Skip to content

Commit cc452b2

Browse files
Sentient111Sentient111
committed
init
init
1 parent 56d3be1 commit cc452b2

File tree

7 files changed

+569
-0
lines changed

7 files changed

+569
-0
lines changed

‎FindKernelFunctionUm/Exports.h‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
#pragma once
2+
#include <Windows.h>
3+
#include <iostream>
4+
#include <string>
5+
#include <fstream>
6+
7+
#include "QueryModuleInformation.h"
8+
9+
UINT64 LoadFileToMemory(std::string path)
10+
{
11+
std::ifstream inputPeFile(path, std::ios::binary);
12+
if (!inputPeFile.is_open())
13+
{
14+
printf("[PE] failed to open %s\n", path.c_str());
15+
return 0;
16+
}
17+
18+
inputPeFile.seekg(0, std::ios::end);
19+
int fileSize = inputPeFile.tellg();
20+
inputPeFile.seekg(0, std::ios::beg);
21+
22+
if (!fileSize)
23+
{
24+
printf("[PE] following driver has a invalid file size\n");
25+
printf("%s\n", path.c_str());
26+
inputPeFile.close();
27+
return 0;
28+
}
29+
30+
UINT64 fileBuffer = (UINT64)VirtualAlloc(NULL, fileSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
31+
if (!fileBuffer)
32+
{
33+
printf("[PE] failed to allocate memory for file buffer %x\n", GetLastError());
34+
inputPeFile.close();
35+
return 0;
36+
}
37+
38+
inputPeFile.read((char*)fileBuffer, fileSize);
39+
inputPeFile.close();
40+
41+
42+
return fileBuffer;
43+
}
44+
45+
46+
UINT64 TranslateVa(UINT64 rva, PVOID ntHeaders, UINT64 fileBuffer)
47+
{
48+
PIMAGE_FILE_HEADER fileHeader = &((PIMAGE_NT_HEADERS)ntHeaders)->FileHeader;
49+
50+
PIMAGE_SECTION_HEADER currentSection = IMAGE_FIRST_SECTION((PIMAGE_NT_HEADERS32)ntHeaders);
51+
52+
for (size_t i = 0; i < ((PIMAGE_NT_HEADERS32)ntHeaders)->FileHeader.NumberOfSections; ++i, ++currentSection)
53+
{
54+
if (rva >= currentSection->VirtualAddress && rva < currentSection->VirtualAddress + currentSection->Misc.VirtualSize)
55+
{
56+
return fileBuffer + currentSection->PointerToRawData + (rva - currentSection->VirtualAddress);
57+
}
58+
}
59+
return 0;
60+
}
61+
62+
63+
UINT64 GetExport(UINT64 fileBuffer, const char* functionName)
64+
{
65+
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(fileBuffer);
66+
PIMAGE_NT_HEADERS64 ntHeaders = (PIMAGE_NT_HEADERS64)(fileBuffer + dosHeader->e_lfanew);
67+
68+
UINT64 exportDirVa = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
69+
if (!exportDirVa)
70+
{
71+
printf("Failed to find export dir\n");
72+
return 0;
73+
}
74+
75+
PIMAGE_EXPORT_DIRECTORY exportDir = (PIMAGE_EXPORT_DIRECTORY)(TranslateVa(exportDirVa, ntHeaders, fileBuffer));
76+
77+
if (!exportDir)
78+
{
79+
printf("Failed to translate export dir\n");
80+
return 0;
81+
}
82+
83+
DWORD* peat = (DWORD*)(TranslateVa(exportDir->AddressOfFunctions, ntHeaders, fileBuffer));
84+
