init

Anit-Cheat_EXE/kdmapper/kd_driver.cpp

@@ -1,5 +1,5 @@
 #include "kd_driver.h"
-#include "utils.h"
+#include "kd_utils.h"
 //#include "..\Vmp\Vmp.h"
 
 HANDLE kd_driver::iqvw64e_device_handle;
@@ -51,27 +51,41 @@ bool kd_driver::AcquireDebugPrivilege() {
 	return true;
 }
 
-#include "MmKd_sumper.h"
+#include "Ld_BASE.h"
 
-bool kd_driver::Load()
+bool kd_driver::Load(PDWORD status)
 {
 	srand((unsigned)time(NULL) * GetCurrentThreadId());
 
 	std::wstring driver_path = GetDriverPath();
 	_wremove(driver_path.c_str());
 
-	if (!utils::CreateFileFromMemory(driver_path, reinterpret_cast<const char*>(MmKd_sumper), sizeof(MmKd_sumper))) {
+	if (!utils::CreateFileFromMemory(driver_path, reinterpret_cast<const char*>(Ld_BASE), sizeof(Ld_BASE))) {
+
+		//驱动文件创建失败
+
+		*status = 102;
+		
+
 		Log((L"[-] Failed to create vulnerable driver file") << std::endl);
 		return false;
 	}
 
 	if (!AcquireDebugPrivilege()) {
+
+		//权限提升失败
+		*status = 103;
+
 		Log((L"[-] Failed to acquire SeDebugPrivilege") << std::endl);
 		_wremove(driver_path.c_str());
 		return false;
 	}
 
 	if (!nt::RegisterAndStart(driver_path, GetDriverNameW())) {
+
+		*status = 104;
+		//驱动加载或启动失败
+
 		Log((L"[-] Failed to register and start service for the vulnerable driver") << std::endl);
 		_wremove(driver_path.c_str());
 		return false;
@@ -82,6 +96,9 @@ bool kd_driver::Load()
 	iqvw64e_device_handle = CreateFileA(XorStr("\\\\.\\esp_link"), GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 	if (iqvw64e_device_handle == INVALID_HANDLE_VALUE)
 	{
+		*status = 105;
+		//链接驱动通信失败
+
 		kd_driver::Unload();
 		Log((L"[-] failed handle !!") << std::endl);
 		return false;
@@ -91,6 +108,10 @@ bool kd_driver::Load()
 	kd_driver::ntoskrnlbase = utils::GetKernelModule("ntoskrnl.exe");
 	if (!kd_driver::ntoskrnlbase)
 	{
+		//获取内核模块基址失败
+
+		*status = 106;
+
 		kd_driver::Unload();
 		Log((L"[-] Failed to get ntoskrnl.exe") << std::endl);
 		return false;