gmh5225
2 years ago
parent
ebc411c139
commit
fb710005c2
@ -0,0 +1,101 @@
|
|||||||
|
AccessModifierOffset: -4
|
||||||
|
AlignAfterOpenBracket: AlwaysBreak
|
||||||
|
AlignConsecutiveAssignments: false
|
||||||
|
AlignConsecutiveDeclarations: false
|
||||||
|
AlignEscapedNewlines: DontAlign
|
||||||
|
AlignOperands: true
|
||||||
|
AllowAllParametersOfDeclarationOnNextLine: false
|
||||||
|
AllowShortBlocksOnASingleLine: false
|
||||||
|
AllowShortCaseLabelsOnASingleLine: false
|
||||||
|
AllowShortFunctionsOnASingleLine: Inline
|
||||||
|
AllowShortIfStatementsOnASingleLine: false
|
||||||
|
AllowShortLoopsOnASingleLine: false
|
||||||
|
AlwaysBreakAfterReturnType: TopLevel
|
||||||
|
AlwaysBreakBeforeMultilineStrings: false
|
||||||
|
AlwaysBreakTemplateDeclarations: true
|
||||||
|
BinPackArguments: false
|
||||||
|
BinPackParameters: false
|
||||||
|
BraceWrapping:
|
||||||
|
AfterClass: true
|
||||||
|
AfterControlStatement: true
|
||||||
|
AfterEnum: true
|
||||||
|
AfterFunction: true
|
||||||
|
AfterNamespace: false
|
||||||
|
AfterStruct: true
|
||||||
|
AfterUnion: true
|
||||||
|
AfterExternBlock: false
|
||||||
|
BeforeCatch: true
|
||||||
|
BeforeElse: true
|
||||||
|
BreakBeforeBraces: Custom
|
||||||
|
BreakBeforeBinaryOperators: None
|
||||||
|
BreakBeforeTernaryOperators: true
|
||||||
|
BreakConstructorInitializers: AfterColon
|
||||||
|
BreakStringLiterals: false
|
||||||
|
ColumnLimit: 120
|
||||||
|
CommentPragmas: '^begin_wpp|^end_wpp|^FUNC |^USESUFFIX |^USESUFFIX '
|
||||||
|
ConstructorInitializerAllOnOneLineOrOnePerLine: true
|
||||||
|
ConstructorInitializerIndentWidth: 4
|
||||||
|
ContinuationIndentWidth: 4
|
||||||
|
Cpp11BracedListStyle: true
|
||||||
|
DerivePointerAlignment: false
|
||||||
|
ExperimentalAutoDetectBinPacking: false
|
||||||
|
IndentCaseLabels: false
|
||||||
|
IndentPPDirectives: AfterHash
|
||||||
|
IndentWidth: 4
|
||||||
|
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||||
|
Language: Cpp
|
||||||
|
MacroBlockBegin: '^BEGIN_MODULE$|^BEGIN_TEST_CLASS$|^BEGIN_TEST_METHOD$'
|
||||||
|
MacroBlockEnd: '^END_MODULE$|^END_TEST_CLASS$|^END_TEST_METHOD$'
|
||||||
|
MaxEmptyLinesToKeep: 1
|
||||||
|
NamespaceIndentation: None
|
||||||
|
PointerAlignment: Right
|
||||||
|
ReflowComments: true
|
||||||
|
SortIncludes: false
|
||||||
|
SpaceAfterCStyleCast: false
|
||||||
|
SpaceBeforeAssignmentOperators: true
|
||||||
|
SpaceBeforeCtorInitializerColon: true
|
||||||
|
SpaceBeforeCtorInitializerColon: true
|
||||||
|
SpaceBeforeParens: ControlStatements
|
||||||
|
SpaceBeforeRangeBasedForLoopColon: true
|
||||||
|
SpaceInEmptyParentheses: false
|
||||||
|
SpacesInAngles: false
|
||||||
|
SpacesInCStyleCastParentheses: false
|
||||||
|
SpacesInParentheses: false
|
||||||
|
SpacesInSquareBrackets: false
|
||||||
|
Standard: Cpp11
|
||||||
|
StatementMacros: [
|
||||||
|
'EXTERN_C',
|
||||||
|
'PAGED',
|
||||||
|
'PAGEDX',
|
||||||
|
'NONPAGED',
|
||||||
|
'PNPCODE',
|
||||||
|
'INITCODE',
|
||||||
|
'_At_',
|
||||||
|
'_When_',
|
||||||
|
