Add files via upload

Author: EEEEhex

SbieKernelPatch.sln

@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.14.36408.4 d17.14
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SbieKernelPatch", "SbieKernelPatch\SbieKernelPatch.vcxproj", "{3129E8DD-7654-4A1F-A305-57CBB984EDD7}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Debug|x64.ActiveCfg = Debug|x64
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Debug|x64.Build.0 = Debug|x64
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Debug|x86.ActiveCfg = Debug|Win32
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Debug|x86.Build.0 = Debug|Win32
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Release|x64.ActiveCfg = Release|x64
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Release|x64.Build.0 = Release|x64
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Release|x86.ActiveCfg = Release|Win32
+		{3129E8DD-7654-4A1F-A305-57CBB984EDD7}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {D358B296-3E83-4D17-A51F-44666C4D0189}
+	EndGlobalSection
+EndGlobal

SbieKernelPatch/DriverInterface.h

@@ -0,0 +1,88 @@
+#include <iostream>
+#include "DriverTypes.h"
+
+class DriverInterface {
+public:
+    HANDLE hDevice;
+
+    // On instantiation, get a handle to the driver and execute our first IOCTL call.
+    DriverInterface() {
+        hDevice = CreateFileA(
+                "\\\\.\\EchoDrv",
+                GENERIC_READ | GENERIC_WRITE,
+                FILE_SHARE_READ | FILE_SHARE_WRITE,
+                NULL,
+                OPEN_EXISTING,
+                NULL,
+                NULL
+        );
+
+        //If driver handle failed to open print message and return
+        if (hDevice == INVALID_HANDLE_VALUE) {
+            std::cout << "Invalid handle on CreateFileA!" << std::endl;
+            //Get the last error from windows for CreateFile
+            std::cout << "Error code: " << GetLastError() << std::endl;
+        }
+
+        // Yes, this buffer seems useless - but without it the driver BSOD's the PC.
+        //Create a buffer to have data returned to.
+        void* buf = (void*)malloc(4096);
+
+        //Call IOCTL that sets the PID variable and gets past the DWORD check
+        //0x9e6a0594 - IOCTL Code
+        BOOL success = DeviceIoControl(hDevice, 0x9e6a0594, NULL, NULL, buf, 4096, NULL, NULL);
+        if (!success) {
+            std::cout << "DeviceIOControl 0x9e6a0594 failed!" << std::endl;
+            std::cout << "Error code: " << GetLastError() << std::endl;
+
+            CloseHandle(hDevice);
+            return;
+        }
+
+        //We don't need that buffer anymore
+        free(buf);
+    }
+
+    ~DriverInterface() {
+        CloseHandle(hDevice);
+    }
+
+    // Next, get a HANDLE to the desired process through the driver.
+    HANDLE get_handle_for_pid(DWORD pid) {
+        // IOCTL Code - 0xe6224248
+
+        k_get_handle param{};
+        // Process ID to get handle for
+        param.pid = pid;
+
+        // Access to be granted on the returned handle
+        param.access = GENERIC_ALL;
+
+        // Do DeviceIoControl call
+        BOOL success = DeviceIoControl(hDevice, 0xe6224248, &param, sizeof(param), &param, sizeof(param), NULL, NULL);
+        if (!success) {
+            std::cout << "DeviceIOControl 0xe6224248 failed!" << std::endl;
+            std::cout << "Error code: " << GetLastError() << std::endl;
+            return INVALID_HANDLE_VALUE;
+        }
+
+        // Return the handle given by the driver.
+        return param.handle;
+    }
+
+    // A simple function to read memory using the driver.
+    BOOL read_memory_raw(void* address, void* buf, size_t len, HANDLE targetProcess) {
+        k_param_readmem req{};
+        req.fromAddress = (void*)address;
+        req.length = len;
+        req.targetProcess = targetProcess;
+        req.toAddress = (void*)buf;
+
+        BOOL success = DeviceIoControl(hDevice, 0x60a26124, &req, sizeof(k_param_readmem), &req, sizeof(k_param_readmem), NULL, NULL);
+        return success;
+    }
+
+    void Shutdown() {
+        CloseHandle(hDevice);
+   }
+};