DWORD* pent = (DWORD*)(TranslateVa(exportDir->AddressOfNames, ntHeaders, fileBuffer));
85+
WORD* peot = (WORD*)(TranslateVa(exportDir->AddressOfNameOrdinals, ntHeaders, fileBuffer));
86+
87+
WORD ordinal = 0;
88+
89+
90+
for (DWORD i = 0; i < exportDir->NumberOfNames; ++i)
91+
{
92+
93+
printf("%s\n", (char*)(TranslateVa(pent[i], ntHeaders, fileBuffer)));
94+
95+
}
96+
97+
return 0;
98+
}
99+
100+
UINT64 GetExportFromFile(UINT64 fileBuffer, const char* functionName)
101+
{
102+
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(fileBuffer);
103+
PIMAGE_NT_HEADERS64 ntHeaders = (PIMAGE_NT_HEADERS64)(fileBuffer + dosHeader->e_lfanew);
104+
105+
if (!dosHeader || !ntHeaders)
106+
{
107+
printf("File buffer has invalid pe headers\n");
108+
return 0;
109+
}
110+
111+
UINT64 exportDirVa = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
112+
if (!exportDirVa)
113+
{
114+
printf("Failed to find export dir\n");
115+
return 0;
116+
}
117+
118+
PIMAGE_EXPORT_DIRECTORY exportDir = (PIMAGE_EXPORT_DIRECTORY)(TranslateVa(exportDirVa, ntHeaders, fileBuffer));
119+
120+
if (!exportDir)
121+
{
122+
printf("Failed to translate export dir\n");
123+
return 0;
124+
}
125+
126+
DWORD* functionList = (DWORD*)(TranslateVa(exportDir->AddressOfFunctions, ntHeaders, fileBuffer));
127+
DWORD* nameList = (DWORD*)(TranslateVa(exportDir->AddressOfNames, ntHeaders, fileBuffer));
128+
WORD* ordinalList = (WORD*)(TranslateVa(exportDir->AddressOfNameOrdinals, ntHeaders, fileBuffer));
129+
130+
for (int i = 0; i < exportDir->NumberOfNames; ++i)
131+
{
132+
char* currExportName = (char*)(TranslateVa(nameList[i], ntHeaders, fileBuffer));
133+
if (!strcmp(currExportName, functionName))
134+
{
135+
return functionList[ordinalList[i]] - ntHeaders->OptionalHeader.ImageBase;
136+
}
137+
}
138+
139+
return 0;
140+
}
141+
142+
PVOID GetExportAddrFromDisk(const char* moduleName, const char* functionName)
143+
{
144+
std::string fullModulePath = GetKernelModuleFilePath(moduleName);
145+
if (!fullModulePath.length())
146+
{
147+
printf("failed to get module path\n");
148+
return 0;
149+
}
150+
151+
UINT64 fileBuffer = LoadFileToMemory(fullModulePath);
152+
if (!fileBuffer)
153+
{
154+
printf("failed to load file to memory\n");
155+
return 0;
156+
}
157+
158+
PVOID kernelModuleBase = GetSystemModuleBase(moduleName);
159+
if (!kernelModuleBase)
160+
{
161+
printf("failed to get kernel module base\n");
162+
return 0;
163+
}
164+
165+
UINT64 functionOffset = GetExportFromFile(fileBuffer, functionName);
166+
if (!kernelModuleBase)
167+
{
168+
printf("failed to find export from disk\n");
169+
return 0;
170+
}
171+
172+
VirtualFree((PVOID)fileBuffer, NULL, MEM_RELEASE);
173+
174+
return (PVOID)((UINT64)kernelModuleBase + functionOffset);
175+
}
176+

