mirror of
https://github.com/zer0condition/GoodmansKernel/
synced 2026-08-19 01:14:35 +00:00
initial commit
This commit is contained in:
zer0condition
@@ -0,0 +1,48 @@
|
||||
; Goodmans.inf - minimal WDM install
|
||||
|
||||
[Version]
|
||||
Signature = "$WINDOWS NT$"
|
||||
Class = System
|
||||
ClassGuid = {4d36e97d-e325-11ce-bfc1-08002be10318}
|
||||
Provider = %Provider%
|
||||
DriverVer =
|
||||
CatalogFile = Goodmans.cat
|
||||
PnpLockdown = 1
|
||||
|
||||
[DestinationDirs]
|
||||
DefaultDestDir = 12
|
||||
|
||||
[SourceDisksNames]
|
||||
1 = %DiskName%
|
||||
|
||||
[SourceDisksFiles]
|
||||
Goodmans.sys = 1
|
||||
|
||||
[Manufacturer]
|
||||
%Provider% = Standard,NT$ARCH$
|
||||
|
||||
[Standard.NT$ARCH$]
|
||||
%DeviceDesc% = Goodmans_Install,Root\Goodmans
|
||||
|
||||
[Goodmans_Install.NT]
|
||||
CopyFiles = Goodmans.CopyFiles
|
||||
|
||||
[Goodmans_Install.NT.Services]
|
||||
AddService = Goodmans,%SPSVCINST_ASSOCSERVICE%,Goodmans_Service
|
||||
|
||||
[Goodmans.CopyFiles]
|
||||
Goodmans.sys
|
||||
|
||||
[Goodmans_Service]
|
||||
DisplayName = %ServiceDesc%
|
||||
ServiceType = 1
|
||||
StartType = 3
|
||||
ErrorControl = 1
|
||||
ServiceBinary = %12%\Goodmans.sys
|
||||
|
||||
[Strings]
|
||||
SPSVCINST_ASSOCSERVICE = 0x00000002
|
||||
Provider = "Goodmans"
|
||||
DeviceDesc = "Goodmans WASM Kernel VM"
|
||||
ServiceDesc = "Goodmans"
|
||||
DiskName = "Goodmans Install Disk"
|
||||
@@ -0,0 +1,60 @@
|
||||
Goodmans deploy folder
|
||||
|
||||
After running build.cmd from the repo root, this directory contains
|
||||
everything needed to install and run Goodmans on a test VM.
|
||||
|
||||
layout after build:
|
||||
deploy\
|
||||
Goodmans.sys signed driver (test-cert)
|
||||
Goodmans.inf driver inf
|
||||
GoodmansTest.cer test code-signing cert
|
||||
GoodmansTest.pfx pfx used for signing (password: goodmans)
|
||||
gen_cert.cmd creates cer+pfx (run once, elevated)
|
||||
install.cmd imports cert + sc create + sc start
|
||||
uninstall.cmd sc stop + sc delete
|
||||
README.txt this file
|
||||
gui\
|
||||
goodmans-gui.exe debug GUI (Qt6)
|
||||
Qt6*.dll + platform + tls + imageformats plugins
|
||||
toolkit.wasm toolkit guest for the Explorer tab
|
||||
samples\
|
||||
sample_guest.wasm demo host-import roundtrips
|
||||
ffi_demo.wasm direct nt/hal export calls via host_call
|
||||
pslist_dumper.wasm walks PsLoadedModuleList
|
||||
handle_stripper.wasm ObDereferenceObject demo
|
||||
infinity_hook.wasm full IH port in wasm
|
||||
features\
|
||||
toolkit.wasm
|
||||
process_tracer.wasm
|
||||
|
||||
workflow on the target VM
|
||||
|
||||
1. enable test signing (once, then reboot):
|
||||
bcdedit /set testsigning on
|
||||
|
||||
2. copy the whole `deploy\` folder to the VM. from an elevated cmd here:
|
||||
gen_cert.cmd (first-time setup, creates the cer+pfx)
|
||||
install.cmd (imports cert + sc create/start Goodmans)
|
||||
|
||||
3. run the GUI:
|
||||
gui\goodmans-gui.exe
|
||||
the toolkit.wasm loads automatically; the Explorer tab wakes up.
|
||||
load any sample from Workbench, Browse, samples\*.wasm
|
||||
|
||||
4. teardown:
|
||||
uninstall.cmd
|
||||
|
||||
common errors
|
||||
|
||||
sc start returns 577 driver isnt signed with a trusted cert.
|
||||
re-run install.cmd. verify cert landed in
|
||||
Cert:\LocalMachine\Root and TrustedPublisher.
|
||||
|
||||
sc start returns 1275 testsigning off, or HVCI blocking. verify:
|
||||
bcdedit /enum {current}
|
||||
testsigning should say Yes.
|
||||
|
||||
CreateFile fails 2 driver started but DriverEntry bailed. open the
|
||||
GUI Log tab or DbgView filtered on [goodmans].
|
||||
|
||||
bugcheck on start paste the bugcheck code + parameters into an issue.
|
||||
@@ -0,0 +1,44 @@
|
||||
@echo off
|
||||
setlocal
|
||||
|
||||
net session >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo [X] must be run as Administrator.
