diff --git a/buffer_dump.dll b/buffer/buffer_dump.dll similarity index 100% rename from buffer_dump.dll rename to buffer/buffer_dump.dll diff --git a/buffer_dump.i64 b/buffer/buffer_dump.i64 similarity index 100% rename from buffer_dump.i64 rename to buffer/buffer_dump.i64 diff --git a/driver.sys b/driver/driver.sys similarity index 100% rename from driver.sys rename to driver/driver.sys diff --git a/driver.sys.i64 b/driver/driver.sys.i64 similarity index 97% rename from driver.sys.i64 rename to driver/driver.sys.i64 index a4e5e7d..17aec4e 100644 Binary files a/driver.sys.i64 and b/driver/driver.sys.i64 differ diff --git a/ida_pages/ioctl_hook_setup.html b/driver/html/ioctl_hook_setup.html similarity index 100% rename from ida_pages/ioctl_hook_setup.html rename to driver/html/ioctl_hook_setup.html diff --git a/images/ioctl_hook_driver.png b/driver/images/ioctl_hook_driver.png similarity index 100% rename from images/ioctl_hook_driver.png rename to driver/images/ioctl_hook_driver.png diff --git a/images/spoofer_paste.png b/driver/images/spoofer_paste_1.png similarity index 100% rename from images/spoofer_paste.png rename to driver/images/spoofer_paste_1.png diff --git a/images/nsiproxy_paste.PNG b/driver/images/spoofer_paste_2.PNG similarity index 100% rename from images/nsiproxy_paste.PNG rename to driver/images/spoofer_paste_2.PNG diff --git a/images/amlegit_diagram.png b/images/amlegit_diagram.png deleted file mode 100644 index 34bc792..0000000 Binary files a/images/amlegit_diagram.png and /dev/null differ diff --git a/images/lapex_imports.png b/images/lapex_imports.png deleted file mode 100644 index 10415a7..0000000 Binary files a/images/lapex_imports.png and /dev/null differ diff --git a/inject/images/DeviceIoControl.PNG b/inject/images/DeviceIoControl.PNG new file mode 100644 index 0000000..ceb4078 Binary files /dev/null and b/inject/images/DeviceIoControl.PNG differ diff --git a/inject_dump.dll b/inject/inject_dump.dll similarity index 100% rename from inject_dump.dll rename to inject/inject_dump.dll diff --git a/inject_dump.i64 b/inject/inject_dump.i64 similarity index 98% rename from inject_dump.i64 rename to inject/inject_dump.i64 index 298dce3..e0a47c8 100644 Binary files a/inject_dump.i64 and b/inject/inject_dump.i64 differ diff --git a/lapex.dll b/lapex/lapex.dll similarity index 100% rename from lapex.dll rename to lapex/lapex.dll diff --git a/lapex.dll.i64 b/lapex/lapex.dll.i64 similarity index 100% rename from lapex.dll.i64 rename to lapex/lapex.dll.i64 diff --git a/llauncher/html/export_inject.html b/llauncher/html/export_inject.html new file mode 100644 index 0000000..cef94ba --- /dev/null +++ b/llauncher/html/export_inject.html @@ -0,0 +1,17 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAC0C +.text:00007FF7D93BAC0C loc_7FF7D93BAC0C: ; DATA XREF: sub_7FF7D95E2D10-97C6D↓o +.text:00007FF7D93BAC0C call export_inject_addr ; ExportInject("Respawn001", "lapex.dll"); +.text:00007FF7D93BAC0E test al, al +.text:00007FF7D93BAC10 lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAC14 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAC18 jnz short dll_injected_success ; if (ExportInject("Respawn001", "lapex.dll")) + diff --git a/llauncher/html/export_load.html b/llauncher/html/export_load.html new file mode 100644 index 0000000..0a7c0ce --- /dev/null +++ b/llauncher/html/export_load.html @@ -0,0 +1,22 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAD9E ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD9E call export_loader_addr ; ExportLoad() +.text:00007FF7D93BADA0 test al, al +.text:00007FF7D93BADA2 lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BADA6 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BADAA jnz short loaded_intel_driver ; if(ExportLoad()) +.text:00007FF7D93BADAC mov edx, 20h ; ' ' +.text:00007FF7D93BADB1 lea rcx, aFailedToLoadVu ; "Failed to load vulnerable driver" +.text:00007FF7D93BADB8 call sub_7FF7D958DEFC +.text:00007FF7D93BADBD int 3 ; Trap to Debugger +.text:00007FF7D93BADBE ; --------------------------------------------------------------------------- +.text:00007FF7D93BADBE mov [rbp+arg_8], get_proc_result + diff --git a/llauncher/html/export_map.html b/llauncher/html/export_map.html new file mode 100644 index 0000000..4a66215 --- /dev/null +++ b/llauncher/html/export_map.html @@ -0,0 +1,19 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAE03 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE03 lea rcx, aDriverSys ; "driver.sys" +.text:00007FF7D93BAE0A call export_map_addr ; ExportMap("driver.sys") +.text:00007FF7D93BAE0C test al, al +.text:00007FF7D93BAE0E +.text:00007FF7D93BAE0E loc_7FF7D93BAE0E: ; DATA XREF: sub_7FF7D957BEA6-FC4D7↓o +.text:00007FF7D93BAE0E lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAE12 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAE16 jnz short mapped_driver_success ; if(ExportMap("driver.sys")) + diff --git a/llauncher/html/export_spoof.html b/llauncher/html/export_spoof.html new file mode 100644 index 0000000..e9ed734 --- /dev/null +++ b/llauncher/html/export_spoof.html @@ -0,0 +1,16 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAFC6 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAFC6 call export_spoof_addr ; ExportSpoof(); +.text:00007FF7D93BAFC8 test al, al +.text:00007FF7D93BAFCA lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAFCE mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAFD2 jnz short loc_7FF7D93BAFF3 ; if(!ExportSpoof()) + diff --git a/llauncher/html/getprocaddr_export_inject.html b/llauncher/html/getprocaddr_export_inject.html new file mode 100644 index 0000000..cdca811 --- /dev/null +++ b/llauncher/html/getprocaddr_export_inject.html @@ -0,0 +1,18 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAB6E ; --------------------------------------------------------------------------- +.text:00007FF7D93BAB6E lea rdx, ProcName ; "ExportInject" +.text:00007FF7D93BAB75 lea rcx, hModule ; hModule +.text:00007FF7D93BAB7C push get_proc_result +.text:00007FF7D93BAB7D call GetProcAddress_Wrapper ; GetProcAddress(InjectModuleHandle, "ExportInject") +.text:00007FF7D93BAB82 mov export_inject_addr, get_proc_result +.text:00007FF7D93BAB85 test get_proc_result, get_proc_result +.text:00007FF7D93BAB88 jnz short loc_7FF7D93BABB2 ; if(GetProcAddress(InjectModuleHandle, "ExportInject")) + diff --git a/llauncher/html/getprocaddr_export_spoof.html b/llauncher/html/getprocaddr_export_spoof.html new file mode 100644 index 0000000..6f3dcc9 --- /dev/null +++ b/llauncher/html/getprocaddr_export_spoof.html @@ -0,0 +1,28 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAF36 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAF36 