GithubStar/Blackbone
1
0
Fork 0
mirror of https://github.com/DarthTon/Blackbone.git synced 2026-10-28 19:36:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Driver: update to redstone 2 WIP

Browse Source
This commit is contained in:
DarthTon
2017-04-08 14:01:32 +03:00
parent 875eaabcc4
commit 99cfd034d0
3 changed files with 33 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/BlackBoneDrv/BlackBoneDrv.c
+30 -4
View File
@@ -261,7 +261,7 @@ NTSTATUS BBInitDynamicData( IN OUT PDYNAMIC_DATA pData )
if (ver_short != WINVER_81)
return STATUS_NOT_SUPPORTED;
#elif defined (_WIN10_)
if (ver_short != WINVER_10 && ver_short != WINVER_10_AU)
if (ver_short != WINVER_10 && ver_short != WINVER_10_AU && ver_short != WINVER_10_CU)
return STATUS_NOT_SUPPORTED;
#endif
@@ -331,7 +331,7 @@ NTSTATUS BBInitDynamicData( IN OUT PDYNAMIC_DATA pData )
pData->ExRemoveTable -= 0x5E;
break;
// Windows 10, build 14393/10586
// Windows 10, build 15063/14393/10586
case WINVER_10:
if (verInfo.dwBuildNumber == 10586)
{
@@ -363,6 +363,24 @@ NTSTATUS BBInitDynamicData( IN OUT PDYNAMIC_DATA pData )
if (NT_SUCCESS(BBScanSection("PAGE", (PCUCHAR)"\x48\x8D\x7D\x18\x48\x8B", 0xCC, 6, (PVOID)&pData->ExRemoveTable)))
pData->ExRemoveTable -= 0x60;
status = BBLocatePageTables( pData );
break;
}
else if (verInfo.dwBuildNumber == 15063)
{
pData->ver = WINVER_10_CU;
pData->KExecOpt = 0x0;
pData->Protection = 0x0;
pData->ObjTable = 0x0;
pData->VadRoot = 0x620;
pData->NtCreateThdIndex = 0x0;
pData->NtTermThdIndex = 0x0;
pData->PrevMode = 0x0;
pData->ExitStatus = 0x0;
pData->MiAllocPage = 0;
if (NT_SUCCESS(BBScanSection("PAGE", (PCUCHAR)"\x48\x8D\x7D\x18\x48\x8B", 0xCC, 6, (PVOID)&pData->ExRemoveTable)))
pData->ExRemoveTable -= 0x60;
status = BBLocatePageTables( pData );
break;
}
@@ -401,8 +419,16 @@ NTSTATUS BBLocatePageTables( IN OUT PDYNAMIC_DATA pData )
if (pMmGetPhysicalAddress)
{
PUCHAR pMiGetPhysicalAddress = *(PLONG)(pMmGetPhysicalAddress + 0xE + 1) + pMmGetPhysicalAddress + 0xE + 5;
pData->DYN_PDE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x49 + 2);
pData->DYN_PTE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x56 + 2);
if (pData->ver >= WINVER_10_CU)
{
pData->DYN_PDE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x43 + 2);
pData->DYN_PTE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x50 + 2);
}
else
{
pData->DYN_PDE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x49 + 2);
pData->DYN_PTE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x56 + 2);
}
return STATUS_SUCCESS;
}
src/BlackBoneDrv/Private.c
+1 -1
View File
@@ -239,7 +239,7 @@ PVOID GetSSDTEntry( IN ULONG index )
/// <returns>Found PTE</returns>
PMMPTE GetPTEForVA( IN PVOID pAddress )
{
if (dynData.ver == WINVER_10_AU)
if (dynData.ver >= WINVER_10_AU)
{
// Check if large page
PMMPTE pPDE = (PMMPTE)(((((ULONG_PTR)pAddress >> PDI_SHIFT) << PTE_SHIFT) & 0x3FFFFFF8ull) + dynData.DYN_PDE_BASE);
src/BlackBoneDrv/Private.h
+2 -1
View File
@@ -142,6 +142,7 @@ typedef enum _WinVer
WINVER_81 = 0x0630,
WINVER_10 = 0x0A00,
WINVER_10_AU = 0x0A01,
WINVER_10_CU = 0x0A02,
} WinVer;
extern PLIST_ENTRY PsLoadedModuleList;
@@ -310,4 +311,4 @@ VOID StartProcessors( IN NOPPROCINFO* Info );
/// <param name="SizeOfImage">Block size to allocate</param>
/// <param name="ppFoundBase">Allocated address</param>
/// <returns>Status code</returns>
NTSTATUS AllocateInDiscardedMemory( IN ULONG size, OUT PVOID* ppFoundBase );
NTSTATUS AllocateInDiscardedMemory( IN ULONG size, OUT PVOID* ppFoundBase );