1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
| #include <ntifs.h>
PDRIVER_OBJECT g_Object;
#define kprintf(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, format, ##__VA_ARGS__)
#define SystemBigPoolInformation 66
typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)(ULONG, PVOID, ULONG, PULONG);
typedef struct _SYSTEM_BIGPOOL_ENTRY {
union {
PVOID VirtualAddress;
ULONG_PTR NonPaged : 1;
};
ULONG_PTR SizeInBytes;
union {
UCHAR Tag[4];
ULONG TagUlong;
};
} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;
typedef struct _SYSTEM_BIGPOOL_INFORMATION {
ULONG Count;
SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1];
} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;
VOID DRIVERUNLOAD(_In_ struct _DRIVER_OBJECT* DriverObject)
{
UNREFERENCED_PARAMETER(DriverObject);
kprintf("unload\n");
}
PVOID FindPattern(PUCHAR base, ULONG length, PCUCHAR pattern, ULONG patternLength) {
for (ULONG i = 0; i < length - patternLength; i++) {
BOOLEAN found = TRUE;
for (ULONG j = 0; j < patternLength; j++) {
if (pattern[j] != base[i + j]) {
found = FALSE;
break;
}
}
if (found) {
return &base[i];
}
}
return NULL;
}
NTSTATUS BigPoolSearch() {
ULONG poolInformationLength = 0x50000;
UNICODE_STRING routineName;
RtlInitUnicodeString(&routineName, L"ZwQuerySystemInformation");
ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)MmGetSystemRoutineAddress(&routineName);
if (!ZwQuerySystemInformation) {
kprintf("Failed to get ZwQuerySystemInformation address\n");
return STATUS_UNSUCCESSFUL;
}
NTSTATUS status = 0;
PVOID poolInformation = ExAllocatePoolWithTag(NonPagedPool, poolInformationLength, 'ace0');
if (!poolInformation) {
kprintf("Failed to allocate pool information buffer\n");
return STATUS_INSUFFICIENT_RESOURCES;
}
status = ZwQuerySystemInformation(SystemBigPoolInformation, poolInformation, poolInformationLength, &poolInformationLength);
if (!NT_SUCCESS(status)) {
kprintf("Failed to query pool information\n");
ExFreePoolWithTag(poolInformation, 'ace0');
return status;
}
PSYSTEM_BIGPOOL_INFORMATION bigPoolInfo = (PSYSTEM_BIGPOOL_INFORMATION)poolInformation;
for (ULONG i = 0; i < bigPoolInfo->Count; i++) {
PSYSTEM_BIGPOOL_ENTRY entry = &bigPoolInfo->AllocatedInfo[i];
if (entry->TagUlong == 'ace0') {
ULONG_PTR lpAddress = (ULONG_PTR)(entry->VirtualAddress) & (~1ull);
kprintf("Pool Entry: Address=%p, Size=%llu, Tag='%c%c%c%c'\n",
lpAddress,
entry->SizeInBytes,
entry->Tag[3],
entry->Tag[2],
entry->Tag[1],
entry->Tag[0]);
ULONG SizeCopied;
MM_COPY_ADDRESS MmCopyAddress;
PVOID Buffer = ExAllocatePool(NonPagedPoolNx, entry->SizeInBytes);
MmCopyAddress.VirtualAddress = Buffer;
status = MmCopyMemory(Buffer, MmCopyAddress, entry->SizeInBytes, MM_COPY_MEMORY_VIRTUAL, &SizeCopied);
if (NT_SUCCESS(status)) {
UCHAR pattern[] = { 0x41, 0xB8, 0xCE, 0x0A, 0x00, 0x00};
PVOID res=FindPattern(lpAddress, entry->SizeInBytes, pattern, 6);
if (res) {
kprintf(("shellcode Found in address %p\n"), lpAddress);
return STATUS_SUCCESS;
}
}
}
}
ExFreePoolWithTag(poolInformation, 'ace0');
return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg) {
UNREFERENCED_PARAMETER(pReg);
kprintf("Hello xia0ji233\n");
pDriver->DriverUnload = DRIVERUNLOAD;
g_Object = pDriver;
NTSTATUS status = BigPoolSearch();
if (!NT_SUCCESS(status)) {
kprintf("BigPoolSearch failed with status 0x%x\n", status);
}
return status;
}
|
