diff --git a/buffer_dump.dll b/buffer_dump.dll new file mode 100644 index 0000000..0d84fa3 Binary files /dev/null and b/buffer_dump.dll differ diff --git a/buffer_dump.i64 b/buffer_dump.i64 new file mode 100644 index 0000000..9bb8bbe Binary files /dev/null and b/buffer_dump.i64 differ diff --git a/driver.sys b/driver.sys new file mode 100644 index 0000000..b27e2bf Binary files /dev/null and b/driver.sys differ diff --git a/driver.sys.i64 b/driver.sys.i64 new file mode 100644 index 0000000..a4e5e7d Binary files /dev/null and b/driver.sys.i64 differ diff --git a/ida_pages/ioctl_hook_setup.html b/ida_pages/ioctl_hook_setup.html new file mode 100644 index 0000000..dfdc3dd --- /dev/null +++ b/ida_pages/ioctl_hook_setup.html @@ -0,0 +1,71 @@ + + + + +IDA - driver.sys.i64 (driver.sys) C:\Users\xerox\Desktop\amlegit.com\driver.sys.i64 + + + + +__int64 __fastcall ioctl_hook_setup(__int64 DRIVER_OBJECT) +{ + // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND] + + device_name = (const UNICODE_STRING *)(DRIVER_OBJECT + 0x38); + pdriver_object = (struct _DRIVER_OBJECT *)DRIVER_OBJECT; + debug_with_prefix((__int64)"Going to %wZ @ 0x%p\n", DRIVER_OBJECT + 0x38, DRIVER_OBJECT); + if ( !pdriver_object->DeviceObject ) + { + register_result = register_device(pdriver_object, (PDEVICE_OBJECT *)&qword_140006180); + if ( (register_result & 0xC0000000) == 0xC0000000 ) + { + debug_with_prefix((__int64)"Failed to create Device!\n"); + return register_result; + } + v5 = 1; + goto LABEL_11; + } + if ( !ObQueryNameInfo() ) + { + print_string = "Unnamed device. Skipping.\n"; +LABEL_7: + debug_with_prefix((__int64)print_string); + return 0xC0000002i64; // STATUS_NOT_IMPLEMENTED + } + RtlInitUnicodeString(&gpu_energy_drv_str, L"\\Driver\\GpuEnergyDrv"); + if ( !RtlEqualUnicodeString(&gpu_energy_drv_str, device_name, 0) ) + { + print_string = "Not our target driver. Skipping.\n"; + goto LABEL_7; + } + original_ioctl = install_ioctl_hook((__int64)pdriver_object, (__int64)ioctl_inline_hook); + v5 = 0; +LABEL_11: + byte_140006188 = v5; + qword_140006180 = (__int64)pdriver_object->DeviceObject; + if ( (sub_1400044CC(pdriver_object->MajorFunction, qword_1400060A0, 28i64) & 0xC0000000) == 0xC0000000 ) + { + if ( byte_140006188 == 1 ) + sub_140001544(&qword_140006180); + byte_140006188 = 0; + result = 0xC0000305i64; + } + else + { + pdriver_object->MajorFunction[0] = (PDRIVER_DISPATCH)IRP_MJ_CREATE; + pdriver_object->MajorFunction[2] = (PDRIVER_DISPATCH)IRP_MJ_CLOSE; + pdriver_object->MajorFunction[14] = (PDRIVER_DISPATCH)IOCTL_HOOK_FUNCTION; + pdriver_obj = (__int64)pdriver_object; + if ( (int)sub_140001438(qword_140006180) < 0 ) + debug_with_prefix((__int64)"Failed to create symlink\n"); + if ( pdriver_object->DriverUnload ) + { + driver_unload_orig = (__int64)pdriver_object->DriverUnload; + pdriver_object->DriverUnload = (PDRIVER_UNLOAD)new_driver_unload; + } + debug_with_prefix((__int64)"Successfully hooked %wZ @ 0x%p\n", device_name, pdriver_object); + result = 0i64; + } + return result; +} + diff --git a/images/amlegit_diagram.png b/images/amlegit_diagram.png new file mode 100644 index 0000000..34bc792 Binary files /dev/null and b/images/amlegit_diagram.png differ diff --git a/images/ioctl_hook_driver.png b/images/ioctl_hook_driver.png new file mode 100644 index 0000000..5a72b4b Binary files /dev/null and b/images/ioctl_hook_driver.png differ diff --git a/images/lapex_imports.png b/images/lapex_imports.png new file mode 100644 index 0000000..10415a7 Binary files /dev/null and b/images/lapex_imports.png differ diff --git a/images/nsiproxy_paste.PNG b/images/nsiproxy_paste.PNG new file mode 100644 index 0000000..aa6155b Binary files /dev/null and b/images/nsiproxy_paste.PNG differ diff --git a/images/spoofer_paste.png b/images/spoofer_paste.png new file mode 100644 index 0000000..39b0537 Binary files /dev/null and b/images/spoofer_paste.png differ diff --git a/inject_dump.dll b/inject_dump.dll new file mode 100644 index 0000000..6443d49 Binary files /dev/null and b/inject_dump.dll differ diff --git a/inject_dump.i64 b/inject_dump.i64 new file mode 100644 index 0000000..298dce3 Binary files /dev/null and b/inject_dump.i64 differ diff --git a/lapex.dll b/lapex.dll new file mode 100644 index 0000000..80105b0 Binary files /dev/null and b/lapex.dll differ diff --git a/lapex.dll.i64 b/lapex.dll.i64 new file mode 100644 index 0000000..614cd8f Binary files /dev/null and b/lapex.dll.i64 differ diff --git a/llauncher_dump.exe b/llauncher_dump.exe new file mode 100644 index 0000000..02f1ea5 Binary files /dev/null and b/llauncher_dump.exe differ diff --git a/llauncher_dump.i64 b/llauncher_dump.i64 new file mode 100644 index 0000000..d5a724a Binary files /dev/null and b/llauncher_dump.i64 differ diff --git a/mmap_dump.dll b/mmap_dump.dll new file mode 100644 index 0000000..76b0958 Binary files /dev/null and b/mmap_dump.dll differ diff --git a/mmap_dump.i64 b/mmap_dump.i64 new file mode 100644 index 0000000..bf52110 Binary files /dev/null and b/mmap_dump.i64 differ