KernelExploitDriver/KernelExploitDriver/PoolOverflow.c at master · ethobis/KernelExploitDriver · GitHub

Repository navigation

History

54 lines (45 loc) · 1.06 KB

Raw

#include "PoolOverflow.h"

NTSTATUS

PoolOverflowHandler(

_In_ PIRP pIrp,

_In_ PIO_STACK_LOCATION pStackLocation

)

{

NTSTATUS status = STATUS_SUCCESS;

PVOID pvUserBuffer = NULL;

PVOID pvKernelBuffer = NULL;

ULONG ulInputBufferLength = 0;

UNREFERENCED_PARAMETER(pIrp);

ulInputBufferLength = pStackLocation->Parameters.DeviceIoControl.InputBufferLength;

pvUserBuffer = (PVOID)pStackLocation->Parameters.DeviceIoControl.Type3InputBuffer;

if (NULL == pvUserBuffer)

{

goto _RET;

}

__try

{

pvKernelBuffer = ExAllocatePoolWithTag(

NonPagedPool,

POOL_SIZE,

'pofh'

);

if (NULL == pvKernelBuffer)

{

goto _RET;

}

ProbeForRead((PVOID)pvUserBuffer, POOL_SIZE, (ULONG)__alignof(UCHAR));

//RtlCopyMemory((PVOID)pvKernelBuffer, (PVOID)pvUserBuffer, POOL_SIZE);

RtlCopyMemory((PVOID)pvKernelBuffer, (PVOID)pvUserBuffer, ulInputBufferLength);

if (NULL != pvKernelBuffer)

{

ExFreePoolWithTag(pvKernelBuffer, 'pofh');

pvKernelBuffer = NULL;

}

__except (EXCEPTION_EXECUTE_HANDLER)

{

status = GetExceptionCode();

}

_RET:

return status;

}

KernelExploitDriver/KernelExploitDriver/PoolOverflow.c at master · ethobis/KernelExploitDriver · GitHub

Repository navigation

Expand file tree

Breadcrumbs

PoolOverflow.c

Latest commit

History

Breadcrumbs

PoolOverflow.c

File metadata and controls