diff --git a/Common/Headers/IoctlCodes.hpp b/Common/Headers/IoctlCodes.hpp index 3264e11..e40b986 100644 --- a/Common/Headers/IoctlCodes.hpp +++ b/Common/Headers/IoctlCodes.hpp @@ -72,11 +72,6 @@ enum class Ioctl : u32 /// DisableMonitoring = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_BUFFERED, FILE_ANY_ACCESS), - /// - ///@brief StoreTestCase - /// - StoreTestCase = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS), - // clang-format on }; diff --git a/Driver/Client/Main.cpp b/Driver/Client/Main.cpp index abdbdd4..e351c32 100644 --- a/Driver/Client/Main.cpp +++ b/Driver/Client/Main.cpp @@ -143,7 +143,7 @@ ToggleMonitoring(HANDLE hFile, std::string const& arg, bool enable) bool -SendData(std::string const& device_name, const u32 ioctl) +SendData(std::string const& device_name, const u32 ioctl, std::vector& buffer_in) { wil::unique_handle hFile(::CreateFileA( device_name.c_str(), @@ -160,12 +160,16 @@ SendData(std::string const& device_name, const u32 ioctl) } DWORD nbBytesReturned = 0; - const usize sz = 0x20; - auto buffer_in = std::make_unique(sz); - ::memset(buffer_in.get(), 'A', sz); - - bool bSuccess = ::DeviceIoControl(hFile.get(), ioctl, buffer_in.get(), sz, nullptr, 0, &nbBytesReturned, nullptr); - info("SendData('%s', %dB) returned %s", device_name.c_str(), sz, boolstr(bSuccess)); + bool bSuccess = ::DeviceIoControl( + hFile.get(), + ioctl, + buffer_in.data(), + buffer_in.size(), + nullptr, + 0, + &nbBytesReturned, + nullptr); + info("SendData('%s', %dB) returned %s", device_name.c_str(), buffer_in.size(), boolstr(bSuccess)); return bSuccess; } @@ -173,48 +177,27 @@ SendData(std::string const& device_name, const u32 ioctl) std::optional ReceiveData(HANDLE hFile) { - // - // Try read into empty buffer to probe the size - // - DWORD expectedDataLength = 0; - { - u8* data = nullptr; - bool bRes = ::ReadFile(hFile, data, 0, &expectedDataLength, nullptr); - info("ReceiveData(nullptr) = %s", boolstr(bRes)); - if ( bRes ) - { - ok(" -> expectedDataLength = %d", expectedDataLength); - } - else - { - err("stopping"); - return std::nullopt; - } - } - - if ( expectedDataLength == 0 ) - { - return 0; - } + DWORD expectedDataLength = 1024; - // - // Get read content - // + while ( true ) { const DWORD dataLength = expectedDataLength; auto data = std::make_unique(dataLength); bool bRes = ::ReadFile(hFile, data.get(), dataLength, &expectedDataLength, nullptr); info("ReceiveData(data, %d) = %s", dataLength, boolstr(bRes)); - if ( bRes ) + if ( bRes == false ) { - CFB::Utils::Hexdump(data.get(), dataLength); - return dataLength; - } - else - { - err("stopping"); + if ( ::GetLastError() == ERROR_INSUFFICIENT_BUFFER ) + { + expectedDataLength = dataLength * 2; + continue; + } + err("ReadFile() failed, GLE %#x", ::GetLastError()); return std::nullopt; } + + CFB::Utils::Hexdump(data.get(), dataLength); + return dataLength; } } @@ -227,7 +210,7 @@ main(int argc, const char** argv) argparse::ArgumentParser program("DriverClient"); const std::vector valid_actions = - {"hook", "hook-unhook", "unhook", "size", "set-capturing", "send-data", "read-data", "session"}; + {"hook", "unhook", "size", "monitor", "unmonitor", "send", "recv", "session"}; program.add_argument("--action") .default_value(std::string("hook")) @@ -244,7 +227,6 @@ main(int argc, const char** argv) program.add_argument("--driver").default_value(std::string("\\driver\\hevd")); program.add_argument("--device").default_value(std::string("\\\\.