Martymoose98

Windows Driver PoC | Take Ownership of Win Store NieR:Automata Binary

Oct 17th, 2021
948
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. NTSTATUS KsNierExe(VOID)
  2. {
  3.     NTSTATUS Status;
  4.     HANDLE hFile, hFileDest;
  5.     UNICODE_STRING uniSrcName, uniDestName;
  6.     OBJECT_ATTRIBUTES ObjAttribSrc, ObjAttrDest;
  7.     IO_STATUS_BLOCK IoStatusBlock;
  8.     BYTE Buffer[1024];
  9.  
  10.     LARGE_INTEGER liCursorWrite = { 0 };
  11.     LARGE_INTEGER liCursorRead = { 0 };
  12.  
  13.     RtlInitUnicodeString(&uniSrcName, L"\\DosDevices\\C:\\Program Files\\WindowsApps\\39EA002F.NieRAutomataPC_1.0.38.0_x64__n746a19ndrrjg\\NieRAutomata.exe");
  14.  
  15.     InitializeObjectAttributes(&ObjAttribSrc, &uniSrcName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
  16.  
  17.     TRACE("File:  %ls \n", uniSrcName.Buffer);
  18.  
  19.     // Do not try to perform any file operations at higher IRQL levels.
  20.     // Instead, you may use a work item or a system worker thread to perform file operations.
  21.     if (KeGetCurrentIrql() != PASSIVE_LEVEL)
  22.         return STATUS_INVALID_DEVICE_STATE;
  23.  
  24.     TRACE("IRQL CHECK\n");
  25.  
  26.     Status = ZwOpenFile(&hFile, GENERIC_READ, &ObjAttribSrc, &IoStatusBlock, NULL,
  27.         FILE_ATTRIBUTE_NORMAL, 0, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
  28.  
  29.     if (NT_SUCCESS(Status))
  30.     {
  31.         TRACE("Opened Source File\n");
  32.  
  33.         RtlInitUnicodeString(&uniDestName, L"\\DosDevices\\Z:\\39EA002F.NieRAutomataPC_1.0.38.0_x64__n746a19ndrrjg\\NieRAutomata.exe");
  34.  
  35.         InitializeObjectAttributes(&ObjAttrDest, &uniDestName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
  36.  
  37.         Status = ZwCreateFile(&hFileDest, GENERIC_WRITE, &ObjAttrDest, &IoStatusBlock, NULL,
  38.             FILE_ATTRIBUTE_NORMAL, 0, FILE_CREATE, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
  39.  
  40.         TRACE("ZwCreateFile (DEST) %x\n", Status);
  41.  
  42.         if (NT_SUCCESS(Status))
  43.         {
  44.             TRACE("Opened Dest File\n");
  45.  
  46.             FILE_STANDARD_INFORMATION fileInfo = { 0 };
  47.  
  48.             //. fileInfo.EndOfFile is the file size of handle.
  49.             Status = ZwQueryInformationFile(hFile, &IoStatusBlock, &fileInfo, sizeof(fileInfo), FileStandardInformation);
  50.             if (NT_SUCCESS(Status))
  51.             {
  52.                 TRACE("Src File Size %llx\n", fileInfo.EndOfFile.QuadPart);
  53.  
  54.                 while (liCursorRead.QuadPart < fileInfo.EndOfFile.QuadPart)
  55.                 {
  56.                     ULONG uReadSize = (fileInfo.EndOfFile.QuadPart - liCursorRead.QuadPart >= 1024) ? 1024 : fileInfo.EndOfFile.QuadPart - liCursorRead.QuadPart;
  57.  
  58.                     if (NT_SUCCESS(Status))
  59.                     {
  60.                         Status = ZwReadFile(hFile, NULL, NULL, NULL, &IoStatusBlock,
  61.                             Buffer, uReadSize, &liCursorRead, NULL);
  62.  
  63.                         liCursorRead.QuadPart += uReadSize;
  64.  
  65.                         TRACE("READ BUFFER STATUS %x Cursor %llx\n", Status, liCursorRead.QuadPart);
  66.                     }
  67.  
  68.                     if (NT_SUCCESS(Status))
  69.                     {
  70.                         Status = ZwWriteFile(hFileDest, NULL, NULL, NULL, &IoStatusBlock,
  71.                             Buffer, uReadSize, &liCursorWrite, NULL);
  72.  
  73.                         liCursorWrite.QuadPart += uReadSize;
  74.  
  75.                         TRACE("WRITE BUFFER %x Cursor %llx\n", Status, liCursorWrite.QuadPart);
  76.                     }
  77.  
  78.                     TRACE("FILE SIZE: %llx READ CURSOR: %llx\n", liCursorRead.QuadPart, fileInfo.EndOfFile.QuadPart);
  79.                 }
  80.             }
  81.             ZwClose(hFileDest);
  82.         }
  83.         ZwClose(hFile);
  84.     }
  85.  
  86.     return Status;
  87. }
RAW Paste Data