lea rdx, aExportspoof ; "ExportSpoof" +.text:00007FF7D93BAF3D +.text:00007FF7D93BAF3D loc_7FF7D93BAF3D: ; DATA XREF: sub_7FF7D95C26CF-1AD520↓o +.text:00007FF7D93BAF3D lea rcx, hModule +.text:00007FF7D93BAF44 push get_proc_result +.text:00007FF7D93BAF45 call GetProcAddress_Wrapper_3 ; GetProcAddress(InjectModuleHandle, "ExportSpoof"); +.text:00007FF7D93BAF4A mov export_spoof_addr, get_proc_result +.text:00007FF7D93BAF4D test get_proc_result, get_proc_result +.text:00007FF7D93BAF50 jnz short loc_7FF7D93BAF7A ; if(!GetProcAddress(InjectModuleHandle, "ExportSpoof")) +.text:00007FF7D93BAF52 lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAF56 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAF5A lea edx, [export_spoof_addr+15h] +.text:00007FF7D93BAF5D lea rcx, aFailedToGetExp ; "Failed to get exports" +.text:00007FF7D93BAF64 call sub_7FF7D951A927 +.text:00007FF7D93BAF69 int 3 ; Trap to Debugger +.text:00007FF7D93BAF6A ; --------------------------------------------------------------------------- +.text:00007FF7D93BAF6A mov [rbp+arg_8], get_proc_result + diff --git a/llauncher/html/getprocaddr_map_load.html b/llauncher/html/getprocaddr_map_load.html new file mode 100644 index 0000000..0e156c8 --- /dev/null +++ b/llauncher/html/getprocaddr_map_load.html @@ -0,0 +1,31 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAD1A ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD1A lea rdx, aExportload ; "ExportLoad" +.text:00007FF7D93BAD21 lea rcx, InjectModuleHandle ; handle to inject.dll +.text:00007FF7D93BAD28 push export_map_addr +.text:00007FF7D93BAD29 call GetProcAddress_Wrapper_0 ; GetProcAddress(InjectHandle, "ExportLoad"); +.text:00007FF7D93BAD2E +.text:00007FF7D93BAD2E loc_7FF7D93BAD2E: ; DATA XREF: sub_7FF7D954B379-8B56A↓o +.text:00007FF7D93BAD2E ; sub_7FF7D953050F+19↓o +.text:00007FF7D93BAD2E mov export_loader_addr, get_proc_result +.text:00007FF7D93BAD31 lea rdx, aExportmap ; "ExportMap" +.text:00007FF7D93BAD38 lea rcx, InjectModuleHandle +.text:00007FF7D93BAD3F call GetProcAddress_Wrapper_1 ; GetProcAddress(InjectHandle, "ExportMap"); +.text:00007FF7D93BAD44 int 3 ; Trap to Debugger +.text:00007FF7D93BAD45 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD45 mov export_map_addr, get_proc_result +.text:00007FF7D93BAD48 test export_loader_addr, export_loader_addr +.text:00007FF7D93BAD4B jz get_import_failed ; if(!GetProcAddress(InjectHandle, "ExportLoad")) +.text:00007FF7D93BAD51 +.text:00007FF7D93BAD51 loc_7FF7D93BAD51: ; DATA XREF: sub_7FF7D94AAA89+10F799↓o +.text:00007FF7D93BAD51 test get_proc_result, get_proc_result +.text:00007FF7D93BAD54 jz get_import_failed ; if(!GetProcAddress(InjectHandle, "ExportMap")) + diff --git a/llauncher/html/load_and_map.html b/llauncher/html/load_and_map.html new file mode 100644 index 0000000..62b5612 --- /dev/null +++ b/llauncher/html/load_and_map.html @@ -0,0 +1,236 @@ + + + + +IDA - llauncher_dump.i64 (llauncher_dump.exe) C:\Users\xerox\Desktop\amlegit.com\files\llauncher\llauncher_dump.i64 + + + + +.text:00007FF7D93BAC80 +.text:00007FF7D93BAC80 ; =============== S U B R O U T I N E ======================================= +.text:00007FF7D93BAC80 +.text:00007FF7D93BAC80 ; Attributes: noreturn bp-based frame +.text:00007FF7D93BAC80 +.text:00007FF7D93BAC80 load_driver proc near ; CODE XREF: sub_7FF7D93BB220+66↓p +.text:00007FF7D93BAC80 ; DATA XREF: .vmp1:00007FF7D9CB5F14↓o +.text:00007FF7D93BAC80 +.text:00007FF7D93BAC80 arg_0 = qword ptr 20h +.text:00007FF7D93BAC80 arg_8 = qword ptr 28h +.text:00007FF7D93BAC80 arg_10 = qword ptr 30h +.text:00007FF7D93BAC80 arg_18 = qword ptr 38h +.text:00007FF7D93BAC80 +.text:00007FF7D93BAC80 get_proc_result = rax +.text:00007FF7D93BAC80 export_map_addr = rdi +.text:00007FF7D93BAC80 export_loader_addr = rsi +.text:00007FF7D93BAC80 ; __unwind { // sub_7FF7D93BD226 +.text:00007FF7D93BAC80 mov [rsp-18h+arg_0], rbx +.text:00007FF7D93BAC85 push rbp +.text:00007FF7D93BAC86 push export_loader_addr +.text:00007FF7D93BAC87 push export_map_addr +.text:00007FF7D93BAC88 mov rbp, rsp +.text:00007FF7D93BAC8B sub rsp, 20h +.text:00007FF7D93BAC8F ; 6: sub_7FF7D95BBA6F(a1); +.text:00007FF7D93BAC8F mov rbx, rcx +.text:00007FF7D93BAC92 ; 5: v2 = &v1; +.text:00007FF7D93BAC92 lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAC96 +.text:00007FF7D93BAC96 loc_7FF7D93BAC96: ; DATA XREF: sub_7FF7D959D1A6-1C17C↓o +.text:00007FF7D93BAC96 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAC9A mov edx, 11h +.text:00007FF7D93BAC9F lea rcx, aLoadingDriver ; "Loading driver..." +.text:00007FF7D93BACA6 call sub_7FF7D95BBA6F +.text:00007FF7D93BACAB ; 7: __debugbreak(); +.text:00007FF7D93BACAB int 3 ; Trap to Debugger +.text:00007FF7D93BACAC ; --------------------------------------------------------------------------- +.text:00007FF7D93BACAC mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BACB0 mov edx, 1 +.text:00007FF7D93BACB5 lea rcx, aI ; "i" +.text:00007FF7D93BACBC call sub_7FF7D940B132 +.text:00007FF7D93BACC1 int 3 ; Trap to Debugger +.text:00007FF7D93BACC2 ; --------------------------------------------------------------------------- +.text:00007FF7D93BACC2 mov [rbp+arg_10], get_proc_result +.text:00007FF7D93BACC6 lea r8, [rbp+arg_8] +.text:00007FF7D93BACCA lea rdx, [rbp+arg_10] +.text:00007FF7D93BACCE mov rcx, rbx +.text:00007FF7D93BACD1 call sub_7FF7D93BB040 +.text:00007FF7D93BACD6 ; --------------------------------------------------------------------------- +.text:00007FF7D93BACD6 +.text:00007FF7D93BACD6 loc_7FF7D93BACD6: ; DATA XREF: sub_7FF7D95E4FFB+1↓o +.text:00007FF7D93BACD6 ; sub_7FF7D95ED6E8-E95B5↓o +.text:00007FF7D93BACD6 lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BACDA mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BACDE mov edx, 12h +.text:00007FF7D93BACE3 lea rcx, aGettingExports ; "Getting exports..." +.text:00007FF7D93BACEA push rbx +.text:00007FF7D93BACEB +.text:00007FF7D93BACEB loc_7FF7D93BACEB: ; DATA XREF: sub_7FF7D94757CA-1297F↓o +.text:00007FF7D93BACEB call sub_7FF7D95592BA +.text:00007FF7D93BACF0 mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BACF4 +.text:00007FF7D93BACF4 loc_7FF7D93BACF4: ; DATA XREF: sub_7FF7D94468AE+1674B7↓o +.text:00007FF7D93BACF4 mov edx, 1 +.text:00007FF7D93BACF9 lea rcx, aD ; "d" +.text:00007FF7D93BAD00 push get_proc_result +.text:00007FF7D93BAD01 call sub_7FF7D95056A0 +.text:00007FF7D93BAD06 +.text:00007FF7D93BAD06 loc_7FF7D93BAD06: ; DATA XREF: sub_7FF7D942142B+1BEC8↓o +.text:00007FF7D93BAD06 mov [rbp+arg_10], get_proc_result +.text:00007FF7D93BAD0A lea r8, [rbp+arg_8] +.text:00007FF7D93BAD0E lea rdx, [rbp+arg_10] +.text:00007FF7D93BAD12 mov rcx, rbx +.text:00007FF7D93BAD15 call sub_7FF7D93BB040 +.text:00007FF7D93BAD1A ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD1A lea rdx, aExportload ; "ExportLoad" +.text:00007FF7D93BAD21 lea rcx, InjectModuleHandle ; handle to inject.dll +.text:00007FF7D93BAD28 push export_map_addr +.text:00007FF7D93BAD29 call GetProcAddress_Wrapper_0 ; GetProcAddress(InjectHandle, "ExportLoad"); +.text:00007FF7D93BAD2E +.text:00007FF7D93BAD2E loc_7FF7D93BAD2E: ; DATA XREF: sub_7FF7D954B379-8B56A↓o +.text:00007FF7D93BAD2E ; sub_7FF7D953050F+19↓o +.text:00007FF7D93BAD2E mov export_loader_addr, get_proc_result +.text:00007FF7D93BAD31 lea rdx, aExportmap ; "ExportMap" +.text:00007FF7D93BAD38 lea rcx, InjectModuleHandle +.text:00007FF7D93BAD3F call GetProcAddress_Wrapper_1 ; GetProcAddress(InjectHandle, "ExportMap"); +.text:00007FF7D93BAD44 int 3 ; Trap to Debugger +.text:00007FF7D93BAD45 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD45 mov export_map_addr, get_proc_result +.text:00007FF7D93BAD48 test export_loader_addr, export_loader_addr +.text:00007FF7D93BAD4B jz get_import_failed ; if(!GetProcAddress(InjectHandle, "ExportLoad")) +.text:00007FF7D93BAD51 +.text:00007FF7D93BAD51 loc_7FF7D93BAD51: ; DATA XREF: sub_7FF7D94AAA89+10F799↓o +.text:00007FF7D93BAD51 test get_proc_result, get_proc_result +.text:00007FF7D93BAD54 jz get_import_failed +.text:00007FF7D93BAD5A lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAD5E mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAD62 mov edx, 1Ch +.text:00007FF7D93BAD67 +.text:00007FF7D93BAD67 loc_7FF7D93BAD67: ; DATA XREF: sub_7FF7D95ECD37-A8861↓o +.text:00007FF7D93BAD67 ; .vmp0:loc_7FF7D94B4A3E↓o +.text:00007FF7D93BAD67 lea rcx, aLoadingVulnera ; "Loading vulnerable driver..." +.text:00007FF7D93BAD6E push rbx +.text:00007FF7D93BAD6F call print_wrapper +.text:00007FF7D93BAD74 mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BAD78 mov edx, 1 +.text:00007FF7D93BAD7D +.text:00007FF7D93BAD7D loc_7FF7D93BAD7D: ; DATA XREF: sub_7FF7D94503B6-30DA4↓o +.text:00007FF7D93BAD7D lea rcx, aD ; "d" +.text:00007FF7D93BAD84 call sub_7FF7D9478BE0 +.text:00007FF7D93BAD89 int 3 ; Trap to Debugger +.text:00007FF7D93BAD8A ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD8A mov [rbp+arg_10], get_proc_result +.text:00007FF7D93BAD8E lea r8, [rbp+arg_8] +.text:00007FF7D93BAD92 lea rdx, [rbp+arg_10] +.text:00007FF7D93BAD96 mov rcx, rbx +.text:00007FF7D93BAD99 call sub_7FF7D93BB040 +.text:00007FF7D93BAD9E ; --------------------------------------------------------------------------- +.text:00007FF7D93BAD9E call export_loader_addr ; ExportLoad() +.text:00007FF7D93BADA0 test al, al +.text:00007FF7D93BADA2 lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BADA6 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BADAA jnz short loaded_intel_driver ; if(!ExportLoad()) +.text:00007FF7D93BADAC mov edx, 20h ; ' ' +.text:00007FF7D93BADB1 lea rcx, aFailedToLoadVu ; "Failed to load vulnerable driver" +.text:00007FF7D93BADB8 call sub_7FF7D958DEFC +.text:00007FF7D93BADBD int 3 ; Trap to Debugger +.text:00007FF7D93BADBE ; --------------------------------------------------------------------------- +.text:00007FF7D93BADBE mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BADC2 jmp loc_7FF7D93BAE6D +.text:00007FF7D93BADC7 ; --------------------------------------------------------------------------- +.text:00007FF7D93BADC7 +.text:00007FF7D93BADC7 