'_Success_',
|
||||||
|
'_Check_return_',
|
||||||
|
'_Must_inspect_result_',
|
||||||
|
'_IRQL_requires_',
|
||||||
|
'_IRQL_requires_max_',
|
||||||
|
'_IRQL_requires_min_',
|
||||||
|
'_IRQL_saves_',
|
||||||
|
'_IRQL_restores_',
|
||||||
|
'_IRQL_saves_global_',
|
||||||
|
'_IRQL_restores_global_',
|
||||||
|
'_IRQL_raises_',
|
||||||
|
'_IRQL_lowers_',
|
||||||
|
'_Acquires_lock_',
|
||||||
|
'_Releases_lock_',
|
||||||
|
'_Acquires_exclusive_lock_',
|
||||||
|
'_Releases_exclusive_lock_',
|
||||||
|
'_Acquires_shared_lock_',
|
||||||
|
'_Releases_shared_lock_',
|
||||||
|
'_Requires_lock_held_',
|
||||||
|
'_Use_decl_annotations_',
|
||||||
|
'_Guarded_by_',
|
||||||
|
'__drv_preferredFunction',
|
||||||
|
'__drv_allocatesMem',
|
||||||
|
'__drv_freesMem',
|
||||||
|
]
|
||||||
|
TabWidth: '4'
|
||||||
|
UseTab: Never
|
||||||
@ -0,0 +1,403 @@
|
|||||||
|
#pragma once
|
||||||
|
#include <fltKernel.h>
|
||||||
|
#include <intrin.h>
|
||||||
|
|
||||||
|
namespace clonestd {
|
||||||
|
// STRUCT TEMPLATE remove_reference
|
||||||
|
template <class _Ty>
|
||||||
|
struct remove_reference
|
||||||
|
{
|
||||||
|
using type = _Ty;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <class _Ty>
|
||||||
|
struct remove_reference<_Ty &>
|
||||||
|
{
|
||||||
|
using type = _Ty;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <class _Ty>
|
||||||
|
struct remove_reference<_Ty &&>
|
||||||
|
{
|
||||||
|
using type = _Ty;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <class _Ty>
|
||||||
|
using remove_reference_t = typename remove_reference<_Ty>::type;
|
||||||
|
|
||||||
|
// STRUCT TEMPLATE remove_const
|
||||||
|
template <class _Ty>
|
||||||
|
struct remove_const
|
||||||
|
{ // remove top-level const qualifier
|
||||||
|
using type = _Ty;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <class _Ty>
|
||||||
|
struct remove_const<const _Ty>
|
||||||
|
{
|
||||||
|
using type = _Ty;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <class _Ty>
|
||||||
|
using remove_const_t = typename remove_const<_Ty>::type;
|
||||||
|
} // namespace clonestd
|
||||||
|
|
||||||
|
namespace kli {
|
||||||
|
constexpr auto Time = __TIME__;
|
||||||
|
constexpr auto Seed = static_cast<unsigned long long>(Time[7]) + static_cast<unsigned long long>(Time[6]) * 10 +
|
||||||
|
static_cast<unsigned long long>(Time[4]) * 60 + static_cast<unsigned long long>(Time[3]) * 600 +
|
||||||
|
static_cast<unsigned long long>(Time[1]) * 3600 +
|
||||||
|
static_cast<unsigned long long>(Time[0]) * 36000;
|
||||||
|
constexpr auto Seed2 = static_cast<unsigned long long>(Time[7]) + static_cast<unsigned long long>(Time[6]) * 10 +
|
||||||
|
static_cast<unsigned long long>(Time[4]) * 60;
|
||||||
|
constexpr auto Seed3 = static_cast<unsigned long long>(Time[7]) + static_cast<unsigned long long>(Time[5]) * 10 +
|
||||||
|
static_cast<unsigned long long>(Time[2]) * 60;
|
||||||
|
constexpr auto Seed4 = static_cast<unsigned long long>(Time[7]) + static_cast<unsigned long long>(Time[3]) * 10 +
|
||||||
|
static_cast<unsigned long long>(Time[1]) * 60;
|
||||||
|
|
||||||
|
namespace cache {
|
||||||
|
constexpr unsigned long long base_init = Seed3;
|
||||||
|
inline unsigned long long base = base_init;
|
||||||
|
} // namespace cache
|
||||||
|
|
||||||
|
namespace hash {
|
||||||
|
namespace detail {
|
||||||
|
template <typename Size>
|
||||||
|
struct fnv_constants;
|
||||||
|
|
||||||
|
template <>
|
||||||
|
struct fnv_constants<unsigned int>
|
||||||
|
{
|
||||||
|
constexpr static unsigned int default_offset_basis = 0x811C9DC5UL;
|
||||||
|
constexpr static unsigned int prime = 0x01000193UL;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <>
|
||||||
|
struct fnv_constants<unsigned long long>
|
||||||
|
{
|
||||||
|
constexpr static unsigned long long default_offset_basis = 0xCBF29CE484222325ULL;
|
||||||
|
constexpr static unsigned long long prime = 0x100000001B3ULL;
|
||||||
|
};
|
||||||
|
|
||||||
|
} // namespace detail
|
||||||
|
|
||||||
|
// Dumb hack to force a constexpr value to be evaluated in compiletime
|
||||||
|
template <typename Type, Type Value>
|
||||||
|
struct force_cx
|
||||||
|
{
|
||||||
|
constexpr static auto value = Value;
|
||||||
|
};
|
||||||
|
|
||||||
|
template <typename Type, typename Char>
|
||||||
|
__forceinline constexpr Type
|
||||||
|
hash_fnv1a(const Char *str)
|
||||||
|
{
|
||||||
|
Type val = detail::fnv_constants<Type>::default_offset_basis;
|
||||||
|
|
||||||
|
// random
|
||||||
|
val += Seed;
|
||||||
|
|
||||||
|
for (; *str != static_cast<Char>(0); ++str)
|
||||||
|
{
|
||||||
|
Char c = *str;
|
||||||
|
val ^= static_cast<Type>(c);
|
||||||
|
val *= static_cast<Type>(detail::fnv_constants<Type>::prime);
|
||||||
|
}
|
||||||
|
|
||||||
|
return val;
|
||||||
|
}
|
||||||
|
|
||||||
|
#define KLI_HASH_RTS(str) \
|
||||||
|
(::kli::hash:: \
|
||||||
|
hash_fnv1a<unsigned long long, clonestd::remove_const_t<clonestd::remove_reference_t<decltype(*(str))>>>( \
|
||||||
|
(str)))
|
||||||
|
|
||||||
|
#define KLI_HASH_STR(str) \
|
||||||
|
(::kli::hash::force_cx< \
|
||||||
|
unsigned long long, \
|
||||||
|
::kli::hash:: \
|
||||||
|
hash_fnv1a<unsigned long long, clonestd::remove_const_t<clonestd::remove_reference_t<decltype(*(str))>>>( \
|
||||||
|
(str))>::value)
|
||||||
|
|
||||||
|
} // namespace hash
|
||||||
|
|
||||||
|
namespace crypto {
|
||||||
|
typedef struct s_rc4_state
|
||||||
|
{
|
||||||
|
int x, y;
|
||||||
|
unsigned char m[256];
|
||||||
|
} rc4_state;
|
||||||
|
|
||||||
|
__forceinline void
|
||||||
|
rc4_init_key(rc4_state *s, unsigned char *key, int length)
|
||||||
|
{
|
||||||
|
int i, j, k, a;
|
||||||
|
|
||||||
|
unsigned char *m;
|
||||||
|
|
||||||
|
s->x = 0;
|
||||||
|
s->y = 0;
|
||||||
|
m = s->m;
|
||||||
|
|
||||||
|
for (i = 0; i < 256; i++)
|
||||||
|
{
|
||||||
|
m[i] = (unsigned char)i;
|
||||||
|
}
|
||||||
|
|
||||||
|
j = k = 0;
|
||||||
|
|
||||||
|
for (i = 0; i < 256; i++)
|
||||||
|
{
|
||||||
|
a = m[i];
|
||||||
|
j = (unsigned char)(j + a + key[k]);
|
||||||
|
m[i] = m[j];
|