SbieKernelPatch/DriverTypes.h

@@ -0,0 +1,79 @@
+#pragma once
+#include <Windows.h>
+#include <cstdint>
+#include <winternl.h>
+
+struct k_param_readmem {
+    HANDLE targetProcess;
+    void* fromAddress;
+    void* toAddress;
+    size_t length;
+    void* padding;
+    uint32_t returnCode;
+};
+
+struct k_param_init {
+    void* first;
+    void* second;
+    void* third;
+};
+
+struct k_get_handle {
+    DWORD pid;
+    ACCESS_MASK access;
+    HANDLE handle;
+    DWORD extra1; // ½ÓסÇý¶¯¶àдµÄ 
+};
+
+// This is a windows type to fetch NtQuerySystemInformation
+// These structures are copied from Process Hacker source code (ntldr.h)
+typedef struct _RTL_PROCESS_MODULE_INFORMATION
+{
+    HANDLE Section;
+    PVOID MappedBase;
+    PVOID ImageBase;
+    ULONG ImageSize;
+    ULONG Flags;
+    USHORT LoadOrderIndex;
+    USHORT InitOrderIndex;
+    USHORT LoadCount;
+    USHORT OffsetToFileName;
+    UCHAR FullPathName[256];
+} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
+
+typedef struct _RTL_PROCESS_MODULES
+{
+    ULONG NumberOfModules;
+    RTL_PROCESS_MODULE_INFORMATION Modules[1];
+} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
+
+typedef struct _SYSTEM_HANDLE
+{
+    PVOID Object;
+    HANDLE UniqueProcessId;
+    HANDLE HandleValue;
+    ULONG GrantedAccess;
+    USHORT CreatorBackTraceIndex;
+    USHORT ObjectTypeIndex;
+    ULONG HandleAttributes;
+    ULONG Reserved;
+} SYSTEM_HANDLE, *PSYSTEM_HANDLE;
+
+typedef struct _SYSTEM_HANDLE_INFORMATION_EX
+{
+    ULONG_PTR HandleCount;
+    ULONG_PTR Reserved;
+    SYSTEM_HANDLE Handles[1];
+} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
+
+typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
+{
+    PVOID Object;
+    ULONG_PTR UniqueProcessId;
+    ULONG_PTR HandleValue;
+    ULONG GrantedAccess;
+    USHORT CreatorBackTraceIndex;
+    USHORT ObjectTypeIndex;
+    ULONG HandleAttributes;
+    ULONG Reserved;
+} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;

