_xeroxz
4 years ago
parent
45f2492246
commit
034209aae1
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,166 @@
|
|||||||
|
#include "RawDriver.hpp"
|
||||||
|
#include "ZwSwapCert.hpp"
|
||||||
|
|
||||||
|
// this function was taken from Kernel-Force-Delete...
|
||||||
|
// https://github.com/DragonQuestHero/Kernel-Force-Delete/blob/master/Kernel_Force_Delete/Kernel_Force_Delete.cc#L3
|
||||||
|
// (i cleaned it up a little and put it in here)
|
||||||
|
NTSTATUS Utils::SwapDriver(PUNICODE_STRING DriverPath, PVOID DriverBuffer, SIZE_T BufferSize)
|
||||||
|
{
|
||||||
|
HANDLE FileHandle;
|
||||||
|
NTSTATUS Status;
|
||||||
|
IO_STATUS_BLOCK IOBlock;
|
||||||
|
PDEVICE_OBJECT DeviceObject = nullptr;
|
||||||
|
PFILE_OBJECT FileObject = nullptr;
|
||||||
|
OBJECT_ATTRIBUTES FileAttributes;
|
||||||
|
|
||||||
|
RtlZeroMemory(&IOBlock, sizeof IOBlock);
|
||||||
|
InitializeObjectAttributes(&FileAttributes,
|
||||||
|
DriverPath,
|
||||||
|
OBJ_CASE_INSENSITIVE,
|
||||||
|
NULL,
|
||||||
|
NULL);
|
||||||
|
|
||||||
|
if ((Status = IoCreateFileSpecifyDeviceObjectHint(
|
||||||
|
&FileHandle,
|
||||||
|
SYNCHRONIZE | FILE_WRITE_ATTRIBUTES | FILE_READ_ATTRIBUTES | FILE_READ_DATA,
|
||||||
|
&FileAttributes,
|
||||||
|
&IOBlock,
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
|
||||||
|
FILE_OPEN,
|
||||||
|
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
CreateFileTypeNone,
|
||||||
|
NULL,
|
||||||
|
IO_IGNORE_SHARE_ACCESS_CHECK,
|
||||||
|
DeviceObject)) != STATUS_SUCCESS)
|
||||||
|
return Status;
|
||||||
|
|
||||||
|
|
||||||
|
if ((Status = ObReferenceObjectByHandle(
|
||||||
|
FileHandle, NULL, NULL, NULL, (PVOID*)&FileObject, NULL)) != STATUS_SUCCESS)
|
||||||
|
return Status;
|
||||||
|
|
||||||
|
// Make the driver file object section object null and then try
|
||||||
|
// and delete the file on disk...
|
||||||
|
FileObject->SectionObjectPointer->ImageSectionObject = 0;
|
||||||
|
FileObject->DeleteAccess = 1;
|
||||||
|
if ((Status = ZwDeleteFile(&FileAttributes)) != STATUS_SUCCESS)
|
||||||
|
return Status;
|
||||||
|
|
||||||
|
ObDereferenceObject(FileObject);
|
||||||
|
if ((Status = ZwClose(FileHandle)) != STATUS_SUCCESS)
|
||||||
|
return Status;
|
||||||
|
|
||||||
|
RtlZeroMemory(&IOBlock, sizeof IOBlock);
|
||||||
|
InitializeObjectAttributes(&FileAttributes, DriverPath,
|
||||||
|
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
|
||||||
|
NULL, NULL);
|
||||||
|
|
||||||
|
// Create a new file where the driver was on disk
|
||||||
|
// instead we are going to write a valid driver to disk...
|
||||||
|
// (by valid i mean signed by MS...)
|
||||||
|
if ((Status = ZwCreateFile(
|
||||||
|
&FileHandle,
|
||||||
|
GENERIC_WRITE,
|
||||||
|
&FileAttributes,
|
||||||
|
&IOBlock,
|
||||||
|
NULL,
|
||||||
|
FILE_ATTRIBUTE_NORMAL,
|
||||||
|
NULL,
|
||||||
|
FILE_OVERWRITE_IF,
|
||||||
|
FILE_SYNCHRONOUS_IO_NONALERT,
|
||||||
|
NULL,
|
||||||
|
NULL
|
||||||
|
)) != STATUS_SUCCESS)
|
||||||
|
return Status;
|
||||||
|
|
||||||
|
// Write the driver buffer to disk...
