Windows Driver PoC | Take Ownership of Win Store NieR:Automata Binary

 // e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - JEREMY SHA-256 EXE
NTSTATUS KsNierExe(VOID)
{
    NTSTATUS Status;
    HANDLE hFile, hFileDest;
    UNICODE_STRING uniSrcName, uniDestName;
    OBJECT_ATTRIBUTES ObjAttribSrc, ObjAttrDest;
    IO_STATUS_BLOCK IoStatusBlock;
    BYTE Buffer[1024];

    LARGE_INTEGER liCursorWrite = { 0 };
    LARGE_INTEGER liCursorRead = { 0 };

    RtlInitUnicodeString(&uniSrcName, L"\\DosDevices\\C:\\Program Files\\WindowsApps\\39EA002F.NieRAutomataPC_1.0.38.0_x64__n746a19ndrrjg\\NieRAutomata.exe");

    InitializeObjectAttributes(&ObjAttribSrc, &uniSrcName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

    TRACE("File:  %ls \n", uniSrcName.Buffer);

    // Do not try to perform any file operations at higher IRQL levels.
    // Instead, you may use a work item or a system worker thread to perform file operations.
    if (KeGetCurrentIrql() != PASSIVE_LEVEL)
        return STATUS_INVALID_DEVICE_STATE;

    TRACE("IRQL CHECK\n");

    Status = ZwOpenFile(&hFile, GENERIC_READ, &ObjAttribSrc, &IoStatusBlock, NULL,
        FILE_ATTRIBUTE_NORMAL, 0, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);

    if (NT_SUCCESS(Status))
    {
        TRACE("Opened Source File\n");

        RtlInitUnicodeString(&uniDestName, L"\\DosDevices\\Z:\\39EA002F.NieRAutomataPC_1.0.38.0_x64__n746a19ndrrjg\\NieRAutomata.exe");

        InitializeObjectAttributes(&ObjAttrDest, &uniDestName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

        Status = ZwCreateFile(&hFileDest, GENERIC_WRITE, &ObjAttrDest, &IoStatusBlock, NULL,
            FILE_ATTRIBUTE_NORMAL, 0, FILE_CREATE, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);

        TRACE("ZwCreateFile (DEST) %x\n", Status);

        if (NT_SUCCESS(Status))
        {
            TRACE("Opened Dest File\n");

            FILE_STANDARD_INFORMATION fileInfo = { 0 };

            //. fileInfo.EndOfFile is the file size of handle.
            Status = ZwQueryInformationFile(hFile, &IoStatusBlock, &fileInfo, sizeof(fileInfo), FileStandardInformation);
            if (NT_SUCCESS(Status))
            {
                TRACE("Src File Size %llx\n", fileInfo.EndOfFile.QuadPart);

                while (liCursorRead.QuadPart < fileInfo.EndOfFile.QuadPart)
                {
                    ULONG uReadSize = (fileInfo.EndOfFile.QuadPart - liCursorRead.QuadPart >= 1024) ? 1024 : fileInfo.EndOfFile.QuadPart - liCursorRead.QuadPart;

                    if (NT_SUCCESS(Status))
                    {
                        Status = ZwReadFile(hFile, NULL, NULL, NULL, &IoStatusBlock,
                            Buffer, uReadSize, &liCursorRead, NULL);

                        liCursorRead.QuadPart += uReadSize;

                        TRACE("READ BUFFER STATUS %x Cursor %llx\n", Status, liCursorRead.QuadPart);
                    }

                    if (NT_SUCCESS(Status))
                    {
                        Status = ZwWriteFile(hFileDest, NULL, NULL, NULL, &IoStatusBlock,
                            Buffer, uReadSize, &liCursorWrite, NULL);

                        liCursorWrite.QuadPart += uReadSize;

                        TRACE("WRITE BUFFER %x Cursor %llx\n", Status, liCursorWrite.QuadPart);
                    }

                    TRACE("FILE SIZE: %llx READ CURSOR: %llx\n", liCursorRead.QuadPart, fileInfo.EndOfFile.QuadPart);
                }
            }
            ZwClose(hFileDest);
        }
        ZwClose(hFile);
    }

    return Status;
}