145 lines
3.3 KiB
C++
145 lines
3.3 KiB
C++
#pragma once
|
|
#include <Windows.h>
|
|
#include <iostream>
|
|
#include <winternl.h>
|
|
#include <stdint.h>
|
|
#include <fstream>
|
|
#include <string>
|
|
#pragma comment(lib, "ntdll.lib")
|
|
|
|
#define DEBUG_PRINTF 0
|
|
|
|
#if DEBUG_PRINTF
|
|
|
|
#define Log(content) std::wcout << content
|
|
#else
|
|
#define Log(content)
|
|
#endif // 0
|
|
|
|
|
|
|
|
|
|
|
|
namespace nt
|
|
{
|
|
EXTERN_C NTSTATUS RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN Client, BOOLEAN* WasEnabled);
|
|
EXTERN_C NTSTATUS NtLoadDriver(PUNICODE_STRING DriverServiceName);
|
|
EXTERN_C NTSTATUS NtUnloadDriver(PUNICODE_STRING DriverServiceName);
|
|
|
|
|
|
constexpr auto STATUS_INFO_LENGTH_MISMATCH = 0xC0000004;
|
|
|
|
constexpr auto SystemModuleInformation = 11;
|
|
constexpr auto SystemExtendedHandleInformation = 64;
|
|
|
|
bool RegisterAndStart(const std::wstring& driver_path, const std::wstring& serviceName);
|
|
bool StopAndRemove(const std::wstring& serviceName);
|
|
|
|
typedef struct _SYSTEM_HANDLE
|
|
{
|
|
PVOID Object;
|
|
HANDLE UniqueProcessId;
|
|
HANDLE HandleValue;
|
|
ULONG GrantedAccess;
|
|
USHORT CreatorBackTraceIndex;
|
|
USHORT ObjectTypeIndex;
|
|
ULONG HandleAttributes;
|
|
ULONG Reserved;
|
|
} SYSTEM_HANDLE, * PSYSTEM_HANDLE;
|
|
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION_EX
|
|
{
|
|
ULONG_PTR HandleCount;
|
|
ULONG_PTR Reserved;
|
|
SYSTEM_HANDLE Handles[1];
|
|
} SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX;
|
|
|
|
|
|
typedef struct _RTL_BALANCED_LINKS {
|
|
struct _RTL_BALANCED_LINKS* Parent;
|
|
struct _RTL_BALANCED_LINKS* LeftChild;
|
|
struct _RTL_BALANCED_LINKS* RightChild;
|
|
CHAR Balance;
|
|
UCHAR Reserved[3];
|
|
} RTL_BALANCED_LINKS;
|
|
typedef RTL_BALANCED_LINKS* PRTL_BALANCED_LINKS;
|
|
|
|
typedef struct _RTL_AVL_TABLE {
|
|
RTL_BALANCED_LINKS BalancedRoot;
|
|
PVOID OrderedPointer;
|
|
ULONG WhichOrderedElement;
|
|
ULONG NumberGenericTableElements;
|
|
ULONG DepthOfTree;
|
|
PVOID RestartKey;
|
|
ULONG DeleteCount;
|
|
PVOID CompareRoutine;
|
|
PVOID AllocateRoutine;
|
|
PVOID FreeRoutine;
|
|
PVOID TableContext;
|
|
} RTL_AVL_TABLE;
|
|
typedef RTL_AVL_TABLE* PRTL_AVL_TABLE;
|
|
|
|
typedef struct _PiDDBCacheEntry
|
|
{
|
|
LIST_ENTRY List;
|
|
UNICODE_STRING DriverName;
|
|
ULONG TimeDateStamp;
|
|
NTSTATUS LoadStatus;
|
|
char _0x0028[16]; // data from the shim engine, or uninitialized memory for custom drivers
|
|
} PiDDBCacheEntry, * NPiDDBCacheEntry;
|
|
|
|
typedef struct _HashBucketEntry
|
|
{
|
|
struct _HashBucketEntry* Next;
|
|
UNICODE_STRING DriverName;
|
|
ULONG CertHash[5];
|
|
} HashBucketEntry, * PHashBucketEntry;
|
|
|
|
}
|
|
|
|
typedef struct _CALC_VERIFY
|
|
{
|
|
int a, b, c, d;
|
|
ULONG64 calc_val;
|
|
|
|
}CALC_VERIFY,*PCALC_VERIFY;
|
|
|
|
typedef struct COMM_INFO
|
|
{
|
|
uintptr_t case_number;
|
|
uintptr_t reserved;
|
|
uintptr_t source;
|
|
uintptr_t destination;
|
|
uintptr_t length;
|
|
|
|
PCALC_VERIFY Verify;
|
|
|
|
}COMM_INFO, * PCOMM_INFO;
|
|
|
|
typedef struct _GET_PHYS_ADDRESS_BUFFER_INFO
|
|
{
|
|
uint64_t case_number;
|
|
uint64_t reserved;
|
|
uint64_t return_physical_address;
|
|
uint64_t address_to_translate;
|
|
}GET_PHYS_ADDRESS_BUFFER_INFO, * PGET_PHYS_ADDRESS_BUFFER_INFO;
|
|
|
|
typedef struct _MAP_IO_SPACE_BUFFER_INFO
|
|
{
|
|
uint64_t case_number;
|
|
uint64_t reserved;
|
|
uint64_t return_value;
|
|
uint64_t return_virtual_address;
|
|
uint64_t physical_address_to_map;
|
|
uint32_t size;
|
|
}MAP_IO_SPACE_BUFFER_INFO, * PMAP_IO_SPACE_BUFFER_INFO;
|
|
|
|
typedef struct _UNMAP_IO_SPACE_BUFFER_INFO
|
|
{
|
|
uint64_t case_number;
|
|
uint64_t reserved1;
|
|
uint64_t reserved2;
|
|
uint64_t virt_address;
|
|
uint64_t reserved3;
|
|
uint32_t number_of_bytes;
|
|
}UNMAP_IO_SPACE_BUFFER_INFO, * PUNMAP_IO_SPACE_BUFFER_INFO; |