diff --git a/PSKDM/PSKDM.vcxproj b/PSKDM/PSKDM.vcxproj
index 84e6de3..fde7a9a 100644
--- a/PSKDM/PSKDM.vcxproj
+++ b/PSKDM/PSKDM.vcxproj
@@ -202,7 +202,6 @@
-
@@ -210,7 +209,6 @@
-
diff --git a/PSKDM/PSKDM.vcxproj.filters b/PSKDM/PSKDM.vcxproj.filters
index 44dc5b9..e2026b6 100644
--- a/PSKDM/PSKDM.vcxproj.filters
+++ b/PSKDM/PSKDM.vcxproj.filters
@@ -32,9 +32,6 @@
Source Files
-
- Source Files
-
@@ -70,8 +67,5 @@
Header Files
-
- Header Files
-
\ No newline at end of file
diff --git a/PSKDM/map_driver.cpp b/PSKDM/map_driver.cpp
index 2685c00..6a1f381 100644
--- a/PSKDM/map_driver.cpp
+++ b/PSKDM/map_driver.cpp
@@ -2,7 +2,6 @@
#include "mapper_ctx/mapper_ctx.hpp"
#include "vdm_ctx/vdm_ctx.h"
#include "vdm/vdm.hpp"
-#include "set_mgr/set_mgr.hpp"
namespace mapper
{
@@ -27,13 +26,13 @@ namespace mapper
nasa::mem_ctx runtime_broker(v_ctx, runtime_broker_pid);
nasa::mapper_ctx mapper(my_proc, runtime_broker);
- // shoot the tires off the set manager thread.....
- set_mgr::stop_setmgr(v_ctx, set_mgr::get_setmgr_pethread(v_ctx));
const auto [drv_base, drv_entry] = mapper.map(drv_buffer);
+
if (!drv_base || !drv_entry)
return { mapper_error::init_failed, nullptr };
mapper.call_entry(drv_entry, entry_data);
+
if (!vdm::unload_drv(drv_handle, drv_key))
return { mapper_error::unload_error, nullptr };
diff --git a/PSKDM/set_mgr/set_mgr.cpp b/PSKDM/set_mgr/set_mgr.cpp
deleted file mode 100644
index e2fd1c6..0000000
--- a/PSKDM/set_mgr/set_mgr.cpp
+++ /dev/null
@@ -1,77 +0,0 @@
-#include "set_mgr.hpp"
-
-namespace set_mgr
-{
- auto get_setmgr_pethread(vdm::vdm_ctx& v_ctx)->PETHREAD
- {
- ULONG return_len = 0u;
- std::size_t alloc_size = 0x1000u;
- auto process_info = reinterpret_cast(malloc(alloc_size));
-
- while (NtQuerySystemInformation
- (
- SystemProcessInformation,
- process_info,
- alloc_size,
- &return_len
- ) == STATUS_INFO_LENGTH_MISMATCH)
- process_info = reinterpret_cast(
- realloc(process_info, alloc_size += 0x1000));
-
- const auto og_ptr = process_info;
- while (process_info && process_info->UniqueProcessId != (HANDLE)4)
- process_info = reinterpret_cast(
- reinterpret_cast(process_info) + process_info->NextEntryOffset);
-
- auto thread_info = reinterpret_cast(
- reinterpret_cast(process_info) + sizeof SYSTEM_PROCESS_INFORMATION);
-
- static const auto ntoskrnl_base =
- util::get_kmodule_base("ntoskrnl.exe");
-
- const auto [ke_balance_um, ke_balance_rva] =
- util::memory::sig_scan(
- KE_BALANCE_SIG, KE_BALANCE_MASK);
-
- auto rip_rva = *reinterpret_cast(ke_balance_um + 19);
- const auto ke_balance_set = ntoskrnl_base + ke_balance_rva + 23 + rip_rva;
-
- const auto [suspend_in_um, suspend_rva] =
- util::memory::sig_scan(SUSPEND_THREAD_SIG, SUSPEND_THREAD_MASK);
-
- rip_rva = *reinterpret_cast(suspend_in_um + 1);
- const auto ps_suspend_thread = reinterpret_cast(ntoskrnl_base + rip_rva + 5 + suspend_rva);
-
- static const auto lookup_pethread =
- util::get_kmodule_export("ntoskrnl.exe", "PsLookupThreadByThreadId");
-
- for (auto idx = 0u; idx < process_info->NumberOfThreads; ++idx)
- {
- if (thread_info[idx].StartAddress == reinterpret_cast(ke_balance_set))
- {
- PETHREAD pethread;
- auto result = v_ctx.syscall(
