Add new file

loadup.hpp

@@ -0,0 +1,251 @@
+#pragma once
+#include <Windows.h>
+#include <Winternl.h>
+#include <string>
+#include <fstream>
+
+#pragma comment(lib, "ntdll.lib")
+using nt_load_driver_t = NTSTATUS(__fastcall*)(PUNICODE_STRING);
+using nt_unload_driver_t = NTSTATUS(__fastcall*)(PUNICODE_STRING);
+
+namespace util
+{
+	inline bool delete_service_entry(const std::string& service_name)
+	{
+		HKEY reg_handle;
+		static const std::string reg_key("System\\CurrentControlSet\\Services\\");
+
+		auto result = RegOpenKeyA(
+			HKEY_LOCAL_MACHINE,
+			reg_key.c_str(),
+			&reg_handle
+		);
+
+		RegCloseKey(reg_handle);
+		return ERROR_SUCCESS == RegDeleteKeyA(reg_handle, service_name.data());
+	}
+
+	inline bool create_service_entry(const std::string& drv_path, const std::string& service_name)
+	{
+		HKEY reg_handle;
+		std::string reg_key("System\\CurrentControlSet\\Services\\");
+		reg_key += service_name;
+
+		auto result = RegCreateKeyA(
+			HKEY_LOCAL_MACHINE,
+			reg_key.c_str(),
+			&reg_handle
+		);
+
+		if (result != ERROR_SUCCESS)
+			return false;
+
+		//
+		// set type to 1 (kernel)
+		//
+		constexpr std::uint8_t type_value = 1;
+		result = RegSetValueExA(
+			reg_handle,
+			"Type",
+			NULL,
+			REG_DWORD,
+			&type_value,
+			4u
+		);
+
+		if (result != ERROR_SUCCESS)
+			return false;
+
+		//
+		// set error control to 3
+		//
+		constexpr std::uint8_t error_control_value = 3;
+		result = RegSetValueExA(
+			reg_handle,
+			"ErrorControl",
+			NULL,
+			REG_DWORD,
+			&error_control_value,
+			4u
+		);
+
+		if (result != ERROR_SUCCESS)
+			return false;
+
+		//
+		// set start to 3
+		//
+		constexpr std::uint8_t start_value = 3;
+		result = RegSetValueExA(
+			reg_handle,
+			"Start",
+			NULL,
+			REG_DWORD,
+			&start_value,
+			4u
+		);
+
+		if (result != ERROR_SUCCESS)
+			return false;
+
+		//
+		// set image path to the driver on disk
+		//
+		result = RegSetValueExA(
+			reg_handle,
+			"ImagePath",
+			NULL,
+			REG_SZ,
+			(std::uint8_t*) drv_path.c_str(),
+			drv_path.size()
+		);
+
+		if (result != ERROR_SUCCESS)
+			return false;
+
+		return ERROR_SUCCESS == RegCloseKey(reg_handle);
+	}
+
+	// this function was coded by paracord: https://githacks.org/snippets/4#L94 
+	inline bool enable_privilege(const std::wstring& privilege_name)
+	{
+		HANDLE token_handle = nullptr;
+		if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token_handle))
+			return false;
+
+		LUID luid{};
+		if (!LookupPrivilegeValueW(nullptr, privilege_name.data(), &luid))
+			return false;
+
+		TOKEN_PRIVILEGES token_state{};
+		token_state.PrivilegeCount = 1;
+		token_state.Privileges[0].Luid = luid;
+		token_state.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
+
+		if (!AdjustTokenPrivileges(token_handle, FALSE, &token_state, sizeof(TOKEN_PRIVILEGES), nullptr, nullptr))
+			return false;
+
+		CloseHandle(token_handle);
+		return true;
+	}
+
+	inline std::string get_service_image_path(const std::string& service_name)
+	{
+		HKEY reg_handle;
+		DWORD bytes_read;
+		char image_path[0xFF];
+		static const std::string reg_key("System\\CurrentControlSet\\Services\\");
+
+		auto result = RegOpenKeyA(
+			HKEY_LOCAL_MACHINE,
+			reg_key.c_str(),
+			&reg_handle
+		);
+
+		result = RegGetValueA(
+			reg_handle,
+			"ImagePath",
+			service_name.c_str(),
+			REG_SZ, NULL,
+			image_path,
+			&bytes_read
+		);
+
+		RegCloseKey(reg_handle);
+		return std::string(image_path);
+	}
+}
+
+namespace driver
+{
+	inline bool load(const std::string& drv_path, const std::string& service_name)
+	{
+		if (!util::enable_privilege(L"SeLoadDriverPrivilege"))
+			return false;
+
+		if (!util::create_service_entry("\\??\\" + std::filesystem::absolute(std::filesystem::path(drv_path)).string(), service_name))
+			return false;
+
+		std::string reg_path("\\Registry\\Machine\\System\\CurrentControlSet\\Services\\");
+		reg_path += service_name;
+
+		static const auto lp_nt_load_drv =
+			::GetProcAddress(
+				GetModuleHandleA("ntdll.dll"),
+				"NtLoadDriver"
+			);
+
+		if (lp_nt_load_drv)
+		{
+			ANSI_STRING driver_rep_path_cstr;
+			UNICODE_STRING driver_reg_path_unicode;
+
+			RtlInitAnsiString(&driver_rep_path_cstr, reg_path.c_str());
+			RtlAnsiStringToUnicodeString(&driver_reg_path_unicode, &driver_rep_path_cstr, true);
+			return ERROR_SUCCESS == reinterpret_cast<nt_load_driver_t>(lp_nt_load_drv)(&driver_reg_path_unicode);
+		}
+		return false;
+	}
+
+	inline std::tuple<bool, std::string> load(const std::vector<std::uint8_t>& drv_buffer)
+	{
+		static const auto random_file_name = [](std::size_t length) -> std::string
+		{
+			static const auto randchar = []() -> char
+			{
+				const char charset[] =
+					"0123456789"
+					"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+					"abcdefghijklmnopqrstuvwxyz";
+				const std::size_t max_index = (sizeof(charset) - 1);
+				return charset[rand() % max_index];
+			};
+			std::string str(length, 0);
+			std::generate_n(str.begin(), length, randchar);
+			return str;
+		};
+
+		const auto service_name = random_file_name(16);
+		const auto file_path = std::filesystem::temp_directory_path().string() + random_file_name(16);
+		std::ofstream output_file(file_path.c_str(), std::ios::binary);
+
+		output_file.write((char*)drv_buffer.data(), drv_buffer.size());
+		output_file.close();
+
+		return { load(file_path, service_name), service_name };
+	}
+
+	inline std::tuple<bool, std::string> load(const void* buffer, const std::size_t size)
+	{
+		std::vector<std::uint8_t> image((std::uint8_t*)buffer, (std::uint8_t*)buffer + size);
+		return load(image);
+	}
+
+	inline bool unload(const std::string& service_name)
+	{
+		std::string reg_path("\\Registry\\Machine\\System\\CurrentControlSet\\Services\\");
+		reg_path += service_name;
+
+		static const auto lp_nt_unload_drv =
+			::GetProcAddress(
+				GetModuleHandleA("ntdll.dll"),
+				"NtUnloadDriver"
+			);
+
+		if (lp_nt_unload_drv)
+		{
+			ANSI_STRING driver_rep_path_cstr;
+			UNICODE_STRING driver_reg_path_unicode;
+
+			RtlInitAnsiString(&driver_rep_path_cstr, reg_path.c_str());
+			RtlAnsiStringToUnicodeString(&driver_reg_path_unicode, &driver_rep_path_cstr, true);
+
+			const bool unload_drv = !reinterpret_cast<nt_unload_driver_t>(lp_nt_unload_drv)(&driver_reg_path_unicode);
+			const bool delete_drv = std::filesystem::remove(util::get_service_image_path(service_name));
+			const bool delete_reg = util::delete_service_entry(service_name);
+
+			return unload_drv && delete_drv && delete_reg;
+		}
+		return false;
+	}
+}