refactor a ton of stuff + dynamic pointer gettin
This commit is contained in:
@@ -1,54 +1,16 @@
|
||||
#include "PdFwKrnl.h"
|
||||
|
||||
template <typename T, typename... Args>
|
||||
T call_kernel_function(const char* function_name, Args... args){
|
||||
|
||||
uint64_t ntoskrnl_base = pdfwkrnl.get_ntoskrnl_base();
|
||||
if (!ntoskrnl_base)
|
||||
return T{};
|
||||
|
||||
uint64_t function_address = pdfwkrnl.get_ntoskrnl_export(function_name);
|
||||
if (!function_address)
|
||||
return T{};
|
||||
|
||||
uint64_t qword_swap = ntoskrnl_base + 0xC1DA00;
|
||||
uint64_t qword_original = 0;
|
||||
|
||||
if (!pdfwkrnl.read_virtual_memory(qword_swap, &qword_original, sizeof(uint64_t)))
|
||||
return T{};
|
||||
|
||||
if (!pdfwkrnl.write_virtual_memory(qword_swap, &function_address, sizeof(uint64_t)))
|
||||
return T{};
|
||||
|
||||
HMODULE m_ntdll = GetModuleHandleA("ntdll.dll");
|
||||
if (!m_ntdll)
|
||||
return T{};
|
||||
|
||||
FARPROC NtCompareSigningLevels = GetProcAddress(m_ntdll, "NtCompareSigningLevels");
|
||||
|
||||
using FuncPtr = T(__stdcall*)(Args...);
|
||||
if constexpr (std::is_void_v<T>) {
|
||||
auto func = reinterpret_cast<void(__stdcall*)(Args...)>(NtCompareSigningLevels);
|
||||
func(args...);
|
||||
pdfwkrnl.write_virtual_memory(qword_swap, &qword_original, sizeof(uint64_t)); // swap back
|
||||
return T{};
|
||||
}
|
||||
else {
|
||||
auto func = reinterpret_cast<FuncPtr>(NtCompareSigningLevels);
|
||||
T return_value = func(args...);
|
||||
pdfwkrnl.write_virtual_memory(qword_swap, &qword_original, sizeof(uint64_t)); // swap back
|
||||
return return_value;
|
||||
}
|
||||
}
|
||||
|
||||
int main() {
|
||||
if (!pdfwkrnl.attach())
|
||||
int main(void) {
|
||||
if (!pdfwkrnl::attach()) {
|
||||
printf(STR("failed to attach to driver \n"));
|
||||
return -1;
|
||||
}
|
||||
|
||||
printf("attached to kernel\n");
|
||||
// a ntstatus of STATUS_INVALID_IMAGE_HASH or 0xC0000428 will always be returned as NtCompareSigningLevels always returns it if returned value by the called function is not equal then 0.
|
||||
pdfwkrnl::call_kernel_function<void>(pdfwkrnl::get_kernel_export("DbgPrint"), "hello from pdfwkrnl!\n");
|
||||
|
||||
call_kernel_function<void>("DbgPrint", "called kernel function");
|
||||
|
||||
pdfwkrnl.detach();
|
||||
return 0;
|
||||
}
|
||||
if (!pdfwkrnl::detach()) {
|
||||
printf(STR("failed to detach from driver \n"));
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user