hfiref0x’s gists

hfiref0x / log.txt

Created February 5, 2019 05:58

CMake (6e91f5d6204e650c808b6585074faa248ee6e6a9)

	/Build/cmake/Source/kwsys/ProcessUNIX.c 378 err V595 The 'cp->Commands' pointer was utilized before it was verified against nullptr. Check lines: 378, 381.
	/Build/cmake/Source/kwsys/Terminal.c 62 warn V560 A part of conditional expression is always true: !pipeIsConsole.
	/Build/cmake/Source/kwsys/System.c 31 err V1028 Possible overflow. Consider casting operands of the '* size * 2' operator to the 'size_t' type, not the result.
	/Build/cmake/Source/cmsys/RegularExpression.hxx 409 warn V730 Not all members of a class are initialized inside the constructor. Consider inspecting: regstart, reganch, regmust, regmlen, progsize.
	/Build/cmake/Source/kwsys/RegularExpression.cxx 260 err V536 Be advised that the utilized constant value is represented by an octal form. Oct: 0234, Dec: 156.
	/Build/cmake/Source/kwsys/SystemTools.cxx 851 warn V769 The 'orig' pointer in the 'searchPos - src + orig' expression could be nullptr. In such case, resulting value will be senseless and it should not be used. Check lines: 851, 849.
	/Bu

hfiref0x / akagi_58a.c

Created October 23, 2019 16:27

UAC bypass using EditionUpgradeManager COM interface


	typedef interface IEditionUpgradeManager IEditionUpgradeManager;

	typedef struct IEditionUpgradeManagerVtbl {

	BEGIN_INTERFACE

	HRESULT(STDMETHODCALLTYPE *QueryInterface)(
	__RPC__in IEditionUpgradeManager * This,
	__RPC__in REFIID riid,

hfiref0x / gist:6901a8e571946e84d8adb1c6f720fdad

Created November 15, 2019 16:27

NtGdiDdDDISetHwProtectionTeardownRecovery BSOD

	NtGdiDdDDISetHwProtectionTeardownRecovery (0x121B) service implemented in Windows 10 TH2 has no validation of input parameter which is pointer.

	.text:00000001C00BA0C0 public NtGdiDdDDISetHwProtectionTeardownRecovery
	.text:00000001C00BA0C0 NtGdiDdDDISetHwProtectionTeardownRecovery proc near
	.text:00000001C00BA0C0 xor r8d, r8d
	.text:00000001C00BA0C3 mov edx, 1
	.text:00000001C00BA0C8 cmp [rcx+4], r8d //<- Have a nice BSOD
	.text:00000001C00BA0CC setz r8b
	.text:00000001C00BA0D0 xor ecx, ecx
	.text:00000001C00BA0D2 jmp DCompositionForceRender

hfiref0x / ntoskrnl

Created December 11, 2019 08:24

ReactOS syscalls

	NtAcceptConnectPort 0
	NtAccessCheck 1
	NtAccessCheckAndAuditAlarm 2
	NtAccessCheckByType 3 (STATUS_NOT_IMPLEMENTED)
	NtAccessCheckByTypeAndAuditAlarm 4
	NtAccessCheckByTypeResultList 5 (STATUS_NOT_IMPLEMENTED)
	NtAccessCheckByTypeResultListAndAuditAlarm 6
	NtAccessCheckByTypeResultListAndAuditAlarmByHandle 7
	NtAddAtom 8
	NtAddBootEntry 9 (STATUS_NOT_IMPLEMENTED)

hfiref0x / rtcore.c

Created January 25, 2020 13:40

RTCore64 DoS Proof-of-concept

	#include <windows.h>
	#include <cstdio>

	typedef struct _RTCORE_WRITE_PORT_UCHAR {
	ULONG Port;
	ULONG Value;
	} RTCORE_WRITE_PORT_UCHAR, * PRTCORE_WRITE_PORT_UCHAR;

	#define KBRD_INTRFC 0x64
	#define KBRD_RESET 0xFE

hfiref0x / wr0_demo1.c

Created January 29, 2020 13:45

EVGA PrecisionX OC 6.2.7 wormhole driver

	#include <windows.h>
	#include <cstdio>

	#define DEVICE_WR0_TYPE 40000
	#define WR0_DEVICE_LINK TEXT("\\\\.\\WinRing0_1_2_0")

	HANDLE g_handleWR0 = INVALID_HANDLE_VALUE;

	//
	// Port mapped I/O access IOCTLS.

hfiref0x / wr0_demo2.c

Created January 29, 2020 14:40

EVGA PrecisionX OC 6.2.7 wormhole driver

	#include <windows.h>
	#include <cstdio>

	#define DEVICE_WR0_TYPE 40000
	#define WR0_DEVICE_LINK TEXT("\\\\.\\WinRing0_1_2_0")

	HANDLE g_handleWR0 = INVALID_HANDLE_VALUE;

	#define IOCTL_WR0_READ_MSR CTL_CODE(DEVICE_WR0_TYPE, 0x821, METHOD_BUFFERED, FILE_ANY_ACCESS)
	#define IOCTL_WR0_WRITE_MSR CTL_CODE(DEVICE_WR0_TYPE, 0x822, METHOD_BUFFERED, FILE_ANY_ACCESS)

hfiref0x / wr0_demo3.c

Created January 29, 2020 17:54

EVGA PrecisionX OC 6.2.7 wormhole driver

	#include <windows.h>
	#include <cstdio>

	#define DEVICE_WR0_TYPE 40000
	#define WR0_DEVICE_LINK TEXT("\\\\.\\WinRing0_1_2_0")

	HANDLE g_handleWR0 = INVALID_HANDLE_VALUE;

	#define IOCTL_WR0_READ_MEMORY CTL_CODE(DEVICE_WR0_TYPE, 0x841, METHOD_BUFFERED, FILE_READ_ACCESS)
	#define IOCTL_WR0_WRITE_MEMORY CTL_CODE(DEVICE_WR0_TYPE, 0x842, METHOD_BUFFERED, FILE_WRITE_ACCESS)

hfiref0x / wr0_demo4.c

Last active October 28, 2021 07:10

EVGA PrecisionX OC 6.2.7 wormhole driver

	#include <windows.h>
	#include <cstdio>

	#define DEVICE_WR0_TYPE 40000
	#define WR0_DEVICE_LINK TEXT("\\\\.\\WinRing0_1_2_0")

	HANDLE g_handleWR0 = INVALID_HANDLE_VALUE;

	#define IOCTL_WR0_READ_PCI_CONFIG CTL_CODE(DEVICE_WR0_TYPE, 0x851, METHOD_BUFFERED, FILE_READ_ACCESS)
	#define IOCTL_WR0_WRITE_PCI_CONFIG CTL_CODE(DEVICE_WR0_TYPE, 0x852, METHOD_BUFFERED, FILE_WRITE_ACCESS)

hfiref0x / handleopen.c

Created February 8, 2020 16:21

	NTSTATUS HandleOpen(PDEVICE_OBJECT DeviceObject, IRP *Irp)
	{
	NTSTATUS ntStatus;
	BOOL bAllowed;
	PIO_SECURITY_CONTEXT SecurityContext;
	PACCESS_STATE AccessState;
	PACCESS_TOKEN Token;
	DWORD IsTokenElevated;
	DWORD tokenIntegrityLevel;
	PTOKEN_ELEVATION tokenElevation;