||||||
|
m[j] = (unsigned char)a;
|
||||||
|
if (++k >= length)
|
||||||
|
k = 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline void
|
||||||
|
rc4_crypt(rc4_state *s, unsigned char *data, int length)
|
||||||
|
{
|
||||||
|
int i, x, y, a, b;
|
||||||
|
|
||||||
|
unsigned char *m;
|
||||||
|
|
||||||
|
x = s->x;
|
||||||
|
y = s->y;
|
||||||
|
m = s->m;
|
||||||
|
|
||||||
|
for (i = 0; i < length; i++)
|
||||||
|
{
|
||||||
|
x = (unsigned char)(x + 1);
|
||||||
|
a = m[x];
|
||||||
|
y = (unsigned char)(y + a);
|
||||||
|
m[x] = b = m[y];
|
||||||
|
m[y] = (unsigned char)a;
|
||||||
|
data[i] ^= m[(unsigned char)(a + b)];
|
||||||
|
}
|
||||||
|
|
||||||
|
s->x = x;
|
||||||
|
s->y = y;
|
||||||
|
}
|
||||||
|
|
||||||
|
__forceinline void
|
||||||
|
rc4_crypt_all_in_once(unsigned char *key_buff, unsigned long key_len, unsigned char *enc_buff, unsigned long enc_len)
|
||||||
|
{
|
||||||
|
rc4_state state;
|
||||||
|
rc4_init_key(&state, key_buff, key_len);
|
||||||
|
rc4_crypt(&state, enc_buff, enc_len);
|
||||||
|
}
|
||||||
|
|
||||||
|
template <typename Type>
|
||||||
|
__forceinline Type
|
||||||
|
RC4Base(Type Ptr)
|
||||||
|
{
|
||||||
|
unsigned long long rc4_key = Seed2;
|
||||||
|
unsigned long long rc4_data = Seed4;
|
||||||
|
crypto::rc4_crypt_all_in_once(
|
||||||
|
(unsigned char *)(&rc4_key), sizeof(rc4_key), (unsigned char *)(&rc4_data), sizeof(rc4_data));
|
||||||
|
return (Type)((unsigned long long)Ptr ^ rc4_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
template <typename Type>
|
||||||
|
__forceinline Type
|
||||||
|
RC4Func(Type Ptr)
|
||||||
|
{
|
||||||
|
unsigned long long rc4_key = Seed4;
|
||||||
|
unsigned long long rc4_data = Seed2;
|
||||||
|
crypto::rc4_crypt_all_in_once(
|
||||||
|
(unsigned char *)(&rc4_key), sizeof(rc4_key), (unsigned char *)(&rc4_data), sizeof(rc4_data));
|
||||||
|
return (Type)((unsigned long long)Ptr ^ rc4_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
} // namespace crypto
|
||||||
|
|
||||||
|
namespace detail {
|
||||||
|
typedef struct _IMAGE_DOS_HEADER
|
||||||
|
{ // DOS .EXE header
|
||||||
|
unsigned short e_magic; // Magic number
|
||||||
|
unsigned short e_cblp; // Bytes on last page of file
|
||||||
|
unsigned short e_cp; // Pages in file
|
||||||
|
unsigned short e_crlc; // Relocations
|
||||||
|
unsigned short e_cparhdr; // GetSize of header in paragraphs
|
||||||
|
unsigned short e_minalloc; // Minimum extra paragraphs needed
|
||||||
|
unsigned short e_maxalloc; // Maximum extra paragraphs needed
|
||||||
|
unsigned short e_ss; // Initial (relative) SS value
|
||||||
|
unsigned short e_sp; // Initial SP value
|
||||||
|
unsigned short e_csum; // Checksum
|
||||||
|
unsigned short e_ip; // Initial IP value
|
||||||
|
unsigned short e_cs; // Initial (relative) CS value
|
||||||
|
unsigned short e_lfarlc; // File address of relocation table
|
||||||
|
unsigned short e_ovno; // Overlay number
|
||||||
|
unsigned short e_res[4]; // Reserved words
|
||||||
|
unsigned short e_oemid; // OEM identifier (for e_oeminfo)
