FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
KernelExploitDriver/KernelExploitDriver/ArbitraryOverwrite.c at master · ethobis/KernelExploitDriver · GitHub
ethobis
KernelExploitDriver
Repository navigation
Code
Issues
Pull requests
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
KernelExploitDriver
/
KernelExploitDriver
/
ArbitraryOverwrite.c
Copy path
More file actions
More file actions
Latest commit
History
History
History
59 lines (48 loc) · 1.47 KB
Breadcrumbs
KernelExploitDriver
/
KernelExploitDriver
/
ArbitraryOverwrite.c
Copy path
File metadata and controls
59 lines (48 loc) · 1.47 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
#include
"ArbitraryOverwrite.h"
PVOID
pvArbitaryAddress
=
NULL
;
PVOID
pvArbitaryValue
=
NULL
;
VOID
RestoreArbitaryOverWrite
(
VOID
)
{
if
(
NULL
!=
pvArbitaryAddress
)
{
*
(
ULONG_PTR
*
)
pvArbitaryAddress
=
(
ULONG_PTR
)
pvArbitaryValue
;
}
}
NTSTATUS
ArbitaryOverWriteHandler
(
_In_
PIRP
pIrp
,
_In_
PIO_STACK_LOCATION
pStackLocation
)
{
NTSTATUS
status
=
STATUS_SUCCESS
;
PWRITE_WHAT_WHERE
pvUserBuffer
=
NULL
;
PULONG_PTR
What
=
NULL
;
PULONG_PTR
Where
=
NULL
;
UNREFERENCED_PARAMETER
(
pIrp
);
// METHOD_BUFFERED는 커널에 메모리를 할당하고 유저 메모리를 복사해서 사용하기에 ProbeForRead에서 오류 발생.
pvUserBuffer
=
(
PWRITE_WHAT_WHERE
)
pStackLocation
->
Parameters
.
DeviceIoControl
.
Type3InputBuffer
;
//pvUserBuffer = (PWRITE_WHAT_WHERE)pIrp->AssociatedIrp.SystemBuffer;
if
(
NULL
==
pvUserBuffer
)
{
goto
_RET
;
}
__try
{
ProbeForRead
(
pvUserBuffer
,
sizeof
(
WRITE_WHAT_WHERE
), (
ULONG
)__alignof(
WRITE_WHAT_WHERE
));
What
=
((
PWRITE_WHAT_WHERE
)
pvUserBuffer
)
->
pulptrWhatAddress
;
Where
=
((
PWRITE_WHAT_WHERE
)
pvUserBuffer
)
->
pulptrWhereAddress
;
// 해당 메모리 주소가 유저모드 메모리 주소인지 검사를 하지 않으면 커널 메모리 주소를 덮어버린다.
//ProbeForRead((PVOID)Where, sizeof(PULONG_PTR), (ULONG)__alignof(PULONG_PTR));
//ProbeForRead((PVOID)What, sizeof(PULONG_PTR), (ULONG)__alignof(PULONG_PTR));
pvArbitaryAddress
=
(
PVOID
)
Where
;
pvArbitaryValue
=
(
PVOID
)
*
(
Where
);
*
(
Where
)
=
*
(
What
);
}
__except (
EXCEPTION_EXECUTE_HANDLER
)
{
status
=
GetExceptionCode
();
}
_RET
:
return
status
;
}
Back
|
FazBrowse Home
|
New Git URL