hujnja

#include <ntddk.h>

#define IoRequestCode(code)     CTL_CODE(FILE_DEVICE_UNKNOWN, code, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
#define ReadRequestCode         IoRequestCode(0x0701)
#define WriteRequestCode        IoRequestCode(0x0702)
using ulong = unsigned long;

UNICODE_STRING devicePath, DOSDevicePath;

// Undocumented kernel functions

extern "C" NTSTATUS NTAPI MmCopyVirtualMemory
(
    PEPROCESS SourceProcess,
    PVOID SourceAddress,
    PEPROCESS TargetProcess,
    PVOID TargetAddress,
    SIZE_T BufferSize,
    KPROCESSOR_MODE PreviousMode,
    PSIZE_T ReturnSize
);

extern "C" NTSTATUS NTKERNELAPI PsLookupProcessByProcessId
(
    _In_ HANDLE ProcessId,
    _Outptr_ PEPROCESS* Process
);

enum ResponseStatus
{
    BadProcessId = 0xDEADBEEF
};

class ReadRequest
{
    public:
    ReadRequest(ulong pid, ulong addr, ulong sz) : Pid(pid), Addr(addr), Sz(sz) {};
    ulong Pid, Addr, Sz;
    void* Response;
};

class WriteRequest
{
    public:
    WriteRequest(ulong pid, ulong addr, void* data, ulong sz) : Pid(pid), Addr(addr), Data(data), Sz(sz) {};
    ulong Pid, Addr, Sz;
    void* Data;
};

void OnUnload(PDRIVER_OBJECT pDriver)
{
    IoDeleteSymbolicLink(&DOSDevicePath);
    IoDeleteDevice(pDriver->DeviceObject);
}

NTSTATUS IoControl(PDEVICE_OBJECT pDevice, PIRP pIrp)
{
    PIO_STACK_LOCATION ioStack = IoGetCurrentIrpStackLocation(pIrp);
    ULONG code = ioStack->Parameters.DeviceIoControl.IoControlCode;
    NTSTATUS status;
    SIZE_T argumentStub = 0;

    if (code = ReadRequestCode)
    {
        ReadRequest* request = (ReadRequest*)pIrp->AssociatedIrp.SystemBuffer;
        PEPROCESS process;
        if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)request->Pid, &process)))
        {
            MmCopyVirtualMemory(process, (PVOID)request->Addr, IoGetCurrentProcess(), request->Response, request->Sz, KernelMode, &argumentStub);
            status = STATUS_SUCCESS;
        }
        else
        {
            status = BadProcessId;
        }
    }
    if (code = WriteRequestCode)
    {
        WriteRequest* request = (WriteRequest*)pIrp->AssociatedIrp.SystemBuffer;
        PEPROCESS process;
        if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)request->Pid, &process)))
        {
            MmCopyVirtualMemory(IoGetCurrentProcess(), request->Data, process, (PVOID)request->Addr, request->Sz, KernelMode, &argumentStub);
        }
        else
        {
            status = BadProcessId;
        }
    }

    pIrp->IoStatus.Status = status;
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
    DbgPrint("Driver loaded\n");
    PDEVICE_OBJECT pDevice;

    RtlInitUnicodeString(&devicePath, L"\\Device\\MmDrv");
    RtlInitUnicodeString(&DOSDevicePath, L"\\DosDevices\\MmDrv");

    IoCreateDevice(pDriverObject, 0, &devicePath, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDevice);
    IoCreateSymbolicLink(&DOSDevicePath, &devicePath);

    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IoControl;
    pDriverObject->DriverUnload = OnUnload;

    pDevice->Flags |= DO_DIRECT_IO;
    pDevice->Flags &= ~DO_DEVICE_INITIALIZING;

    return STATUS_SUCCESS;
}