|
||||||
|
unsigned short e_oeminfo; // OEM information; e_oemid specific
|
||||||
|
unsigned short e_res2[10]; // Reserved words
|
||||||
|
int e_lfanew; // File address of new exe header
|
||||||
|
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
|
||||||
|
|
||||||
|
typedef struct _IMAGE_FILE_HEADER
|
||||||
|
{
|
||||||
|
unsigned short Machine;
|
||||||
|
unsigned short NumberOfSections;
|
||||||
|
unsigned int TimeDateStamp;
|
||||||
|
unsigned int PointerToSymbolTable;
|
||||||
|
unsigned int NumberOfSymbols;
|
||||||
|
unsigned short SizeOfOptionalHeader;
|
||||||
|
unsigned short Characteristics;
|
||||||
|
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
|
||||||
|
|
||||||
|
typedef struct _IMAGE_DATA_DIRECTORY
|
||||||
|
{
|
||||||
|
unsigned int VirtualAddress;
|
||||||
|
unsigned int Size;
|
||||||
|
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
|
||||||
|
|
||||||
|
typedef struct _IMAGE_OPTIONAL_HEADER64
|
||||||
|
{
|
||||||
|
unsigned short Magic;
|
||||||
|
unsigned char MajorLinkerVersion;
|
||||||
|
unsigned char MinorLinkerVersion;
|
||||||
|
unsigned int SizeOfCode;
|
||||||
|
unsigned int SizeOfInitializedData;
|
||||||
|
unsigned int SizeOfUninitializedData;
|
||||||
|
unsigned int AddressOfEntryPoint;
|
||||||
|
unsigned int BaseOfCode;
|
||||||
|
unsigned long long ImageBase;
|
||||||
|
unsigned int SectionAlignment;
|
||||||
|
unsigned int FileAlignment;
|
||||||
|
unsigned short MajorOperatingSystemVersion;
|
||||||
|
unsigned short MinorOperatingSystemVersion;
|
||||||
|
unsigned short MajorImageVersion;
|
||||||
|
unsigned short MinorImageVersion;
|
||||||
|
unsigned short MajorSubsystemVersion;
|
||||||
|
unsigned short MinorSubsystemVersion;
|
||||||
|
unsigned int Win32VersionValue;
|
||||||
|
unsigned int SizeOfImage;
|
||||||
|
unsigned int SizeOfHeaders;
|
||||||
|
unsigned int CheckSum;
|
||||||
|
unsigned short Subsystem;
|
||||||
|
unsigned short DllCharacteristics;
|
||||||
|
unsigned long long SizeOfStackReserve;
|
||||||
|
unsigned long long SizeOfStackCommit;
|
||||||
|
unsigned long long SizeOfHeapReserve;
|
||||||
|
unsigned long long SizeOfHeapCommit;
|
||||||
|
unsigned int LoaderFlags;
|
||||||
|
unsigned int NumberOfRvaAndSizes;
|
||||||
|
IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||||
|
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
|
||||||
|
|
||||||
|
typedef struct _IMAGE_NT_HEADERS64
|
||||||
|
{
|
||||||
|
unsigned int Signature;
|
||||||
|
IMAGE_FILE_HEADER FileHeader;
|
||||||
|
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||||||
|
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
|
||||||
|
|
||||||
|
typedef struct _IMAGE_EXPORT_DIRECTORY
|
||||||
|
{
|
||||||
|
unsigned int Characteristics;
|
||||||
|
unsigned int TimeDateStamp;
|
||||||
|
unsigned short MajorVersion;
|
||||||
|
unsigned short MinorVersion;
|
||||||
|
unsigned int Name;
|
||||||
|
unsigned int Base;
|
||||||
|
unsigned int NumberOfFunctions;
|
||||||
|
unsigned int NumberOfNames;
|
||||||
|
unsigned int AddressOfFunctions; // RVA from base of image
|
||||||
|
unsigned int AddressOfNames; // RVA from base of image
|
||||||
|
unsigned int AddressOfNameOrdinals; // RVA from base of image
|
||||||
|
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
|
||||||
|
|
||||||
|
__declspec(naked) __forceinline unsigned long long get_kernel_base()
|
||||||
|
{
|
||||||
|
_asm {
|
||||||
|
mov rax, qword ptr gs:[18h]
|
||||||
|
mov rcx, [rax+38h]
|
||||||
|
mov rax, 0FFFFFFFFFFFFF000h
|
||||||
|
and rax, [rcx+4h]
|
||||||
|
jmp while_begin
|
||||||
|
search_begin:
|
||||||
|
add rax, 0FFFFFFFFFFFFF000h
|
||||||
|
while_begin:
|
||||||
|
xor ecx, ecx
|
||||||
|
jmp search_cmp
|
||||||
|
search_next:
|
||||||
|
add rcx, 1
|
||||||
|
cmp rcx, 0FF9h
|
||||||
|
jz search_begin
|
||||||
|
search_cmp:
|
||||||
|
cmp byte ptr[rax+rcx], 48h
|
||||||
|
jnz search_next
|
||||||
|
cmp byte ptr[rax+rcx+1], 8Dh
|
||||||
|
jnz search_next
|
||||||
|
cmp byte ptr[rax+rcx+2], 1Dh
|
||||||
|
jnz search_next
|
||||||
|
cmp byte ptr[rax+rcx+6], 0FFh
|
||||||
|
jnz search_next
|
||||||
|
mov r8d,[rax+rcx+3]
|
||||||
|
lea edx,[rcx+r8]
|
||||||
|
add edx, eax
|
||||||
|
add edx, 7
|
||||||
|
test edx, 0FFFh
|
||||||
|
jnz search_next
|
||||||
|
mov rdx, 0FFFFFFFF00000000h
|
||||||
|
and rdx, rax
|
||||||
|
add r8d, eax
|
||||||
|
lea eax,[rcx+r8]
|
||||||
|
add eax, 7
|
||||||
|
or rax, rdx
|
||||||
|
ret
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
} // namespace detail
|
||||||
|
|
||||||
|
__forceinline unsigned long long
|
||||||
|
find_kernel_export(unsigned long long export_hash)
|
||||||
|
{
|
||||||
|
if (cache::base == cache::base_init)
|
||||||
|
{
|
||||||
|
cache::base = crypto::RC4Base(detail::get_kernel_base());
|
||||||
|
}
|
||||||
|
|
||||||
|
const auto dos_header = (detail::PIMAGE_DOS_HEADER)crypto::RC4Base(cache::base);
|
||||||
|
const auto nt_headers = (detail::PIMAGE_NT_HEADERS64)(crypto::RC4Base(cache::base) + dos_header->e_lfanew);
|
||||||
|
const auto export_directory = (detail::PIMAGE_EXPORT_DIRECTORY)(
|
||||||
|
crypto::RC4Base(cache::base) + nt_headers->OptionalHeader.DataDirectory[0].VirtualAddress);
|
||||||
|
|
||||||
|
const auto address_of_functions =
|
||||||
|
(unsigned int *)(crypto::RC4Base(cache::base) + export_directory->AddressOfFunctions);
|
||||||
|
const auto address_of_names = (unsigned int *)(crypto::RC4Base(cache::base) + export_directory->AddressOfNames);
|
||||||
|
const auto address_of_name_ordinals =
|
||||||
|
(unsigned short *)(crypto::RC4Base(cache::base) + export_directory->AddressOfNameOrdinals);
|
||||||
|
|
||||||
|
for (unsigned int i = 0; i < export_directory->NumberOfNames; ++i)
|
||||||
|
{
|
||||||
|
const auto export_entry_name = (char *)(crypto::RC4Base(cache::base) + address_of_names[i]);
|
||||||
|
const auto export_entry_hash = KLI_HASH_RTS(export_entry_name);
|
||||||
|
|
||||||
|
// address_of_functions is indexed through an ordinal
|
||||||
|
// address_of_name_ordinals gets the ordinal through our own index - i.
