Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <ntddk.h>
- #define IoRequestCode(code) CTL_CODE(FILE_DEVICE_UNKNOWN, code, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
- #define ReadRequestCode IoRequestCode(0x0701)
- #define WriteRequestCode IoRequestCode(0x0702)
- using ulong = unsigned long;
- UNICODE_STRING devicePath, dosDevicePath;
- // Undocumented kernel function definitions
- NTSTATUS NTAPI MmCopyVirtualMemory
- (
- PEPROCESS SourceProcess,
- PVOID SourceAddress,
- PEPROCESS TargetProcess,
- PVOID TargetAddress,
- SIZE_T BufferSize,
- KPROCESSOR_MODE PreviousMode,
- PSIZE_T ReturnSize
- );
- NTKERNELAPI NTSTATUS PsLookupProcessByProcessId
- (
- _In_ HANDLE ProcessId,
- _Outptr_ PEPROCESS *Process
- );
- class ReadRequest
- {
- public:
- ReadRequest(ulong pid, ulong addr, ulong sz) : Pid(pid), Addr(addr), Sz(sz) {};
- ulong Pid, Addr, Sz;
- void* Result;
- };
- class WriteRequest
- {
- public:
- WriteRequest(ulong pid, ulong addr, void* data, ulong sz) : Pid(pid), Addr(addr), Data(data), Sz(sz) {};
- ulong Pid, Addr, Sz;
- void* Data;
- };
- NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
- {
- DbgPrint("Driver loaded \n");
- PDEVICE_OBJECT pDevice;
- RtlInitUnicodeString(&devicePath, L"\\Device\\MmDrv");
- RtlInitUnicodeString(&dosDevicePath, L"\\DosDevices\\MmDrv");
- IoCreateDevice(pDriverObject, 0, &devicePath, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDevice);
- IoCreateSymbolicLink(&dosDevicePath, &devicePath);
- pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IoControl;
- pDriverObject->MajorFunction[IRP_MJ_CREATE] = CreateCall;
- pDriverObject->MajorFunction[IRP_MJ_CLOSE] = CloseCall;
- pDriverObject->DriverUnload = OnUnload;
- pDevice->Flags |= DO_DIRECT_IO;
- pDevice->Flags &= ~DO_DEVICE_INITIALIZING;
- }
- NTSTATUS IoControl(PDEVICE_OBJECT pDevice, PIRP pIrp)
- {
- PIO_STACK_LOCATION ioStack = IoGetCurrentIrpStackLocation(pIrp);
- ULONG code = ioStack->Parameters.DeviceIoControl.IoControlCode;
- if (code = ReadRequestCode)
- {
- ReadRequest* request = (ReadRequest*)pIrp->AssociatedIrp.SystemBuffer;
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement