diff --git a/PSKDM/PSKDM.vcxproj b/PSKDM/PSKDM.vcxproj index 84e6de3..fde7a9a 100644 --- a/PSKDM/PSKDM.vcxproj +++ b/PSKDM/PSKDM.vcxproj @@ -202,7 +202,6 @@ - @@ -210,7 +209,6 @@ - diff --git a/PSKDM/PSKDM.vcxproj.filters b/PSKDM/PSKDM.vcxproj.filters index 44dc5b9..e2026b6 100644 --- a/PSKDM/PSKDM.vcxproj.filters +++ b/PSKDM/PSKDM.vcxproj.filters @@ -32,9 +32,6 @@ Source Files - - Source Files - @@ -70,8 +67,5 @@ Header Files - - Header Files - \ No newline at end of file diff --git a/PSKDM/map_driver.cpp b/PSKDM/map_driver.cpp index 2685c00..6a1f381 100644 --- a/PSKDM/map_driver.cpp +++ b/PSKDM/map_driver.cpp @@ -2,7 +2,6 @@ #include "mapper_ctx/mapper_ctx.hpp" #include "vdm_ctx/vdm_ctx.h" #include "vdm/vdm.hpp" -#include "set_mgr/set_mgr.hpp" namespace mapper { @@ -27,13 +26,13 @@ namespace mapper nasa::mem_ctx runtime_broker(v_ctx, runtime_broker_pid); nasa::mapper_ctx mapper(my_proc, runtime_broker); - // shoot the tires off the set manager thread..... - set_mgr::stop_setmgr(v_ctx, set_mgr::get_setmgr_pethread(v_ctx)); const auto [drv_base, drv_entry] = mapper.map(drv_buffer); + if (!drv_base || !drv_entry) return { mapper_error::init_failed, nullptr }; mapper.call_entry(drv_entry, entry_data); + if (!vdm::unload_drv(drv_handle, drv_key)) return { mapper_error::unload_error, nullptr }; diff --git a/PSKDM/set_mgr/set_mgr.cpp b/PSKDM/set_mgr/set_mgr.cpp deleted file mode 100644 index e2fd1c6..0000000 --- a/PSKDM/set_mgr/set_mgr.cpp +++ /dev/null @@ -1,77 +0,0 @@ -#include "set_mgr.hpp" - -namespace set_mgr -{ - auto get_setmgr_pethread(vdm::vdm_ctx& v_ctx)->PETHREAD - { - ULONG return_len = 0u; - std::size_t alloc_size = 0x1000u; - auto process_info = reinterpret_cast(malloc(alloc_size)); - - while (NtQuerySystemInformation - ( - SystemProcessInformation, - process_info, - alloc_size, - &return_len - ) == STATUS_INFO_LENGTH_MISMATCH) - process_info = reinterpret_cast( - realloc(process_info, alloc_size += 0x1000)); - - const auto og_ptr = process_info; - while (process_info && process_info->UniqueProcessId != (HANDLE)4) - process_info = reinterpret_cast( - reinterpret_cast(process_info) + process_info->NextEntryOffset); - - auto thread_info = reinterpret_cast( - reinterpret_cast(process_info) + sizeof SYSTEM_PROCESS_INFORMATION); - - static const auto ntoskrnl_base = - util::get_kmodule_base("ntoskrnl.exe"); - - const auto [ke_balance_um, ke_balance_rva] = - util::memory::sig_scan( - KE_BALANCE_SIG, KE_BALANCE_MASK); - - auto rip_rva = *reinterpret_cast(ke_balance_um + 19); - const auto ke_balance_set = ntoskrnl_base + ke_balance_rva + 23 + rip_rva; - - const auto [suspend_in_um, suspend_rva] = - util::memory::sig_scan(SUSPEND_THREAD_SIG, SUSPEND_THREAD_MASK); - - rip_rva = *reinterpret_cast(suspend_in_um + 1); - const auto ps_suspend_thread = reinterpret_cast(ntoskrnl_base + rip_rva + 5 + suspend_rva); - - static const auto lookup_pethread = - util::get_kmodule_export("ntoskrnl.exe", "PsLookupThreadByThreadId"); - - for (auto idx = 0u; idx < process_info->NumberOfThreads; ++idx) - { - if (thread_info[idx].StartAddress == reinterpret_cast(ke_balance_set)) - { - PETHREAD pethread; - auto result = v_ctx.syscall( - lookup_pethread, thread_info[idx].ClientId.UniqueThread, &pethread); - - free(og_ptr); - return pethread; - } - } - - free(og_ptr); - return {}; - } - - auto stop_setmgr(vdm::vdm_ctx& v_ctx, PETHREAD pethread) -> NTSTATUS - { - static const auto ntoskrnl_base = - util::get_kmodule_base("ntoskrnl.exe"); - - const auto [suspend_in_um, suspend_rva] = - util::memory::sig_scan(SUSPEND_THREAD_SIG, SUSPEND_THREAD_MASK); - - const auto rip_rva = *reinterpret_cast(suspend_in_um + 1); - const auto ps_suspend_thread = reinterpret_cast(ntoskrnl_base + rip_rva + 5 + suspend_rva); - return v_ctx.syscall(ps_suspend_thread, pethread, nullptr); - } -} \ No newline at end of file diff --git a/PSKDM/set_mgr/set_mgr.hpp b/PSKDM/set_mgr/set_mgr.hpp deleted file mode 100644 index beea970..0000000 --- a/PSKDM/set_mgr/set_mgr.hpp +++ /dev/null @@ -1,18 +0,0 @@ -#pragma once -#include "../vdm_ctx/vdm_ctx.h" - -using PETHREAD = PVOID; -using PsSuspendThread = NTSTATUS(*)(PETHREAD, PULONG); -using PsLookupThreadByThreadId = NTSTATUS(*)(HANDLE, PETHREAD*); - -#define KE_BALANCE_SIG "\x65\x48\x8B\x04\x25\x00\x00\x00\x00\x48\x8B\x88\x00\x00\x00\x00\x48\x8D\x05" -#define KE_BALANCE_MASK "xxxxx????xxx????xxx" - -#define SUSPEND_THREAD_SIG "\xE8\x00\x00\x00\x00\x8B\xF8\xBA\x50\x73\x53\x75" -#define SUSPEND_THREAD_MASK "x????xxxxxxx" - -namespace set_mgr -{ - auto get_setmgr_pethread(vdm::vdm_ctx& v_ctx)->PETHREAD; - auto stop_setmgr(vdm::vdm_ctx& v_ctx, PETHREAD pethread)->NTSTATUS; -} \ No newline at end of file diff --git a/PSKDM/util/util.hpp b/PSKDM/util/util.hpp index 2a7fd37..69b848c 100644 --- a/PSKDM/util/util.hpp +++ b/PSKDM/util/util.hpp @@ -319,54 +319,4 @@ namespace util } return NULL; } - - namespace memory - { - template - __forceinline auto sig_scan(const char(&signature)[pattern_length], const char(&mask)[pattern_length]) -> std::pair - { - static const auto ntoskrnl_module = - LoadLibraryEx( - "ntoskrnl.exe", - NULL, - DONT_RESOLVE_DLL_REFERENCES - ); - - static const auto p_idh = reinterpret_cast(ntoskrnl_module); - if (p_idh->e_magic != IMAGE_DOS_SIGNATURE) - return { {}, {} }; - - static const auto p_inh = reinterpret_cast((LPBYTE)ntoskrnl_module + p_idh->e_lfanew); - if (p_inh->Signature != IMAGE_NT_SIGNATURE) - return { {}, {} }; - - const auto pattern_view = - std::string_view - { - reinterpret_cast(ntoskrnl_module), - p_inh->OptionalHeader.SizeOfImage - }; - - std::array, pattern_length - 1> pattern{}; - for (std::size_t index = 0; index < pattern_length - 1; index++) - pattern[index] = { signature[index], mask[index] }; - - auto resultant_address = std::search - ( - pattern_view.cbegin(), - pattern_view.cend(), - pattern.cbegin(), - pattern.cend(), - [](char left, std::pair right) -> bool { - return (right.second == '?' || left == right.first); - }); - - const auto found_address = - resultant_address == pattern_view.cend() ? 0 : - reinterpret_cast(resultant_address.operator->()); - - const auto rva = found_address - reinterpret_cast(ntoskrnl_module); - return { found_address, rva }; - } - } } \ No newline at end of file diff --git a/um-example/PSKDM.lib b/um-example/PSKDM.lib index bf5f52e..e3cbb27 100644 Binary files a/um-example/PSKDM.lib and b/um-example/PSKDM.lib differ