- lookup_pethread, thread_info[idx].ClientId.UniqueThread, &pethread);
-
- free(og_ptr);
- return pethread;
- }
- }
-
- free(og_ptr);
- return {};
- }
-
- auto stop_setmgr(vdm::vdm_ctx& v_ctx, PETHREAD pethread) -> NTSTATUS
- {
- static const auto ntoskrnl_base =
- util::get_kmodule_base("ntoskrnl.exe");
-
- const auto [suspend_in_um, suspend_rva] =
- util::memory::sig_scan(SUSPEND_THREAD_SIG, SUSPEND_THREAD_MASK);
-
- const auto rip_rva = *reinterpret_cast(suspend_in_um + 1);
- const auto ps_suspend_thread = reinterpret_cast(ntoskrnl_base + rip_rva + 5 + suspend_rva);
- return v_ctx.syscall(ps_suspend_thread, pethread, nullptr);
- }
-}
\ No newline at end of file
diff --git a/PSKDM/set_mgr/set_mgr.hpp b/PSKDM/set_mgr/set_mgr.hpp
deleted file mode 100644
index beea970..0000000
--- a/PSKDM/set_mgr/set_mgr.hpp
+++ /dev/null
@@ -1,18 +0,0 @@
-#pragma once
-#include "../vdm_ctx/vdm_ctx.h"
-
-using PETHREAD = PVOID;
-using PsSuspendThread = NTSTATUS(*)(PETHREAD, PULONG);
-using PsLookupThreadByThreadId = NTSTATUS(*)(HANDLE, PETHREAD*);
-
-#define KE_BALANCE_SIG "\x65\x48\x8B\x04\x25\x00\x00\x00\x00\x48\x8B\x88\x00\x00\x00\x00\x48\x8D\x05"
-#define KE_BALANCE_MASK "xxxxx????xxx????xxx"
-
-#define SUSPEND_THREAD_SIG "\xE8\x00\x00\x00\x00\x8B\xF8\xBA\x50\x73\x53\x75"
-#define SUSPEND_THREAD_MASK "x????xxxxxxx"
-
-namespace set_mgr
-{
- auto get_setmgr_pethread(vdm::vdm_ctx& v_ctx)->PETHREAD;
- auto stop_setmgr(vdm::vdm_ctx& v_ctx, PETHREAD pethread)->NTSTATUS;
-}
\ No newline at end of file
diff --git a/PSKDM/util/util.hpp b/PSKDM/util/util.hpp
index 2a7fd37..69b848c 100644
--- a/PSKDM/util/util.hpp
+++ b/PSKDM/util/util.hpp
@@ -319,54 +319,4 @@ namespace util
}
return NULL;
}
-
- namespace memory
- {
- template
- __forceinline auto sig_scan(const char(&signature)[pattern_length], const char(&mask)[pattern_length]) -> std::pair
- {
- static const auto ntoskrnl_module =
- LoadLibraryEx(
- "ntoskrnl.exe",
- NULL,
- DONT_RESOLVE_DLL_REFERENCES
- );
-
- static const auto p_idh = reinterpret_cast(ntoskrnl_module);
- if (p_idh->e_magic != IMAGE_DOS_SIGNATURE)
- return { {}, {} };
-
- static const auto p_inh = reinterpret_cast((LPBYTE)ntoskrnl_module + p_idh->e_lfanew);
- if (p_inh->Signature != IMAGE_NT_SIGNATURE)
- return { {}, {} };
-
- const auto pattern_view =
- std::string_view
- {
- reinterpret_cast(ntoskrnl_module),
- p_inh->OptionalHeader.SizeOfImage
- };
-
- std::array, pattern_length - 1> pattern{};
- for (std::size_t index = 0; index < pattern_length - 1; index++)
- pattern[index] = { signature[index], mask[index] };
-
- auto resultant_address = std::search
- (
- pattern_view.cbegin(),
- pattern_view.cend(),
- pattern.cbegin(),
- pattern.cend(),
- [](char left, std::pair right) -> bool {
- return (right.second == '?' || left == right.first);
- });
-
- const auto found_address =
- resultant_address == pattern_view.cend() ? 0 :
- reinterpret_cast(resultant_address.operator->());
-
- const auto rva = found_address - reinterpret_cast(ntoskrnl_module);
- return { found_address, rva };
- }
- }
}
\ No newline at end of file
diff --git a/um-example/PSKDM.lib b/um-example/PSKDM.lib
index bf5f52e..e3cbb27 100644
Binary files a/um-example/PSKDM.lib and b/um-example/PSKDM.lib differ