diff --git a/driver/modules.c b/driver/modules.c index e4a5f96..02fc9fe 100644 --- a/driver/modules.c +++ b/driver/modules.c @@ -402,7 +402,10 @@ NTSTATUS HandleValidateDriversIOCTL( } MODULE_VALIDATION_FAILURE_HEADER header; - header.module_count = head->count; + + header.module_count = head->count >= MODULE_VALIDATION_FAILURE_MAX_REPORT_COUNT + ? MODULE_VALIDATION_FAILURE_MAX_REPORT_COUNT + : head->count; if ( head->count > 0 ) { diff --git a/user/km/driver.cpp b/user/km/driver.cpp index 94f44e1..553b90a 100644 --- a/user/km/driver.cpp +++ b/user/km/driver.cpp @@ -1,5 +1,7 @@ #include "driver.h" +#include + #include "../common.h" kernelmode::Driver::Driver( LPCWSTR DriverName, std::shared_ptr ReportInterface ) @@ -116,6 +118,8 @@ void kernelmode::Driver::VerifySystemModules() */ memcpy( &header, buffer, sizeof( header_size ) ); + LOG_INFO( "module report count: %lx", header.module_count ); + UINT64 base = ( UINT64 )buffer + sizeof( header_size ); for ( int i = 0; i < header.module_count; i++ ) @@ -126,6 +130,10 @@ void kernelmode::Driver::VerifySystemModules() sizeof( global::report_structures::MODULE_VALIDATION_FAILURE ) ); + std::cout << report.report_code << " " << report.report_type << " " + << report.driver_base_address << " " << report.driver_size << " " + << report.driver_name << std::endl; + this->report_interface->ReportViolation( &report ); /* sanity clear just in case ;) */ diff --git a/user/report.h b/user/report.h index 1dc76cf..8f96bee 100644 --- a/user/report.h +++ b/user/report.h @@ -103,7 +103,7 @@ namespace global INT report_type; UINT64 driver_base_address; UINT64 driver_size; - BYTE driver_name[ 128 ]; + CHAR driver_name[ 128 ]; }; } }