‎FindKernelFunctionUm/FindKernelFunctionUm.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#include "Exports.h"
2+
3+
int main()
4+
{
5+
PVOID fnAddr = GetExportAddrFromDisk("ntoskrnl.exe", "NtQueryInformationFile");
6+
printf("function addr 0x%p\n", fnAddr);
7+
return 0;
8+
}

‎FindKernelFunctionUm/FindKernelFunctionUm.sln‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.32228.343
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FindKernelFunctionUm", "FindKernelFunctionUm.vcxproj", "{EFFC98E2-7587-4A98-A502-6D78C0BA453F}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Debug|x64.ActiveCfg = Debug|x64
17+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Debug|x64.Build.0 = Debug|x64
18+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Debug|x86.ActiveCfg = Debug|Win32
19+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Debug|x86.Build.0 = Debug|Win32
20+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Release|x64.ActiveCfg = Release|x64
21+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Release|x64.Build.0 = Release|x64
22+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Release|x86.ActiveCfg = Release|Win32
23+
{EFFC98E2-7587-4A98-A502-6D78C0BA453F}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {55FE5FE9-2009-4E0A-A132-BC0E7C7A8762}
30+
EndGlobalSection
31+
EndGlobal

‎FindKernelFunctionUm/FindKernelFunctionUm.vcxproj‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<Keyword>Win32Proj</Keyword>
24+
<ProjectGuid>{effc98e2-7587-4a98-a502-6d78c0ba453f}</ProjectGuid>
25+
<RootNamespace>FindKernelFunctionUm</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v142</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v142</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v142</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v142</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
</PropertyGroup>
76+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
77+
<LinkIncremental>false</LinkIncremental>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
80+
<LinkIncremental>true</LinkIncremental>
81+
</PropertyGroup>
82+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
83+
<LinkIncremental>false</LinkIncremental>
84+
</PropertyGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
86+
<ClCompile>
87+
<WarningLevel>Level3</WarningLevel>
88+
<SDLCheck>true</SDLCheck>
89+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
90+
<ConformanceMode>true</ConformanceMode>
91+
</ClCompile>
92+
<Link>
93+
<SubSystem>Console</SubSystem>
94+
<GenerateDebugInformation>true</GenerateDebugInformation>
95+
</Link>
96+
</ItemDefinitionGroup>
97+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
98+
<ClCompile>
99+
<WarningLevel>Level3</WarningLevel>
100+
<FunctionLevelLinking>true</FunctionLevelLinking>
101+
<IntrinsicFunctions>true</IntrinsicFunctions>
102+
<SDLCheck>true</SDLCheck>
103+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104+
<ConformanceMode>true</ConformanceMode>
105+
</ClCompile>
106+
<Link>
107+
<SubSystem>Console</SubSystem>
108+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
109+
<OptimizeReferences>true</OptimizeReferences>
110+
<GenerateDebugInformation>true</GenerateDebugInformation>
111+
</Link>
112+
</ItemDefinitionGroup>
113+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
114+
<ClCompile>
115+
<WarningLevel>Level3</WarningLevel>
116+
<SDLCheck>true</SDLCheck>
117+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
118+
<ConformanceMode>true</ConformanceMode>
119+
</ClCompile>
120+
<Link>
121+
<SubSystem>Console</SubSystem>
122+
<GenerateDebugInformation>true</GenerateDebugInformation>
123+
</Link>
124+
</ItemDefinitionGroup>
125+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
126+
<ClCompile>
127+
<WarningLevel>Level3</WarningLevel>
128+
<FunctionLevelLinking>true</FunctionLevelLinking>
129+
<IntrinsicFunctions>true</IntrinsicFunctions>
130+
<SDLCheck>true</SDLCheck>
131+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
132+
<ConformanceMode>true</ConformanceMode>
133+
</ClCompile>
134+
<Link>
135+
<SubSystem>Console</SubSystem>
136+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
137+
<OptimizeReferences>true</OptimizeReferences>
138+
<GenerateDebugInformation>true</GenerateDebugInformation>
139+
</Link>
140+
</ItemDefinitionGroup>
141+
<ItemGroup>
142+
<ClCompile Include="FindKernelFunctionUm.cpp" />
143+
</ItemGroup>
144+
<ItemGroup>
145+
<ClInclude Include="Nt.h" />
146+
<ClInclude Include="Exports.h" />
147+
<ClInclude Include="QueryModuleInformation.h" />
148+
</ItemGroup>
149+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
150+
<ImportGroup Label="ExtensionTargets">
151+
</ImportGroup>
152+
</Project>

0 commit comments

Comments
 (0)