b1cc756e55
Fix status value in UaF object allocation functions. As it stands it always returns STATUS_UNSUCCESSFUL even if no error exists ( #66 )
2025-02-24 17:49:16 +05:30
1887af56e1
Explicitly specify sha1 digest algorithm when signing ( #63 )
2025-01-03 00:31:46 +05:30
536d271bd7
Fix the sizeof to avoid casting into 64 bit ( #59 )
2024-09-04 20:39:18 +05:30
219b78c2ec
FIX: copy_from_user macro already inserts size checks, so use __copy_from_user
2023-08-12 01:01:59 +05:30
e8e9d99ef9
FIX: fixed related to SMAP and added test cases to trigger IOCTLs in HEVD for Linux
2023-08-11 16:22:10 +05:30
fee7617094
FIX: Updated copyright information
2023-08-11 12:13:31 +05:30
5bc2bd43cd
FIX: Normalized line ending of all files. Changed from CRLF to LF and indent using 4 spaces instead of 1 tab
2022-12-07 13:14:47 +05:30
bdeebe4ab6
Fix handler to increment by 1 instead of 8 ( #49 )
...
```(*(PULONG_PTR*)UserPointerToIncrementValue)++; ```
increments by one pointer (so 8) instead of 1. To make this a 1-byte arbitrary increment, making UserPointerToIncrementValue a PCHAR, and incrementing by 1 CHAR.
2022-06-15 15:10:38 +05:30
a84693e30e
Fixed Linux build error which was caused by the last commit bb5e6670f3
2021-09-27 07:42:33 -07:00
bb5e6670f3
Windows on ARM support
...
- Added build script and updated CMakeLists
- Tracking issue #44
2021-09-27 06:43:29 -07:00
acc80985f8
Added Arbitrary Increment Vulnerability. Closes #40
2021-07-26 00:03:49 -07:00
643f39023b
Fixed unprobed buffer issue in SECURE mode. Fixes #42
2021-07-20 03:55:00 -07:00
7e941cefd6
Fixed format specifiers for size_t
2021-07-20 03:54:04 -07:00
262884242f
Fixed race condition in WriteNULL. Closed pull request #38
2020-08-13 00:40:39 -07:00
34b4433f56
Merge branch 'bugfix/double-fetch-in-secure-write-null' of https://github.com/Shoshkin/HackSysExtremeVulnerableDriver into Shoshkin-bugfix/double-fetch-in-secure-write-null
2020-08-13 00:07:46 -07:00
b55c50399a
Fixed format specifier
2020-08-12 23:36:48 -07:00
901dfc91ad
Fixed format specifier
2020-08-12 23:27:31 -07:00
f87cd83b69
Fix Size type in Integer Overflow ( #39 )
2020-08-13 10:42:30 +05:30
81f08d605e
Before this fix, there is a double fetch bug in the secure implementation of WriteNULL
...
it checks the address to write into from the passed usermode buffer, then reads the address again from the buffer
The address inside UserBuffer can be changed (from another thread) right after ProbeForWrite, just before the actual write
The bug is hard to reproduce since the time slot is really small
Easiest way to reproduce is to create a delay after ProbeForWrite, giving enough time for the second thread to change the address.
2020-05-22 05:25:41 +03:00
deacc8f059
FIX: Use struct hevd_io to get values from user mode
2020-02-20 17:04:32 +05:30
c53a29cc10
Added break to HEVD_IOCTL_BUFFER_OVERFLOW_STACK case in switch statement ( #36 )
2019-12-11 12:12:18 +05:30
c702a2865d
Ported unitialized stack memory vulnerability module to Linux ( #35 )
...
* Ported unitialized stack memory vulnerability module to Linux
* Added EOL
2019-11-17 23:05:58 +05:30
c23ed795cd
FIX: Changed the status message
2019-10-22 16:48:50 +05:30
808367b6c0
FIX: UaF should now be easy to exploit on x64
2019-10-22 16:38:11 +05:30
045bb53828
FIX: Refactored Linux code to look like similar to Windows code in the driver
2019-10-22 13:06:32 +05:30
1e38c8aa18
FIX: Refactored Linux code to look like similar to Windows code in the driver
2019-10-22 13:04:01 +05:30
a0d5404f44
FIX: Refactored Linux code to look like similar to Windows code in the driver
2019-10-22 12:59:47 +05:30
568b92885b
Added Linux port of ArbitraryWrite vulnerability module ( #33 )
...
* Added Linux port of ArbitraryWrite vulnerability module
* Fix syntax error for secure build for ArbitraryWrite module
* Fixed API incompatibility issue with kernel 5.x
* Remove redundant x_access_ok check
* Remove goto branching
* Remove temporary Linux build file
2019-10-21 15:08:51 +05:30
16464f149b
FIX: changed int to long
2019-10-18 12:29:36 +05:30
29affe00d1
FIX: Untabify
2019-10-18 12:05:42 +05:30
dd82b5823a
Fixed braces style
2019-10-18 11:17:31 +05:30
1fe2aef3f6
Indentation fix
2019-10-18 08:34:46 +05:30
f14f176f9f
Misc fix
2019-10-18 08:00:37 +05:30
434610330c
Ported integer overflow vulnerability module to Linux
2019-10-17 23:19:49 +05:30
5140789c5c
FIX: Moved SLN to Windows and updated path
2019-10-17 05:37:32 -07:00
78682ca97e
FIX: Replaced DbgPrint with INFO macro
2019-10-17 18:00:35 +05:30
cd46b747b6
Fixed the build issue and updated appveyor script
2019-10-17 05:22:32 -07:00
ad45b48797
Fixed the paths in the build scripts
2019-10-17 04:47:14 -07:00
d9c3d87d9e
Added HEVD for linux and updated CMake scripts
2019-10-17 03:56:01 -07:00
57198b057f
Fixed the FunctionPointer declaration
2019-08-07 03:38:46 -07:00
9785bcf59c
Fixed new line at EOF
2019-08-07 03:08:38 -07:00
a8be5a9c88
Added new line
2019-08-06 23:26:41 -07:00
81f2b0cab0
Fixing typo in message
2019-07-02 17:48:19 +05:30
963d6902ca
Adding PFX file and updating scripts
2019-06-28 09:25:30 -07:00
e4815c8881
Fixed the cmake file
2019-06-28 09:11:51 -07:00
e289bcae33
Fixing cmake file
2019-06-28 07:14:11 -07:00
deb6378890
Fixing cmake file and appveyor
2019-06-28 06:58:50 -07:00
e489972134
Fixing cmake file and appveyor
2019-06-28 06:21:46 -07:00
79c00ec9ae
v3.0.0
2019-06-28 03:49:52 -07:00
b2382e279c
Fixing Illegal Indirection bug in SECURE mode
2018-09-24 19:31:20 +05:30
Gonçalo Carvalho