|
||||||
|
if (export_entry_hash == export_hash)
|
||||||
|
{
|
||||||
|
auto func = crypto::RC4Base(cache::base) + address_of_functions[address_of_name_ordinals[i]];
|
||||||
|
return crypto::RC4Func(func);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0ULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
// once
|
||||||
|
#define KLI_CALL(name, ...) \
|
||||||
|
((decltype(&name))(kli::crypto::RC4Func(kli::find_kernel_export(KLI_HASH_STR(#name)))))(__VA_ARGS__)
|
||||||
|
|
||||||
|
// cached
|
||||||
|
#define KLI_CACHED_DEF(name) decltype(&name) KLI##name = nullptr
|
||||||
|
#define KLI_CACHED_SET(name) KLI##name = (decltype(&name))(kli::find_kernel_export(KLI_HASH_STR(#name)))
|
||||||
|
#define KLI_CACHED_CALL(name, ...) ((decltype(&name))(kli::crypto::RC4Func(KLI##name)))(__VA_ARGS__)
|
||||||
|
|
||||||
|
} // namespace kli
|
||||||
@ -0,0 +1,12 @@
|
|||||||
|
#pragma once
|
||||||
|
#include "../kli.hpp"
|
||||||
|
|
||||||
|
KLI_CACHED_DEF(ExAllocatePoolWithTag);
|
||||||
|
KLI_CACHED_DEF(ExFreePoolWithTag);
|
||||||
|
|
||||||
|
__forceinline void
|
||||||
|
IATInitCached()
|
||||||
|
{
|
||||||
|
KLI_CACHED_SET(ExAllocatePoolWithTag);
|
||||||
|
KLI_CACHED_SET(ExFreePoolWithTag);
|
||||||
|
}
|
||||||
@ -0,0 +1,69 @@
|
|||||||
|
#include "IAT.cached.h"
|
||||||
|
|
||||||
|
#define dprintf(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, __VA_ARGS__)
|
||||||
|
|
||||||
|
void
|
||||||
|
DriverUnload(PDRIVER_OBJECT DriverObject)
|
||||||
|
{
|
||||||
|
UNREFERENCED_PARAMETER(DriverObject);
|
||||||
|
dprintf("exit world\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
DECLSPEC_NOINLINE
|
||||||
|
void
|
||||||
|
test_once()
|
||||||
|
{
|
||||||
|
auto pExAllocatePoolWithTag = KLI_CALL(ExAllocatePoolWithTag, NonPagedPool, PAGE_SIZE, 'enoN');
|
||||||
|
if (pExAllocatePoolWithTag)
|
||||||
|
{
|
||||||
|
dprintf("test_once:ExAllocatePoolWithTag=%p\n", pExAllocatePoolWithTag);
|
||||||
|
KLI_CALL(ExFreePoolWithTag, pExAllocatePoolWithTag, 'enoN');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
DECLSPEC_NOINLINE
|
||||||
|
void
|
||||||
|
test_cached_init()
|
||||||
|
{
|
||||||
|
// Make cache
|
||||||
|
IATInitCached();
|
||||||
|
}
|
||||||
|
|
||||||
|
DECLSPEC_NOINLINE
|
||||||
|
void
|
||||||
|
test_cached()
|
||||||
|
{
|
||||||
|
auto pAddr = KLI_CACHED_CALL(ExAllocatePoolWithTag, NonPagedPool, PAGE_SIZE, 'x1x1');
|
||||||
|
if (pAddr)
|
||||||
|
{
|
||||||
|
dprintf("test_cached:pAddr=%p\n", pAddr);
|
||||||
|
KLI_CACHED_CALL(ExFreePoolWithTag, pAddr, 'x1x1');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
DECLSPEC_NOINLINE
|
||||||
|
void
|
||||||
|
test_cached2()
|
||||||
|
{
|
||||||
|
auto pAddr = KLI_CACHED_CALL(ExAllocatePoolWithTag, NonPagedPool, PAGE_SIZE, 'xxxx');
|
||||||
|
if (pAddr)
|
||||||
|
{
|
||||||
|
dprintf("test_cached2:pAddr=%p\n", pAddr);
|
||||||
|
KLI_CACHED_CALL(ExFreePoolWithTag, pAddr, 'xxxx');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
NTSTATUS
|
||||||
|
DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
|
||||||
|
{
|
||||||
|
dprintf("new world\n");
|
||||||
|
DriverObject->DriverUnload = DriverUnload;
|
||||||
|
|
||||||
|
test_once();
|
||||||
|
|
||||||
|
test_cached_init();
|
||||||
|
test_cached();
|
||||||
|
test_cached2();
|
||||||
|
|
||||||
|
return STATUS_SUCCESS;
|
||||||
|
}
|
||||||
@ -0,0 +1,10 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="Source.cpp" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="..\kli.hpp" />
|
||||||
|
<ClInclude Include="IAT.cached.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
Loading…
Reference in new issue