|
||||||
|
if ((Status = ZwWriteFile(
|
||||||
|
FileHandle,
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
&IOBlock,
|
||||||
|
DriverBuffer,
|
||||||
|
BufferSize,
|
||||||
|
NULL,
|
||||||
|
NULL
|
||||||
|
)) != STATUS_SUCCESS)
|
||||||
|
return Status;
|
||||||
|
|
||||||
|
return ZwClose(FileHandle);
|
||||||
|
}
|
||||||
|
|
||||||
|
PVOID Utils::MapDriver(UINT64 ModuleBase, UINT64 DriverBuffer)
|
||||||
|
{
|
||||||
|
// copy pe header...
|
||||||
|
PIMAGE_DOS_HEADER dosHeaders = (IMAGE_DOS_HEADER*)DriverBuffer;
|
||||||
|
PIMAGE_NT_HEADERS64 ntHeaders = (PIMAGE_NT_HEADERS64)(DriverBuffer + dosHeaders->e_lfanew);
|
||||||
|
|
||||||
|
// disable write protect bit in cr0...
|
||||||
|
{
|
||||||
|
auto cr0 = __readcr0();
|
||||||
|
cr0 &= 0xfffffffffffeffff;
|
||||||
|
__writecr0(cr0);
|
||||||
|
_disable();
|
||||||
|
}
|
||||||
|
|
||||||
|
// PE headers are not writeable (readonly i assume? so we disable WP bit)...
|
||||||
|
memcpy((PVOID)ModuleBase, (PVOID)DriverBuffer, ntHeaders->OptionalHeader.SizeOfHeaders);
|
||||||
|
|
||||||
|
// enable write protect bit in cr0...
|
||||||
|
{
|
||||||
|
auto cr0 = __readcr0();
|
||||||
|
cr0 |= 0x10000;
|
||||||
|
_enable();
|
||||||
|
__writecr0(cr0);
|
||||||
|
}
|
||||||
|
|
||||||
|
PIMAGE_SECTION_HEADER sections =
|
||||||
|
(PIMAGE_SECTION_HEADER)((UINT8*)&ntHeaders->OptionalHeader +
|
||||||
|
ntHeaders->FileHeader.SizeOfOptionalHeader);
|
||||||
|
|
||||||
|
// map sections...
|
||||||
|
for (UINT32 i = 0; i < ntHeaders->FileHeader.NumberOfSections; ++i)
|
||||||
|
{
|
||||||
|
PIMAGE_SECTION_HEADER section = §ions[i];
|
||||||
|
memcpy((PVOID)(ModuleBase + section->VirtualAddress),
|
||||||
|
(PVOID)(DriverBuffer + section->PointerToRawData), section->SizeOfRawData);
|
||||||
|
}
|
||||||
|
|
||||||
|
// return entry point...
|
||||||
|
return (PVOID)(ModuleBase + ntHeaders->OptionalHeader.AddressOfEntryPoint);
|
||||||
|
}
|
||||||
|
|
||||||
|
NTSTATUS ScDriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
|
||||||
|
{
|
||||||
|
UNICODE_STRING DriverPath;
|
||||||
|
NTSTATUS Result;
|
||||||
|
|
||||||
|
// get the path to the current driver on disk...
|
||||||
|
if ((Result = IoQueryFullDriverPath(DriverObject, &DriverPath)) != STATUS_SUCCESS)
|
||||||
|
return Result;
|
||||||
|
|
||||||
|
// replace file on disk with the MS driver...
|
||||||
|
if ((Result = Utils::SwapDriver(&DriverPath, RawDriver, MS_DRIVER_FILE_SIZE)) != STATUS_SUCCESS)
|
||||||
|
return Result;
|
||||||
|
|
||||||
|
// allocate a temp buffer, copy the MS driver into the buffer
|
||||||
|
// and then map the driver from the buffer into the first section
|
||||||
|
// of this driver + overwrite this drivers PE headers...
|
||||||
|
PVOID DriverTempBuffer =
|
||||||
|
ExAllocatePool(NonPagedPool, sizeof RawDriver);
|
||||||
|
|
||||||
|
memcpy(DriverTempBuffer, RawDriver, sizeof RawDriver);
|
||||||
|
PDRIVER_INITIALIZE SignedDriverEntry = (PDRIVER_INITIALIZE)
|
||||||
|
Utils::MapDriver((UINT64)DriverObject->DriverStart, (UINT64)DriverTempBuffer);
|
||||||
|
|
||||||
|
// change driver size and entry point to the mapped MS driver...