\\HackSysExtremeVulnerableDriver")); program.add_argument("--ioctl").scan<'i', int>().default_value(0x222003); // BUFFER_OVERFLOW_STACK - program.add_argument("--enable").default_value(false).implicit_value(true); try { @@ -257,11 +239,10 @@ main(int argc, const char** argv) std::exit(1); } - auto action = program.get("--action"); - auto driver_name = program.get("--driver"); - auto device_name = program.get("--device"); - auto ioctl = program.get("--ioctl"); - auto enable = program.get("--enable"); + const auto action = program.get("--action"); + const auto driver_name = program.get("--driver"); + const auto device_name = program.get("--device"); + const auto ioctl = program.get("--ioctl"); wil::unique_handle hEvent; @@ -271,7 +252,7 @@ main(int argc, const char** argv) if ( !hFile ) { err("Failed to open '%S'", CFB_DEVICE_NAME); - // return -1; + return -1; } if ( action == "hook" ) @@ -282,24 +263,26 @@ main(int argc, const char** argv) { Driver::Unhook(hFile.get(), driver_name); } - else if ( action == "hook-unhook" ) - { - Driver::Hook(hFile.get(), driver_name); - Driver::Unhook(hFile.get(), driver_name); - } else if ( action == "size" ) { Driver::GetNumberOfDrivers(hFile.get()); } - else if ( action == "set-capturing" ) + else if ( action == "monitor" ) { - Driver::ToggleMonitoring(hFile.get(), driver_name, enable); + Driver::ToggleMonitoring(hFile.get(), driver_name, true); } - else if ( action == "send-data" ) + else if ( action == "unmonitor" ) { - Driver::SendData(device_name, ioctl); + Driver::ToggleMonitoring(hFile.get(), driver_name, false); } - else if ( action == "read-data" ) + else if ( action == "send" ) + { + const usize sz {0x100}; + auto buffer_in = std::vector(sz); + ::memset(buffer_in.data(), 'A', sz); + Driver::SendData(device_name, ioctl, buffer_in); + } + else if ( action == "recv" ) { Driver::ReceiveData(hFile.get()); } @@ -315,7 +298,12 @@ main(int argc, const char** argv) for ( int i = 0; i < 2; i++ ) { - Driver::SendData(device_name, ioctl); + const usize sz {0x100}; + auto buffer_in = std::vector(sz); + auto buffer_out = std::vector(sz); + ::memset(buffer_in.data(), 'A', sz); + + Driver::SendData(device_name, ioctl, buffer_in); u32 Status = ::WaitForSingleObject(hEvent.get(), 1 * 1000); switch ( Status ) diff --git a/Driver/Source/CapturedIrp.cpp b/Driver/Source/CapturedIrp.cpp index ad1831b..9db8908 100644 --- a/Driver/Source/CapturedIrp.cpp +++ b/Driver/Source/CapturedIrp.cpp @@ -149,7 +149,6 @@ CapturedIrp::CapturePreCallData(_In_ PIRP Irp) return STATUS_ACCESS_DENIED; } - NTSTATUS Status = STATUS_UNSUCCESSFUL; const ULONG Flags = m_DeviceObject->Flags; const PIO_STACK_LOCATION Stack = ::IoGetCurrentIrpStackLocation(Irp); @@ -240,7 +239,7 @@ CapturedIrp::CapturePreCallData(_In_ PIRP Irp) } } - return Status; + return STATUS_SUCCESS; } @@ -310,7 +309,7 @@ CapturedIrp::CapturePostCallData(_In_ PIRP Irp, _In_ NTSTATUS ReturnedIoctlStatu RtlCopyMemory(m_OutputBuffer.get() + Offset, UserBuffer, Count); #ifdef _DEBUG - ok("Capturing output data:"); + dbg("Capturing output data:"); CFB::Utils::Hexdump(m_OutputBuffer.get(), MIN(m_OutputBuffer.size(), CFB_MAX_HEXDUMP_BYTE)); #endif // _DEBUG diff --git a/Driver/Source/Entry.cpp b/Driver/Source/Entry.cpp index d928d14..1468452 100644 --- a/Driver/Source/Entry.cpp +++ b/Driver/Source/Entry.cpp @@ -220,11 +220,6 @@ _Function_class_(DRIVER_DISPATCH) DriverDeviceControlRoutine(_In_ PDEVICE_OBJECT break; } - case CFB::Comms::Ioctl::GetDriverInfo: - warn("TODO"); - Status = STATUS_NOT_IMPLEMENTED; - break; - default: err("Received invalid IOCTL code 0x%08x", IoctlCode); Status = STATUS_INVALID_DEVICE_REQUEST; @@ -290,7 +285,6 @@ _Function_class_(DRIVER_DISPATCH) DriverReadRoutine(_In_ PDEVICE_OBJECT DeviceOb } NT_ASSERT(Irp->MdlAddress); - PVOID Buffer = ::MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority); if ( Buffer == nullptr ) { @@ -308,6 +302,8 @@ _Function_class_(DRIVER_DISPATCH) DriverReadRoutine(_In_ PDEVICE_OBJECT DeviceOb for ( usize i = 0; i < DumpableIrpNumber; i++ ) { + dbg("Popping IRP %d/%d", i + 1, DumpableIrpNumber); + // // Pop front the captured IRP // @@ -331,6 +327,13 @@ _Function_class_(DRIVER_DISPATCH) DriverReadRoutine(_In_ PDEVICE_OBJECT DeviceOb RtlCopyMemory((PVOID)BufferPointer, &Header, DataSize); BufferPointer += DataSize; + + dbg("IRP %d/%d - Copied header: Process='%S', PID=%d, TID=%d", + i + 1, + DumpableIrpNumber, + Header.ProcessName, + Header.Pid, + Header.Tid); } // @@ -347,6 +350,15 @@ _Function_class_(DRIVER_DISPATCH) DriverReadRoutine(_In_ PDEVICE_OBJECT DeviceOb RtlCopyMemory((PVOID)BufferPointer, CurrentIrp->InputBuffer(), DataSize); BufferPointer += DataSize; } + + + dbg("IRP %d/%d - Copied input buffer (%d bytes)", + i + 1, + DumpableIrpNumber, + CurrentIrp->InputDataSize()); +#ifdef _DEBUG + CFB::Utils::Hexdump(Buffer, MIN(CurrentIrp->InputDataSize(), CFB_MAX_HEXDUMP_BYTE)); +#endif // _DEBUG } // @@ -363,7 +375,17 @@ _Function_class_(DRIVER_DISPATCH) DriverReadRoutine(_In_ PDEVICE_OBJECT DeviceOb RtlCopyMemory((PVOID)BufferPointer, CurrentIrp->OutputBuffer(), DataSize); BufferPointer += DataSize; } + + dbg("IRP %d/%d - Copied output buffer (%d bytes)", + i + 1, + DumpableIrpNumber, + CurrentIrp->OutputDataSize()); +#ifdef _DEBUG + CFB::Utils::Hexdump(Buffer, MIN(CurrentIrp->OutputDataSize(), CFB_MAX_HEXDUMP_BYTE)); +#endif // _DEBUG } + + dbg("IRP %d/%d returned to client", i + 1, DumpableIrpNumber); } } @@ -467,7 +489,8 @@ DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) Globals->DeviceObject = DeviceObject; Globals->DriverObject = DriverObject; - err("Device initialization for '%S' done, use `%s` for debug logs", + warn( + "Device initialization for '%S' successful, use `%s` for debug logs", CFB_DEVICE_NAME, DML("ed nt !Kd_IHVDRIVER_Mask f")); return Status;