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
set "HERE=%~dp0"
|
||||
if "%HERE:~-1%"=="\" set "HERE=%HERE:~0,-1%"
|
||||
|
||||
set "CER=%HERE%\GoodmansTest.cer"
|
||||
set "PFX=%HERE%\GoodmansTest.pfx"
|
||||
|
||||
if exist "%CER%" if exist "%PFX%" (
|
||||
echo [*] cert already exists: %CER%
|
||||
echo delete both files first if you want to regenerate.
|
||||
exit /b 0
|
||||
)
|
||||
|
||||
echo [*] generating self-signed code-signing cert
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
|
||||
"$c = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=GoodmansTest' -CertStoreLocation Cert:\CurrentUser\My -KeyUsage DigitalSignature -KeyAlgorithm RSA -KeyLength 2048 -NotAfter (Get-Date).AddYears(5);" ^
|
||||
"Export-Certificate -Cert $c -FilePath '%CER%' | Out-Null;" ^
|
||||
"$pw = ConvertTo-SecureString -String 'goodmans' -Force -AsPlainText;" ^
|
||||
"Export-PfxCertificate -Cert $c -FilePath '%PFX%' -Password $pw | Out-Null;" ^
|
||||
"Write-Host ('thumbprint: ' + $c.Thumbprint)"
|
||||
|
||||
if errorlevel 1 (
|
||||
echo [X] cert generation failed
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
echo.
|
||||
echo [+] generated:
|
||||
echo %CER%
|
||||
echo %PFX% (password: goodmans)
|
||||
echo.
|
||||
echo [*] to sign a driver:
|
||||
echo signtool sign /fd sha256 /f "%PFX%" /p goodmans Goodmans.sys
|
||||
|
||||
endlocal
|
||||
@@ -0,0 +1,57 @@
|
||||
@echo off
|
||||
setlocal
|
||||
|
||||
net session >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo [X] must be run as Administrator.
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
set "HERE=%~dp0"
|
||||
if "%HERE:~-1%"=="\" set "HERE=%HERE:~0,-1%"
|
||||
|
||||
set "SYS=%HERE%\Goodmans.sys"
|
||||
set "CER=%HERE%\GoodmansTest.cer"
|
||||
|
||||
if not exist "%SYS%" (
|
||||
echo [X] missing: %SYS%
|
||||
echo build the driver and copy Goodmans.sys into this folder.
|
||||
exit /b 1
|
||||
)
|
||||
if not exist "%CER%" (
|
||||
echo [X] missing: %CER%
|
||||
echo run gen_cert.cmd first to create the test cert.
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
|
||||
echo [*] Debug Print Filter mask
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /v DEFAULT /t REG_DWORD /d 0xFFFFFFFF /f >nul
|
||||
|
||||
echo [*] importing cert to Root + TrustedPublisher
|
||||
certutil -addstore Root "%CER%" >nul 2>&1
|
||||
certutil -addstore TrustedPublisher "%CER%" >nul 2>&1
|
||||
|
||||
echo [*] removing any prior Goodmans service
|
||||
sc query Goodmans >nul 2>&1
|
||||
if not errorlevel 1 (
|
||||
sc stop Goodmans >nul 2>&1
|
||||
sc delete Goodmans >nul 2>&1
|
||||
timeout /t 1 /nobreak >nul
|
||||
)
|
||||
|
||||
echo [*] sc create + start
|
||||
sc create Goodmans type= kernel binPath= "%SYS%"
|
||||
if errorlevel 1 ( echo [X] sc create failed & exit /b 1 )
|
||||
sc start Goodmans
|
||||
if errorlevel 1 ( echo [X] sc start failed. check testsigning + cert import. & exit /b 1 )
|
||||
|
||||
echo.
|
||||
echo [+] driver running. open DbgView as admin, filter on [goodmans]
|
||||
echo then:
|
||||
echo goodmans.exe load sample_guest.wasm
|
||||
echo goodmans.exe call 1 run_all
|
||||
echo goodmans.exe unload 1
|
||||
|
||||
endlocal
|
||||
@@ -0,0 +1,23 @@
|
||||
@echo off
|
||||
setlocal
|
||||
|
||||
net session >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo [X] must be run as Administrator.
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
sc query Goodmans >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo [*] service not present
|
||||
exit /b 0
|
||||
)
|
||||
|
||||
echo [*] sc stop Goodmans
|
||||
sc stop Goodmans >nul 2>&1
|
||||
|
||||
echo [*] sc delete Goodmans
|
||||
sc delete Goodmans
|
||||
|
||||
endlocal
|
||||
Reference in New Issue
Block a user