|
||||||
|
ExFreePool(DriverTempBuffer);
|
||||||
|
DriverObject->DriverSize = sizeof RawDriver;
|
||||||
|
DriverObject->DriverInit = SignedDriverEntry;
|
||||||
|
return DriverEntry(DriverObject, RegistryPath);
|
||||||
|
}
|
||||||
@ -0,0 +1,121 @@
|
|||||||
|
#pragma once
|
||||||
|
#include <ntifs.h>
|
||||||
|
#include <windef.h>
|
||||||
|
#include <intrin.h>
|
||||||
|
|
||||||
|
typedef struct _IMAGE_DOS_HEADER
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned short e_magic;
|
||||||
|
/* 0x0002 */ unsigned short e_cblp;
|
||||||
|
/* 0x0004 */ unsigned short e_cp;
|
||||||
|
/* 0x0006 */ unsigned short e_crlc;
|
||||||
|
/* 0x0008 */ unsigned short e_cparhdr;
|
||||||
|
/* 0x000a */ unsigned short e_minalloc;
|
||||||
|
/* 0x000c */ unsigned short e_maxalloc;
|
||||||
|
/* 0x000e */ unsigned short e_ss;
|
||||||
|
/* 0x0010 */ unsigned short e_sp;
|
||||||
|
/* 0x0012 */ unsigned short e_csum;
|
||||||
|
/* 0x0014 */ unsigned short e_ip;
|
||||||
|
/* 0x0016 */ unsigned short e_cs;
|
||||||
|
/* 0x0018 */ unsigned short e_lfarlc;
|
||||||
|
/* 0x001a */ unsigned short e_ovno;
|
||||||
|
/* 0x001c */ unsigned short e_res[4];
|
||||||
|
/* 0x0024 */ unsigned short e_oemid;
|
||||||
|
/* 0x0026 */ unsigned short e_oeminfo;
|
||||||
|
/* 0x0028 */ unsigned short e_res2[10];
|
||||||
|
/* 0x003c */ long e_lfanew;
|
||||||
|
} IMAGE_DOS_HEADER, * PIMAGE_DOS_HEADER; /* size: 0x0040 */
|
||||||
|
|
||||||
|
typedef struct _IMAGE_FILE_HEADER
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned short Machine;
|
||||||
|
/* 0x0002 */ unsigned short NumberOfSections;
|
||||||
|
/* 0x0004 */ unsigned long TimeDateStamp;
|
||||||
|
/* 0x0008 */ unsigned long PointerToSymbolTable;
|
||||||
|
/* 0x000c */ unsigned long NumberOfSymbols;
|
||||||
|
/* 0x0010 */ unsigned short SizeOfOptionalHeader;
|
||||||
|
/* 0x0012 */ unsigned short Characteristics;
|
||||||
|
} IMAGE_FILE_HEADER, * PIMAGE_FILE_HEADER; /* size: 0x0014 */
|
||||||
|
|
||||||
|
typedef struct _IMAGE_DATA_DIRECTORY
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned long VirtualAddress;
|
||||||
|
/* 0x0004 */ unsigned long Size;
|
||||||
|
} IMAGE_DATA_DIRECTORY, * PIMAGE_DATA_DIRECTORY; /* size: 0x0008 */
|
||||||
|
|
||||||
|
typedef struct _IMAGE_OPTIONAL_HEADER64
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned short Magic;
|
||||||
|
/* 0x0002 */ unsigned char MajorLinkerVersion;
|
||||||
|
/* 0x0003 */ unsigned char MinorLinkerVersion;
|
||||||
|
/* 0x0004 */ unsigned long SizeOfCode;
|
||||||
|
/* 0x0008 */ unsigned long SizeOfInitializedData;
|
||||||
|
/* 0x000c */ unsigned long SizeOfUninitializedData;
|
||||||
|
/* 0x0010 */ unsigned long AddressOfEntryPoint;
|
||||||
|
/* 0x0014 */ unsigned long BaseOfCode;
|
||||||
|
/* 0x0018 */ unsigned __int64 ImageBase;
|
||||||
|
/* 0x0020 */ unsigned long SectionAlignment;
|
||||||
|
/* 0x0024 */ unsigned long FileAlignment;
|
||||||
|
/* 0x0028 */ unsigned short MajorOperatingSystemVersion;
|
||||||
|
/* 0x002a */ unsigned short MinorOperatingSystemVersion;
|
||||||
|
/* 0x002c */ unsigned short MajorImageVersion;
|
||||||
|
/* 0x002e */ unsigned short MinorImageVersion;
|
||||||
|
/* 0x0030 */ unsigned short MajorSubsystemVersion;
|
||||||
|
/* 0x0032 */ unsigned short MinorSubsystemVersion;
|
||||||
|
/* 0x0034 */ unsigned long Win32VersionValue;