SbieKernelPatch/DriverUtil.h

@@ -0,0 +1,171 @@
+#pragma once
+/*****************************************************************//**
+ * \file   DriverUtil.h
+ * \brief  Çý¶¯¿ØÖÆÏà¹Øº¯Êý
+ *********************************************************************/
+#include <windows.h>
+#include <string>
+#include <iostream>
+
+namespace DriverUtil
+{
+    bool InstallDriver(const std::string& driverName, const std::string& driverPath)
+    {
+        SC_HANDLE hSCManager = OpenSCManagerA(nullptr, nullptr, SC_MANAGER_CREATE_SERVICE);
+        if (!hSCManager)
+        {
+            std::cerr << "[!] OpenSCManager failed: " << GetLastError() << std::endl;
+            return false;
+        }
+
+        SC_HANDLE hService = CreateServiceA(
+            hSCManager,
+            driverName.c_str(),
+            driverName.c_str(),
+            SERVICE_ALL_ACCESS,
+            SERVICE_KERNEL_DRIVER,
+            SERVICE_DEMAND_START,
+            SERVICE_ERROR_NORMAL,
+            driverPath.c_str(),
+            nullptr, nullptr, nullptr, nullptr, nullptr);
+
+        if (!hService)
+        {
+            DWORD err = GetLastError();
+            if (err == ERROR_SERVICE_EXISTS)
+            {
+                std::cout << "[+] Service \'" << driverName << "\' already exists." << std::endl;
+            }
+            else
+            {
+                std::cerr << "[!] CreateService \'"<< driverName << "\' failed: " << err << std::endl;
+                CloseServiceHandle(hSCManager);
+                return false;
+            }
+        }
+        else
+        {
+            std::cout << "[+] Service \'" << driverName << "\' created successfully." << std::endl;
+            CloseServiceHandle(hService);
+        }
+
+        CloseServiceHandle(hSCManager);
+        return true;
+    }
+
+    bool StartDriver(const std::string& driverName)
+    {
+        SC_HANDLE hSCManager = OpenSCManagerA(nullptr, nullptr, SC_MANAGER_CONNECT);
+        if (!hSCManager)
+        {
+            std::cerr << "[!] OpenSCManager failed: " << GetLastError() << std::endl;
+            return false;
+        }
+
+        SC_HANDLE hService = OpenServiceA(hSCManager, driverName.c_str(), SERVICE_START);
+        if (!hService)
+        {
+            std::cerr << "[!] OpenService \'" << driverName << "\' failed: " << GetLastError() << std::endl;
+            CloseServiceHandle(hSCManager);
+            return false;
+        }
+
+        if (!StartServiceA(hService, 0, nullptr))
+        {
+            DWORD err = GetLastError();
+            if (err == ERROR_SERVICE_ALREADY_RUNNING)
+            {
+                std::cout << "[+] Service \'" << driverName << "\' is already running." << std::endl;
+            }
+            else
+            {
+                std::cerr << "[!] StartService \'" << driverName << "\' failed: " << err << std::endl;
+                CloseServiceHandle(hService);
+                CloseServiceHandle(hSCManager);
+                return false;
+            }
+        }
+        else
+        {
+            std::cout << "[+] Service \'" << driverName  << "\' started successfully." << std::endl;
+        }
+
+        CloseServiceHandle(hService);
+        CloseServiceHandle(hSCManager);
+        return true;
+    }
+
+    bool StopDriver(const std::string& driverName)
+    {
+        SC_HANDLE hSCManager = OpenSCManagerA(nullptr, nullptr, SC_MANAGER_CONNECT);
+        if (!hSCManager)
+        {
+            std::cerr << "[!] OpenSCManager failed: " << GetLastError() << std::endl;
+            return false;
+        }
+
+        SC_HANDLE hService = OpenServiceA(hSCManager, driverName.c_str(), SERVICE_STOP | SERVICE_QUERY_STATUS);
+        if (!hService)
+        {
+            std::cerr << "[!] OpenService \'" << driverName << "\' failed: " << GetLastError() << std::endl;
+            CloseServiceHandle(hSCManager);
+            return false;
+        }
+
+        SERVICE_STATUS status = {};
+        if (!ControlService(hService, SERVICE_CONTROL_STOP, &status))
+        {
+            DWORD err = GetLastError();
+            if (err == ERROR_SERVICE_NOT_ACTIVE)
+            {
+                std::cout << "[!] Service \'" << driverName << "\' is not running." << std::endl;
+            }
+            else
+            {
+                std::cerr << "[!] ControlService (STOP) failed: " << err << std::endl;
+                CloseServiceHandle(hService);
+                CloseServiceHandle(hSCManager);
+                return false;
+            }
+        }
+        else
+        {
+            std::cout << "[-] Service \'" << driverName << "\' stopped successfully." << std::endl;
+        }
+
+        CloseServiceHandle(hService);
+        CloseServiceHandle(hSCManager);
+        return true;
+    }
+
+    bool DeleteDriver(const std::string& driverName)
+    {
+        SC_HANDLE hSCManager = OpenSCManagerA(nullptr, nullptr, SC_MANAGER_CONNECT);
+        if (!hSCManager)
+        {
+            std::cerr << "[!] OpenSCManager failed: " << GetLastError() << std::endl;
+            return false;
+        }
+
+        SC_HANDLE hService = OpenServiceA(hSCManager, driverName.c_str(), DELETE);
+        if (!hService)
+        {
+            std::cerr << "[!] OpenService \'" << driverName << "\' failed: " << GetLastError() << std::endl;
+            CloseServiceHandle(hSCManager);
+            return false;
+        }
+
+        if (!DeleteService(hService))
+        {
+            std::cerr << "[!] DeleteService \'" << driverName << "\' failed: " << GetLastError() << std::endl;
+            CloseServiceHandle(hService);
+            CloseServiceHandle(hSCManager);
+            return false;
+        }
+
+        std::cout << "[-] Service \'" << driverName << "\' deleted successfully." << std::endl;
+        CloseServiceHandle(hService);
+        CloseServiceHandle(hSCManager);
+        return true;
+    }
+}