76 lines
1.9 KiB
C++
76 lines
1.9 KiB
C++
#include "driver_func.h"
|
|
|
|
|
|
typedef ULONG(WINAPI* NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)(char a1, PVOID a2, PVOID a3, PVOID a4);
|
|
NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc gNtConvertBetweenAuxiliary = NULL;
|
|
|
|
HANDLE null_device_handle;
|
|
|
|
OSVERSIONINFOW os{ 0 };
|
|
|
|
namespace driver_func
|
|
{
|
|
auto GetVersion() -> OSVERSIONINFOW
|
|
{
|
|
OSVERSIONINFOW os{ 0 };
|
|
typedef NTSTATUS(WINAPI* PFNRtlGetVersion)(PRTL_OSVERSIONINFOW);
|
|
static PFNRtlGetVersion RtlGetVersion = nullptr;
|
|
if (RtlGetVersion == nullptr)
|
|
{
|
|
HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
|
|
if (hNtdll != NULL)
|
|
{
|
|
RtlGetVersion = (PFNRtlGetVersion)GetProcAddress(hNtdll, "RtlGetVersion");
|
|
}
|
|
}
|
|
|
|
RtlGetVersion(&os);
|
|
return os;
|
|
}
|
|
|
|
auto init() -> BOOL
|
|
{
|
|
os = GetVersion();
|
|
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
|
|
{
|
|
null_device_handle = CreateFileA("\\\\.\\Nul", GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
|
|
if (null_device_handle != NULL && null_device_handle != INVALID_HANDLE_VALUE)
|
|
return TRUE;
|
|
}
|
|
else if (os.dwBuildNumber >= 14393)
|
|
{
|
|
HMODULE ntdll = GetModuleHandleA("ntdll.dll");
|
|
if (ntdll)
|
|
{
|
|
if (gNtConvertBetweenAuxiliary == nullptr)
|
|
{
|
|
gNtConvertBetweenAuxiliary = (NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)
|
|
GetProcAddress(ntdll, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter");
|
|
|
|
return gNtConvertBetweenAuxiliary ? TRUE : FALSE;
|
|
}
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
auto driver_comm_func(LPVOID Buf, DWORD bufSize)->BOOL
|
|
{
|
|
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
|
|
{
|
|
DWORD retlen = 0;
|
|
return DeviceIoControl(null_device_handle, 0x12345678, Buf, bufSize, Buf, bufSize, &retlen, NULL);
|
|
}
|
|
else if (os.dwBuildNumber >= 14393)
|
|
{
|
|
ULONG64 xxx = 0;
|
|
auto data = (ULONG64)Buf;
|
|
gNtConvertBetweenAuxiliary(1, &data, (PVOID)&xxx, NULL);
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
} |