C++内核模式远程Call源码

admin

void UsermodeCallback::Init() {
        //KiCallUserMode = (KiCallUserModefn)0xfffff801735c4ac0;
        //MmCreateKernelStack = (MmCreateKernelStackfn)0xfffff8017346c210;
        //MmDeleteKernelStack = (MmDeleteKernelStackfn)0xfffff8017346d1e0;


        ContextUser = (CONTEXT*)UAlloc(sizeof(CONTEXT), PAGE_READWRITE);
        ULONG NtdllSize; auto NtdllBase = GetCurrentProcessModule(E("ntdll.dll"), &NtdllSize);
        NtContinue = GetProcAddress(NtdllBase, "NtContinue");

        CFG_CALL_TARGET_INFO TargetInfo[1];
        TargetInfo[0].Flags = 0x00000001;
        TargetInfo[0].Offset = (ULONG_PTR)((ULONG64)NtContinue - (ULONG64)NtdllBase);

        MEMORY_RANGE_ENTRY RangeEntry;
        RangeEntry.VirtualAddress = NtdllBase;
        RangeEntry.NumberOfBytes = NtdllSize;

        VM_INFORMATION VMInfo;
        VMInfo.NumberOfOffsets = 1;
        VMInfo.MustBeZero = 0;
        VMInfo.TargetsProcessed = &VMInfo.ExpectedFileOffset;

        VMInfo.CallTargets = &TargetInfo[0];
        VMInfo.Section.Section = 0;
        VMInfo.Section.Data = 0;
        VMInfo.ExpectedFileOffset = 0;

        /*
        *  FIX CFG  -- 
         
                USER32!_fnDWORD:
                sub     rsp,58h
                mov     rax,rcx
                xor     ecx,ecx
                mov     dword ptr [rsp+38h],ecx
                mov     qword ptr [rsp+40h],rcx
                mov     rdx,qword ptr [rax+20h]
                mov     r9,qword ptr [rax+18h]
                mov     r8,qword ptr [rax+10h]
                mov     rcx,qword ptr [rax]
                mov     qword ptr [rsp+20h],rdx
                mov     edx,dword ptr [rax+8]
                mov     rax,qword ptr [rax+28h]
                call    qword ptr [USER32!_guard_dispatch_icall_fptr (00007ffe`87599b10)]
        */
        auto statusss = ImpCall(ZwSetInformationVirtualMemory, (HANDLE)-1, (VIRTUAL_MEMORY_INFORMATION_CLASS)2, 1, &RangeEntry, (PVOID)&VMInfo, 0x28);


        //__db();
        //MmCreateKernelStack = (pv)(RVA(FindPatternSect(KBase, (".text"), ("E8 ? ? ? ? 41 83 CF 04")), 5));
        //ImpCall(DbgPrintEx, 0, 0, "MmCreateKernelStack %llx\n", MmCreateKernelStack);
        //__db();
        //MmDeleteKernelStack = (pv)(RVA(FindPatternSect(KBase, ("PAGE"), ("8B D5 E8 ? ? ? ? 48 8B 05 ? ? ? ? 48 05 ? ? ? ?")), 7));
        //ImpCall(DbgPrintEx, 0, 0, "MmDeleteKernelStack %llx\n", MmDeleteKernelStack);
        //__db();
        //KiCallUserMode = (pv)(RVA(FindPatternSect(KBase, ("PAGE"), ("4D 8D ? ? 48 8B 94 24 ? ? ? ? 48 8B 8C 24 ? ? ? ? E8 ? ? ? ?")), 25));
        //ImpCall(DbgPrintEx, 0, 0, "KiCallUserMode %llx\n", KiCallUserMode);
}

RemoteCall.rar (30.41 KB, 下载次数: 0)

2025-3-24 23:11 上传

点击文件名下载附件

xxxxbzn1

果断回帖，如果沉了就是我弄沉的很有成就感

AO1199

好东西！！