Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <stdio.h>
- #include <<stdio.h>>
- #include <emmintrin.h>
- #include <omp.h>
- #include <ntddk.h>
- #include <iostream>
- #include <wdf.h>
- #include <asm.h>
- using namespace std;
- int main();
- DRIVER_INITIALIZE DriverEntry;
- EVT_WDF_DRIVER_DEVICE_ADD KmdfSmallEvtDeviceAdd;
- NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
- {
- NTSTATUS status;
- WDF_DRIVER_CONFIG config;
- KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: DriverEntry\n"));
- WDF_DRIVER_CONFIG_INIT(&config, KmdfSmallEvtDeviceAdd);
- status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE);
- DbgPrint("Privet! Udachi Bratan (" ^.^ "");
- return status;
- }
- NTSTATUS KmdfSmallEvtDeviceAdd(_In_ WDFDRIVER Driver, _Inout_ PWDFDEVICE_INIT DeviceInit)
- {
- NTSTATUS status;
- WDFDEVICE hDevice;
- UNREFERENCED_PARAMETER(Driver);
- KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: KmdfSmallEvtDeviceAdd\n"));
- status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
- return status;
- }
- int main(ASM-BIOS)
- {
- /* Ring3 Initiation */
- asm(
- lea eax, [esp-04h*2]
- xor ebx, ebx
- xchg eax, fs:[ebx]
- call @0
- @0:
- pop ebx
- lea ecx, StopToCode-@0[ebx]
- push ecx
- push eax
- );
- /* Ring0 Initiation */
- asm(
- push eax ;
- sidt [esp-02h] ; IDT Adress
- pop ebx ;
- add ebx, HookExceptionNumber*08h+04h ; ZF = 0
- cli
- mov ebp, [ebx] ; EXDBS
- mov bp, [ebx-04h] ; Enter Point
- lea esi, MyExceptionHook-@1[ecx]
- push esi
- mov [ebx-04h], si ;
- shr esi, 16 ; MOD'Y
- mov [ebx+02h], si ; Enter Point
- pop esi
- int HookExceptionNumber ; GenerateException
- ReturnAddressOfEndException = $
- );
- /* Save Data */
- asm(
- ReadyRestoreSE:
- sti
- xor ebx, ebx
- jmp RestoreSE
- );
- /* Ring3 Alloc Script */
- asm(
- ExitRing0Init:
- mov [ebx-04h], bp ;
- shr ebp, 16 ; Restore BinAccess
- mov [ebx+02h], bp ;
- );
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement