-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathArbitraryOverwrite.c
More file actions
59 lines (48 loc) · 1.47 KB
/
Copy pathArbitraryOverwrite.c
File metadata and controls
59 lines (48 loc) · 1.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
#include "ArbitraryOverwrite.h"
PVOID pvArbitaryAddress = NULL;
PVOID pvArbitaryValue = NULL;
VOID
RestoreArbitaryOverWrite(VOID)
{
if (NULL != pvArbitaryAddress)
{
*(ULONG_PTR*)pvArbitaryAddress = (ULONG_PTR)pvArbitaryValue;
}
}
NTSTATUS
ArbitaryOverWriteHandler(
_In_ PIRP pIrp,
_In_ PIO_STACK_LOCATION pStackLocation
)
{
NTSTATUS status = STATUS_SUCCESS;
PWRITE_WHAT_WHERE pvUserBuffer = NULL;
PULONG_PTR What = NULL;
PULONG_PTR Where = NULL;
UNREFERENCED_PARAMETER(pIrp);
// METHOD_BUFFERED는 커널에 메모리를 할당하고 유저 메모리를 복사해서 사용하기에 ProbeForRead에서 오류 발생.
pvUserBuffer = (PWRITE_WHAT_WHERE)pStackLocation->Parameters.DeviceIoControl.Type3InputBuffer;
//pvUserBuffer = (PWRITE_WHAT_WHERE)pIrp->AssociatedIrp.SystemBuffer;
if (NULL == pvUserBuffer)
{
goto _RET;
}
__try
{
ProbeForRead(pvUserBuffer, sizeof(WRITE_WHAT_WHERE), (ULONG)__alignof(WRITE_WHAT_WHERE));
What = ((PWRITE_WHAT_WHERE)pvUserBuffer)->pulptrWhatAddress;
Where = ((PWRITE_WHAT_WHERE)pvUserBuffer)->pulptrWhereAddress;
// 해당 메모리 주소가 유저모드 메모리 주소인지 검사를 하지 않으면 커널 메모리 주소를 덮어버린다.
//ProbeForRead((PVOID)Where, sizeof(PULONG_PTR), (ULONG)__alignof(PULONG_PTR));
//ProbeForRead((PVOID)What, sizeof(PULONG_PTR), (ULONG)__alignof(PULONG_PTR));
pvArbitaryAddress = (PVOID)Where;
pvArbitaryValue = (PVOID)*(Where);
*(Where) = *(What);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
status = GetExceptionCode();
}
_RET:
return status;
}