noury/mirror-ac
1
0
Fork 0
mirror of https://github.com/donnaskiez/ac.git synced 2024-11-21 22:24:08 +01:00
Code Issues Projects Releases Packages Wiki Activity

holy fuck got it working

Browse source
This commit is contained in:
lhodges1 2023-08-20 15:46:02 +10:00
parent e6cb6a3131
commit fef772f75d
4 changed files with 25 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
driver/common.h
View file

@ -15,6 +15,7 @@
#define SYSTEM_MODULES_POOL 'halb' #define SYSTEM_MODULES_POOL 'halb'
#define THREAD_DATA_POOL 'doof' #define THREAD_DATA_POOL 'doof'
#define PROC_AFFINITY_POOL 'eeee' #define PROC_AFFINITY_POOL 'eeee'
#define TEMP_BUFFER_POOL 'ffff'
#define ERROR -1 #define ERROR -1
#define STACK_FRAME_POOL_SIZE 0x200 #define STACK_FRAME_POOL_SIZE 0x200

15
driver/ioctl.c
View file

@ -30,9 +30,6 @@ NTSTATUS DeviceControl(
case IOCTL_VALIDATE_DRIVER_OBJECTS: case IOCTL_VALIDATE_DRIVER_OBJECTS:
/* KeWaitForSingleObject with infinite time must be called from IRQL <= APC_LEVEL */
PAGED_CODE();
/* /*
* The reason this function is run in a new thread and not the thread * The reason this function is run in a new thread and not the thread
* issuing the IOCTL is because ZwOpenDirectoryObject issues a * issuing the IOCTL is because ZwOpenDirectoryObject issues a
@ -40,6 +37,9 @@ NTSTATUS DeviceControl(
* This is a problem because when we pass said handle to ObReferenceObjectByHandle * This is a problem because when we pass said handle to ObReferenceObjectByHandle
* it will issue a bug check under windows driver verifier. * it will issue a bug check under windows driver verifier.
*/ */
DEBUG_LOG( "irp addr: %p", ( void* )Irp );
status = PsCreateSystemThread( status = PsCreateSystemThread(
&handle, &handle,
PROCESS_ALL_ACCESS, PROCESS_ALL_ACCESS,
@ -78,8 +78,11 @@ NTSTATUS DeviceControl(
goto end; goto end;
} }
/* KeWaitForSingleObject with infinite time must be called from IRQL <= APC_LEVEL */
PAGED_CODE();
DEBUG_LOG( "waiting for thread to finish" );
KeWaitForSingleObject( thread, Executive, KernelMode, FALSE, NULL ); KeWaitForSingleObject( thread, Executive, KernelMode, FALSE, NULL );
DEBUG_LOG( "THREAD FINISHED" );
ZwClose( handle ); ZwClose( handle );
ObDereferenceObject( thread ); ObDereferenceObject( thread );
@ -91,9 +94,9 @@ NTSTATUS DeviceControl(
} }
end: end:
DEBUG_LOG( "completing irp request" );
IoCompleteRequest( Irp, IO_NO_INCREMENT );
Irp->IoStatus.Status = status; Irp->IoStatus.Status = status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return status; return status;
} }

30
driver/modules.c
View file

@ -411,11 +411,6 @@ NTSTATUS HandleValidateDriversIOCTL(
Irp->IoStatus.Information = sizeof( MODULE_VALIDATION_FAILURE_HEADER ) + Irp->IoStatus.Information = sizeof( MODULE_VALIDATION_FAILURE_HEADER ) +
MODULE_VALIDATION_FAILURE_MAX_REPORT_COUNT * sizeof( MODULE_VALIDATION_FAILURE ); MODULE_VALIDATION_FAILURE_MAX_REPORT_COUNT * sizeof( MODULE_VALIDATION_FAILURE );
RtlCopyMemory(
Irp->AssociatedIrp.SystemBuffer,
&header,
sizeof( MODULE_VALIDATION_FAILURE_HEADER ) );
for ( INT i = 0; i < head->count; i++ ) for ( INT i = 0; i < head->count; i++ )
{ {
/* make sure we free any non reported modules */ /* make sure we free any non reported modules */
@ -431,10 +426,20 @@ NTSTATUS HandleValidateDriversIOCTL(
report.driver_base_address = head->first_entry->driver->DriverStart; report.driver_base_address = head->first_entry->driver->DriverStart;
report.driver_size = head->first_entry->driver->Size; report.driver_size = head->first_entry->driver->Size;
RtlCopyMemory( ANSI_STRING string;
&report.driver_name, string.Length = 0;
head->first_entry->driver->DriverName.Buffer, string.MaximumLength = MODULE_REPORT_DRIVER_NAME_BUFFER_SIZE;
MODULE_REPORT_DRIVER_NAME_BUFFER_SIZE ); string.Buffer = &report.driver_name;
status = RtlUnicodeStringToAnsiString(
&string,
&head->first_entry->driver->DriverName,
FALSE
);
/* still continue if we fail to get the driver name */
if ( !NT_SUCCESS( status ) )
DEBUG_ERROR( "RtlUnicodeStringToAnsiString failed with statsu %x", status );
RtlCopyMemory( RtlCopyMemory(
( UINT64 )Irp->AssociatedIrp.SystemBuffer + sizeof( MODULE_VALIDATION_FAILURE_HEADER ) + i * sizeof( MODULE_VALIDATION_FAILURE ), ( UINT64 )Irp->AssociatedIrp.SystemBuffer + sizeof( MODULE_VALIDATION_FAILURE_HEADER ) + i * sizeof( MODULE_VALIDATION_FAILURE ),
@ -452,12 +457,5 @@ NTSTATUS HandleValidateDriversIOCTL(
ExFreePoolWithTag( head, INVALID_DRIVER_LIST_HEAD_POOL ); ExFreePoolWithTag( head, INVALID_DRIVER_LIST_HEAD_POOL );
ExFreePoolWithTag( system_modules.address, SYSTEM_MODULES_POOL ); ExFreePoolWithTag( system_modules.address, SYSTEM_MODULES_POOL );
/*
* Complete the IRP here so we don't have to implement a waiting mechanism
* to prevent an early completion of the IRP.
*/
//IoCompleteRequest( Irp, IO_NO_INCREMENT );
//Irp->IoStatus.Status = status;
return status; return status;
} }

2
driver/modules.h
View file

@ -24,7 +24,7 @@ typedef struct _MODULE_VALIDATION_FAILURE
INT report_type; INT report_type;
UINT64 driver_base_address; UINT64 driver_base_address;
UINT64 driver_size; UINT64 driver_size;
PCHAR driver_name[ 128 ]; CHAR driver_name[ 128 ];
}MODULE_VALIDATION_FAILURE, *PMODULE_VALIDATION_FAILURE; }MODULE_VALIDATION_FAILURE, *PMODULE_VALIDATION_FAILURE;