|
||||||
|
/* 0x0038 */ unsigned long SizeOfImage;
|
||||||
|
/* 0x003c */ unsigned long SizeOfHeaders;
|
||||||
|
/* 0x0040 */ unsigned long CheckSum;
|
||||||
|
/* 0x0044 */ unsigned short Subsystem;
|
||||||
|
/* 0x0046 */ unsigned short DllCharacteristics;
|
||||||
|
/* 0x0048 */ unsigned __int64 SizeOfStackReserve;
|
||||||
|
/* 0x0050 */ unsigned __int64 SizeOfStackCommit;
|
||||||
|
/* 0x0058 */ unsigned __int64 SizeOfHeapReserve;
|
||||||
|
/* 0x0060 */ unsigned __int64 SizeOfHeapCommit;
|
||||||
|
/* 0x0068 */ unsigned long LoaderFlags;
|
||||||
|
/* 0x006c */ unsigned long NumberOfRvaAndSizes;
|
||||||
|
/* 0x0070 */ struct _IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||||
|
} IMAGE_OPTIONAL_HEADER64, * PIMAGE_OPTIONAL_HEADER64; /* size: 0x00f0 */
|
||||||
|
|
||||||
|
typedef struct _IMAGE_NT_HEADERS64
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned long Signature;
|
||||||
|
/* 0x0004 */ struct _IMAGE_FILE_HEADER FileHeader;
|
||||||
|
/* 0x0018 */ struct _IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||||||
|
} IMAGE_NT_HEADERS64, * PIMAGE_NT_HEADERS64; /* size: 0x0108 */
|
||||||
|
|
||||||
|
typedef struct _IMAGE_SECTION_HEADER
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned char Name[8];
|
||||||
|
union
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
/* 0x0008 */ unsigned long PhysicalAddress;
|
||||||
|
/* 0x0008 */ unsigned long VirtualSize;
|
||||||
|
}; /* size: 0x0004 */
|
||||||
|
} /* size: 0x0004 */ Misc;
|
||||||
|
/* 0x000c */ unsigned long VirtualAddress;
|
||||||
|
/* 0x0010 */ unsigned long SizeOfRawData;
|
||||||
|
/* 0x0014 */ unsigned long PointerToRawData;
|
||||||
|
/* 0x0018 */ unsigned long PointerToRelocations;
|
||||||
|
/* 0x001c */ unsigned long PointerToLinenumbers;
|
||||||
|
/* 0x0020 */ unsigned short NumberOfRelocations;
|
||||||
|
/* 0x0022 */ unsigned short NumberOfLinenumbers;
|
||||||
|
/* 0x0024 */ unsigned long Characteristics;
|
||||||
|
} IMAGE_SECTION_HEADER, * PIMAGE_SECTION_HEADER; /* size: 0x0028 */
|
||||||
|
|
||||||
|
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);
|
||||||
|
|
||||||
|
// WARNING: make sure to make driver.sys .text section RWX (E0000020)...
|
||||||
|
namespace Utils
|
||||||
|
{
|
||||||
|
// swaps driver on disk with signed MS driver....
|
||||||
|
NTSTATUS SwapDriver(PUNICODE_STRING DriverPath, PVOID DriverBuffer, SIZE_T BufferSize);
|
||||||
|
|
||||||
|
// only maps sections, doesnt resolve relocs or imports as its not needed...
|
||||||
|
PVOID MapDriver(UINT64 ModuleBase, UINT64 DriverBuffer);
|
||||||
|
}
|
||||||
|
|
||||||
|
// set this to your entry point in the linker...
|
||||||
|
extern "C" NTSTATUS ScDriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="Source Files">
|
||||||
|
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||||
|
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Header Files">
|
||||||
|
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||||
|
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="RawDriver.hpp">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="ZwSwapCert.hpp">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="ZwSwapCert.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<PropertyGroup />
|
||||||
|
</Project>
|
||||||
Loading…
Reference in new issue