From 4ec12bb76ced2e2aa84ec9308c9f0710cbc992b4 Mon Sep 17 00:00:00 2001
From: "CORP\\zengquan" <3123132899@qq.com>
Date: Sun, 28 Aug 2022 14:38:41 +0800
Subject: [PATCH] Add some x86 code bug in DPC Timer traverse

---
 Anti-Rootkit/AntiRootkit.h    |  2 +-
 KernelLibrary/KernelTimer.cpp | 10 ++++++++++
 WinArk/DPCTimerTable.cpp      |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/Anti-Rootkit/AntiRootkit.h b/Anti-Rootkit/AntiRootkit.h
index be77672..ffb8b92 100644
--- a/Anti-Rootkit/AntiRootkit.h
+++ b/Anti-Rootkit/AntiRootkit.h
@@ -44,7 +44,7 @@ Typical drivers just use FILE_ANY_ACCESS and deal with the actual request in the
 // 回调驱动 链接器 命令行 + -----> /integritycheck
 #define ANTI_ROOTKIT_DEVICE 0x8000
 
-#define DRIVER_CURRENT_VERSION 0x88
+#define DRIVER_CURRENT_VERSION 0x8A
 
 
 // 用MDL锁定用户内存
diff --git a/KernelLibrary/KernelTimer.cpp b/KernelLibrary/KernelTimer.cpp
index 07775f8..e2991b2 100644
--- a/KernelLibrary/KernelTimer.cpp
+++ b/KernelLibrary/KernelTimer.cpp
@@ -77,9 +77,19 @@ void KernelTimer::EnumKernelTimer(KernelTimerData* pData, DpcTimerInfo* pInfo) {
 				pInfo[k].Period = pTimer->Period;
 				k++;
 #else
+				if (!MmIsAddressValid(pTimer->Dpc))
+					continue;
 				LogInfo("KTIMER: 0x%p \t KDPC: 0x%p \t函数入口: 0x%p\t\n", pTimer, pTimer->Dpc, pTimer->Dpc->DeferredRoutine);
+				pInfo[k].DueTime = pTimer->DueTime;
+				pInfo[k].KDpc = pTimer->Dpc;
+				pInfo[k].KTimer = pTimer;
+				pInfo[k].Routine = pTimer->Dpc->DeferredRoutine;
+				pInfo[k].Period = pTimer->Period;
+				k++;
 #endif // _WIN64
 			}
 		}
 	}
+
+	LogInfo("Total Kernel Timer: %d\n", k);
 }
\ No newline at end of file
diff --git a/WinArk/DPCTimerTable.cpp b/WinArk/DPCTimerTable.cpp
index 0850079..73686e6 100644
--- a/WinArk/DPCTimerTable.cpp
+++ b/WinArk/DPCTimerTable.cpp
@@ -160,7 +160,7 @@ void CDpcTimerTable::Refresh() {
 			memset(p, 0, size);
 			DriverHelper::EnumKernelTimer(&data, p, size);
 			for (int i = 0; i < maxCount; i++) {
-				if (p[i].KDpc != nullptr) {
+				if (p[i].Routine != nullptr) {
 					std::shared_ptr<DpcTimerInfo> info = std::make_shared<DpcTimerInfo>();
 					info->DueTime = p[i].DueTime;
 					info->KDpc = p[i].KDpc;