ReadWriteProcessMemoryDriver/main.c at master · hypervis0r/ReadWriteProcessMemoryDriver · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
#include "main.h"

NTSTATUS
DriverIrpCreate(
	PDEVICE_OBJECT DeviceObject,
	PIRP Irp)
{
	UNREFERENCED_PARAMETER(DeviceObject);

	Irp->IoStatus.Status = STATUS_SUCCESS;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}

NTSTATUS
DriverIrpClose(
	PDEVICE_OBJECT DeviceObject,
	PIRP Irp)
{
	UNREFERENCED_PARAMETER(DeviceObject);

	Irp->IoStatus.Status = STATUS_SUCCESS;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}

NTSTATUS
DriverIrpDeviceControl(
	PDEVICE_OBJECT DeviceObject,
	PIRP Irp)
{
	UNREFERENCED_PARAMETER(DeviceObject);

	NTSTATUS ntResult = 0;
	PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);

	/*
		Execute IOCTL handler
	*/
	switch (Stack->Parameters.DeviceIoControl.IoControlCode)
	{
		case IOCTL_READ_PROCESS_MEMORY:
		{
			if (Stack->Parameters.DeviceIoControl.InputBufferLength < sizeof(RWMEM_READ))
			{
				ntResult = STATUS_BUFFER_TOO_SMALL;
				break;
			}

			ntResult = RwMemReadProcessMemory(Irp, (P_RWMEM_READ)Stack->Parameters.DeviceIoControl.Type3InputBuffer);

			break;
		}
		case IOCTL_WRITE_PROCESS_MEMORY:
		{
			if (Stack->Parameters.DeviceIoControl.InputBufferLength < sizeof(RWMEM_WRITE))
			{
				ntResult = STATUS_BUFFER_TOO_SMALL;
				break;
			}

			ntResult = RwMemWriteProcessMemory(Irp, (P_RWMEM_WRITE)Stack->Parameters.DeviceIoControl.Type3InputBuffer);

			break;
		}
		default:
		{
			ntResult = STATUS_INVALID_DEVICE_REQUEST;
			break;
		}
	}

	/*
		Finish the I/O request with the final result of the IOCTL
	*/
	Irp->IoStatus.Status = ntResult;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);

	return ntResult;
}

NTSTATUS
DriverEntry(
	PDRIVER_OBJECT DriverObject,
	PUNICODE_STRING RegistryPath)
{
	UNREFERENCED_PARAMETER(RegistryPath);

	NTSTATUS ntResult = 0;
	PDEVICE_OBJECT DeviceObject = NULL;
	UNICODE_STRING devName = RTL_CONSTANT_STRING(L"\\Device\\RWMem");
	UNICODE_STRING symLink = RTL_CONSTANT_STRING(L"\\??\\RWMem");

	/*
		Set our driver callbacks
	*/
	DriverObject->DriverUnload = DriverUnload;
	DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverIrpCreate;
	DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverIrpClose;
	DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverIrpDeviceControl;

	/*
		Create the device object
	*/
	ntResult = IoCreateDevice(
		DriverObject,
		0,
		&devName,
		FILE_DEVICE_UNKNOWN,
		0,
		FALSE,
		&DeviceObject
	);
	if (!NT_SUCCESS(ntResult))
	{
		DbgPrint("[-] Failed to create symbolic link: 0x%08x\n", ntResult);

		return ntResult;
	}

	/*
		Create symlink to our kernel device object
	*/
	ntResult = IoCreateSymbolicLink(&symLink, &devName);
	if (!NT_SUCCESS(ntResult)) {
		DbgPrint("[-] Failed to create symbolic link: 0x%08X\n", ntResult);

		IoDeleteDevice(DeviceObject);
		return ntResult;
	}

	DbgPrint("[+] ReadWriteMemoryDriver loaded\n");

	return STATUS_SUCCESS;
}

void
DriverUnload(
	PDRIVER_OBJECT DriverObject)
{
	UNICODE_STRING symLink = RTL_CONSTANT_STRING(L"\\??\\RWMem");

	IoDeleteSymbolicLink(&symLink);

	IoDeleteDevice(DriverObject->DeviceObject);

	DbgPrint("[+] ReadWriteMemoryDriver unloaded; bye :)\n");
}