loaded_intel_driver: ; CODE XREF: load_driver+12A↑j +.text:00007FF7D93BADC7 mov edx, 21 +.text:00007FF7D93BADCC +.text:00007FF7D93BADCC loc_7FF7D93BADCC: ; DATA XREF: .vmp0:00007FF7D95F9431↓o +.text:00007FF7D93BADCC lea rcx, aMappingOurDriv ; "Mapping our driver..." +.text:00007FF7D93BADD3 push rdx +.text:00007FF7D93BADD4 call sub_7FF7D955E32D +.text:00007FF7D93BADD9 mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BADDD mov edx, 1 +.text:00007FF7D93BADE2 lea rcx, aD ; "d" +.text:00007FF7D93BADE9 +.text:00007FF7D93BADE9 loc_7FF7D93BADE9: ; DATA XREF: sub_7FF7D95A4C59:loc_7FF7D9592C44↓o +.text:00007FF7D93BADE9 call sub_7FF7D952ADCD +.text:00007FF7D93BADEE int 3 ; Trap to Debugger +.text:00007FF7D93BADEF ; --------------------------------------------------------------------------- +.text:00007FF7D93BADEF mov [rbp+arg_10], get_proc_result +.text:00007FF7D93BADF3 lea r8, [rbp+arg_8] +.text:00007FF7D93BADF7 lea rdx, [rbp+arg_10] +.text:00007FF7D93BADFB mov rcx, rbx +.text:00007FF7D93BADFE call sub_7FF7D93BB040 +.text:00007FF7D93BAE03 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE03 lea rcx, aDriverSys ; "driver.sys" +.text:00007FF7D93BAE0A call export_map_addr +.text:00007FF7D93BAE0C test al, al +.text:00007FF7D93BAE0E +.text:00007FF7D93BAE0E loc_7FF7D93BAE0E: ; DATA XREF: sub_7FF7D957BEA6-FC4D7↓o +.text:00007FF7D93BAE0E lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAE12 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAE16 jnz short mapped_driver_success +.text:00007FF7D93BAE18 mov edx, 18h +.text:00007FF7D93BAE1D lea rcx, aFailedToMapOur ; "Failed to map our driver" +.text:00007FF7D93BAE24 +.text:00007FF7D93BAE24 loc_7FF7D93BAE24: ; DATA XREF: sub_7FF7D94FF131-2DECE↓o +.text:00007FF7D93BAE24 push export_loader_addr +.text:00007FF7D93BAE25 call sub_7FF7D954EE11 +.text:00007FF7D93BAE2A mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BAE2E jmp short loc_7FF7D93BAE6D +.text:00007FF7D93BAE30 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE30 +.text:00007FF7D93BAE30 mapped_driver_success: ; CODE XREF: load_driver+196↑j +.text:00007FF7D93BAE30 mov edx, 1Ah +.text:00007FF7D93BAE35 +.text:00007FF7D93BAE35 loc_7FF7D93BAE35: ; DATA XREF: sub_7FF7D9567ABC-7F50C↓o +.text:00007FF7D93BAE35 ; sub_7FF7D95A8564-271A↓o +.text:00007FF7D93BAE35 lea rcx, aDriverLoadedSu ; "Driver loaded successfully" +.text:00007FF7D93BAE3C +.text:00007FF7D93BAE3C loc_7FF7D93BAE3C: ; DATA XREF: sub_7FF7D9471582+10↓o +.text:00007FF7D93BAE3C call sub_7FF7D95B77C9 +.text:00007FF7D93BAE41 int 3 ; Trap to Debugger +.text:00007FF7D93BAE42 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE42 mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BAE46 lea rcx, aS ; "s" +.text:00007FF7D93BAE4D jmp short loc_7FF7D93BAE74 +.text:00007FF7D93BAE4F ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE4F +.text:00007FF7D93BAE4F get_import_failed: ; CODE XREF: load_driver+CB↑j +.text:00007FF7D93BAE4F ; load_driver+D4↑j +.text:00007FF7D93BAE4F lea get_proc_result, [rbp+arg_8] +.text:00007FF7D93BAE53 mov [rbp+arg_18], get_proc_result +.text:00007FF7D93BAE57 +.text:00007FF7D93BAE57 loc_7FF7D93BAE57: ; DATA XREF: sub_7FF7D9529E62+78856↓o +.text:00007FF7D93BAE57 mov edx, 15h +.text:00007FF7D93BAE5C lea rcx, aFailedToGetExp ; "Failed to get exports" +.text:00007FF7D93BAE63 call sub_7FF7D95DC54A +.text:00007FF7D93BAE68 int 3 ; Trap to Debugger +.text:00007FF7D93BAE69 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE69 mov [rbp+arg_8], get_proc_result +.text:00007FF7D93BAE6D +.text:00007FF7D93BAE6D loc_7FF7D93BAE6D: ; CODE XREF: load_driver+142↑j +.text:00007FF7D93BAE6D ; load_driver+1AE↑j +.text:00007FF7D93BAE6D ; DATA XREF: ... +.text:00007FF7D93BAE6D lea rcx, aE ; "e" +.text:00007FF7D93BAE74 +.text:00007FF7D93BAE74 loc_7FF7D93BAE74: ; CODE XREF: load_driver+1CD↑j +.text:00007FF7D93BAE74 mov edx, 1 +.text:00007FF7D93BAE79 call sub_7FF7D959401E +.text:00007FF7D93BAE7E int 3 ; Trap to Debugger +.text:00007FF7D93BAE7F ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE7F mov [rbp+arg_10], get_proc_result +.text:00007FF7D93BAE83 lea r8, [rbp+arg_8] +.text:00007FF7D93BAE87 lea rdx, [rbp+arg_10] +.text:00007FF7D93BAE8B mov rcx, rbx +.text:00007FF7D93BAE8E call sub_7FF7D93BB040 +.text:00007FF7D93BAE93 ; --------------------------------------------------------------------------- +.text:00007FF7D93BAE93 mov rbx, [rsp+20h+arg_0] +.text:00007FF7D93BAE98 add rsp, 20h +.text:00007FF7D93BAE9C +.text:00007FF7D93BAE9C loc_7FF7D93BAE9C: ; DATA XREF: sub_7FF7D954BA34+37E22↓o +.text:00007FF7D93BAE9C pop export_map_addr +.text:00007FF7D93BAE9D pop export_loader_addr +.text:00007FF7D93BAE9E pop rbp +.text:00007FF7D93BAE9F retn +.text:00007FF7D93BAE9F ; } // starts at 7FF7D93BAC80 +.text:00007FF7D93BAE9F load_driver endp +.text:00007FF7D93BAE9F + diff --git a/llauncher/images/getprocaddr_export_load.png b/llauncher/images/getprocaddr_export_load.png new file mode 100644 index 0000000..723804c Binary files /dev/null and b/llauncher/images/getprocaddr_export_load.png differ diff --git a/llauncher/images/load_driver.png b/llauncher/images/load_driver.png new file mode 100644 index 0000000..d00c65f Binary files /dev/null and b/llauncher/images/load_driver.png differ diff --git a/llauncher/images/map_load.png b/llauncher/images/map_load.png new file mode 100644 index 0000000..5225efc Binary files /dev/null and b/llauncher/images/map_load.png differ diff --git a/llauncher_dump.exe b/llauncher/llauncher_dump.exe similarity index 100% rename from llauncher_dump.exe rename to llauncher/llauncher_dump.exe diff --git a/llauncher_dump.i64 b/llauncher/llauncher_dump.i64 similarity index 90% rename from llauncher_dump.i64 rename to llauncher/llauncher_dump.i64 index d5a724a..7cd0a62 100644 Binary files a/llauncher_dump.i64 and b/llauncher/llauncher_dump.i64 differ diff --git a/mmap/images/kdmapper_paste.png b/mmap/images/kdmapper_paste.png new file mode 100644 index 0000000..7158d68 Binary files /dev/null and b/mmap/images/kdmapper_paste.png differ diff --git a/mmap/images/kdmapper_paste2.png b/mmap/images/kdmapper_paste2.png new file mode 100644 index 0000000..1b1c20b Binary files /dev/null and b/mmap/images/kdmapper_paste2.png differ diff --git a/mmap_dump.dll b/mmap/mmap_dump.dll similarity index 100% rename from mmap_dump.dll rename to mmap/mmap_dump.dll diff --git a/mmap_dump.i64 b/mmap/mmap_dump.i64 similarity index 96% rename from mmap_dump.i64 rename to mmap/mmap_dump.i64 index bf52110..f600f1a 100644 Binary files a/mmap_dump.i64 and b/mmap/mmap_dump.i64 differ diff --git a/overview.png b/overview.png new file mode 100644 index 0000000..3db7005 Binary files /dev/null and b/overview.png differ