| #include <windows.h> | |
| #include <cstdio> | |
| #include "ntos.h" | |
| #define WINIO_DEVICE_TYPE (DWORD)0x8010 | |
| #define WINIO_MAP_FUNCID (DWORD)0x810 | |
| #define WINIO_UNMAP_FUNCID (DWORD)0x811 | |
| #define IOCTL_WINIO_MAP_USER_PHYSICAL_MEMORY \ |
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <cstdio> | |
| #include <ntstatus.h> | |
| typedef NTSTATUS (NTAPI *pfnNtCreateEnclave)( | |
| _In_ HANDLE ProcessHandle, | |
| _Inout_ PVOID* BaseAddress, | |
| _In_ ULONG_PTR ZeroBits, |
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, |
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, |
All parameters to the functions supplied from user-mode via DeviceIoControl parameters. Everything from this available for any local user on machine where this driver is running.
Arbitrary file deletion. Resets file attributes via ZwSetInformationFile and then does ZwDeleteFile.
Wrapper around ZwQuerySystemInformation(SystemProcessInformation).
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| #if defined (_MSC_VER) | |
| #if (_MSC_VER >= 1900) | |
| #ifdef _DEBUG |
| This is saskutil64.sys 1.0.0.1016 driver of SUPERAntispyware 8.0.0.1050 (current), both Free/Pro editions. | |
| The SaskCallDriver function work with fixed size buffer send from user mode. | |
| This buffer is a structure defined as | |
| #pragma pack(push, 1) | |
| typedef struct _CALL_DRV { | |
| WCHAR DeviceName[2048]; //e.g. \Device\Harddisk0\DR0 | |
| LARGE_INTEGER StartingOffset; | |
| SIZE_T DataSize; | |
| PVOID DataPtr; //pointer to user mode allocated buffer of DataSize length. |
| int main() | |
| { | |
| HANDLE deviceHandle = CreateFile(TEXT("\\\\.\\MaxProc64"), | |
| GENERIC_READ | GENERIC_WRITE, | |
| 0, | |
| NULL, | |
| OPEN_EXISTING, | |
| 0, | |
| NULL); |
| __int64 __fastcall DrvDispatch(PDEVICE_OBJECT DeviceObject, _IRP *Irp) | |
| { | |
| _IO_STACK_LOCATION *StackLocation; | |
| _IRP *_Irp; | |
| __int64 Id; | |
| StackLocation = Irp->Tail.Overlay.CurrentStackLocation; | |
| _Irp = Irp; | |
| switch ( StackLocation->Parameters.DeviceIoControl.IoControlCode ) | |
| { |
| #include <windows.h> | |
| #include "ntos.h" | |
| #include <cstdio> | |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, | |
| _In_ PVOID InputBuffer, | |
| _In_ ULONG InputBufferLength, | |
| _In_opt_ PVOID OutputBuffer, |