
QWORD pattern_idt = reinterpret_cast<QWORD>(ModuleSig);
|
||||
// DbgPrint("[NMI] ModuleSig = %p\n", ModuleSig);
|
||||
// DbgPrint("[NMI] patternIDT = %p\n", pattern_idt);
|
||||
|
||||
if (pattern_idt != NULL)
|
||||
{
|
||||
pattern_idt = PswResolveRelativeAddress(pattern_idt, 1, 5);
|
||||
pattern_idt = pattern_idt + 0x1a;
|
||||
pattern_idt = PswResolveRelativeAddress(pattern_idt, 3, 7);
|
||||
|
||||
*(QWORD*)(pattern_idt + 0x38) = *(QWORD*)(pattern_idt + 0x1A0);
|
||||
*(QWORD*)(pattern_idt + 0x40) = *(QWORD*)(pattern_idt + 0x1A8);
|
||||
// DbgPrint(_("[NMI] IDT Patched / NMIs Blocked"));
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
`nmi.cpp`:
|
||||
|
||||
```cpp
|
||||
|
||||
BOOL
|
||||
CheckMask(
|
||||
PCHAR Base,
|
||||
PCHAR Pattern,
|
||||
PCHAR Mask
|
||||
) {
|
||||
for (; *Mask; ++Base, ++Pattern, ++Mask) {
|
||||
if (*Mask == 'x' && *Base != *Pattern) {
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
PVOID
|
||||
FindPattern2(
|
||||
PCHAR Base,
|
||||
DWORD Length,
|
||||
PCHAR Pattern,
|
||||
PCHAR Mask
|
||||
) {
|
||||
Length -= (DWORD)strlen(Mask);
|
||||
for (DWORD i = 0; i <= Length; ++i) {
|
||||
PVOID Addr = &Base[i];
|
||||
if (CheckMask((PCHAR)Addr, Pattern, Mask)) {
|
||||
return Addr;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
PVOID FindPatternImage(
|
||||
PCHAR Base,
|
||||
PCHAR Pattern,
|
||||
PCHAR Mask
|
||||
) {
|
||||
PVOID Match = 0;
|
||||
|
||||
PIMAGE_NT_HEADERS Headers = (PIMAGE_NT_HEADERS)(Base + ((PIMAGE_DOS_HEADER)Base)->e_lfanew);
|
||||
PIMAGE_SECTION_HEADER Sections = IMAGE_FIRST_SECTION(Headers);
|
||||
for (DWORD i = 0; i < Headers->FileHeader.NumberOfSections; ++i) {
|
||||
PIMAGE_SECTION_HEADER Section = &Sections[i];
|
||||
if (*(PINT)Section->Name == 'EGAP' || memcmp(Section->Name, _(".text"), 5) == 0) {
|
||||
Match = FindPattern2(Base + Section->VirtualAddress, Section->Misc.VirtualSize, Pattern, Mask);
|
||||
if (Match) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return Match;
|
||||
}
|
||||
|
||||
typedef struct _KNMI_HANDLER_CALLBACK
|
||||
{
|
||||
struct _KNMI_HANDLER_CALLBACK* Next;
|
||||
void(*Callback)();
|
||||
void* Context;
|
||||
void* Handle;
|
||||
} KNMI_HANDLER_CALLBACK, * PKNMI_HANDLER_CALLBACK;
|
||||
|
||||
typedef struct _KAFFINITY_EX
|
||||
{
|
||||
USHORT Count; //0x0
|
||||
USHORT Size; //0x2
|
||||
ULONG Reserved; //0x4
|
||||
ULONGLONG Bitmap[20]; //0x8
|
||||
} KAFFINITY_EX, * PKAFFINITY_EX;
|
||||
|
||||
typedef ULONG KEPROCESSORINDEX;
|
||||
extern "C" NTSYSAPI BOOLEAN NTAPI KeInterlockedSetProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
|
||||
|
||||
|
||||
QWORD PswResolveRelativeAddress(
|
||||
QWORD Instruction,
|
||||
DWORD OffsetOffset,
|
||||
DWORD InstructionSize
|
||||
)
|
||||
{
|
||||
|
||||
QWORD Instr = (QWORD)Instruction;
|
||||
INT32 RipOffset = *(INT32*)(Instr + OffsetOffset);
|
||||
QWORD ResolvedAddr = (QWORD)(Instr + InstructionSize + RipOffset);
|
||||
return ResolvedAddr;
|
||||
}
|
||||
|
||||
void PreventNMIExecution() {
|
||||
void* ntoskrnl_base = reinterpret_cast<void*>((uintptr_t)get_ntos_base_address());
|
||||
if (ntoskrnl_base == NULL) {
|
||||
DbgPrint("[NMI] Failed to get ntoskrnl_base");
|
||||
}
|
||||
|
||||
// Perform the pattern scanning to locate nmi_in_progress
|
||||
char* pattern = _("\xE8\x00\x00\x00\x00\x83\xCB\xFF\x48\x8B\xD6");
|
||||
char* mask = _("x????xxxxxx");
|
||||
|
||||
char* NtoskrnlStr = _("ntoskrnl.exe");
|
||||
|
||||
void* ModuleSig = static_cast<void*>(FindPatternImage((PCHAR)GetKernelModuleBase(NtoskrnlStr), pattern, mask));
|
||||
QWORD pattern_idt = reinterpret_cast<QWORD>(ModuleSig);
|
||||
// DbgPrint("[NMI] ModuleSig = %p\n", ModuleSig);
|
||||
// DbgPrint("[NMI] patternIDT = %p\n", pattern_idt);
|
||||
|
||||
if (pattern_idt != NULL)
|
||||
{
|
||||
pattern_idt = PswResolveRelativeAddress(pattern_idt, 1, 5);
|
||||
pattern_idt = pattern_idt + 0x1a;
|
||||
pattern_idt = PswResolveRelativeAddress(pattern_idt, 3, 7);
|
||||
|
||||
*(QWORD*)(pattern_idt + 0x38) = *(QWORD*)(pattern_idt + 0x1A0);
|
||||
*(QWORD*)(pattern_idt + 0x40) = *(QWORD*)(pattern_idt + 0x1A8);
|
||||
// DbgPrint(_("[NMI] IDT Patched / NMIs Blocked"));
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user