OldSchoolHack

Register / Login English

C#/C++ Reading memory from a driver

not available
  • Category: Sourcecode
  • Developer:
  • Uploaded by: System
  • Uploaded at:
  • System: Windows
Download (22.92 KB)

VirusTotal Result: 0/57

virustotal

Description

This code contains a WDF driver which handles a single IOCTL for calling MmCopyVirtualMemory and a XAML (C#) app which can load/unload the driver and call the IOCTL. I went with a C# client because I'm planning on serving the memory I read up on a network using REST and it's easier to stand up a REST server in C# than C++.

CSHARP Code:
  1. using Microsoft.Win32;
  2. using Microsoft.Win32.SafeHandles;
  3. using System;
  4. using System.Collections.Generic;
  5. using System.IO;
  6. using System.Linq;
  7. using System.Runtime.InteropServices;
  8. using System.Text;
  9. using System.Threading.Tasks;
  10.  
  11. namespace test_cs
  12. {
  13.     public static class Driver
  14.     {
  15.         private static SafeFileHandle Handle = null;
  16.         private static string SymLink = "\\\\.\\DRVTEST";
  17.         private static string SvcName = "DRVTEST";
  18.         private static uint ReadMemCtlCode = Native.CTL_CODE(0x00008008, 0x0800, 0, 3);
  19.  
  20.         public static Native.NTSTATUS EnsureLoaded(string path = "")
  21.         {
  22.             if (Driver.Handle != null && Driver.Handle.IsInvalid == false)
  23.             {
  24.                 return Native.NTSTATUS.Success;
  25.             }
  26.  
  27.             Driver.Handle = Native.CreateFile(Driver.SymLink,FileAccess.ReadWrite,FileShare.ReadWrite,
  28.                 IntPtr.Zero, FileMode.Open, 0, IntPtr.Zero);
  29.  
  30.             if (Driver.Handle == null || Driver.Handle.IsInvalid)
  31.             {
  32.                 return Driver.Reload(path);
  33.             }
  34.  
  35.             return Native.NTSTATUS.Success;
  36.         }
  37.  
  38.         public static Native.NTSTATUS Unload()
  39.         {
  40.             if (Driver.Handle != null && Driver.Handle.IsInvalid == false)
  41.             {
  42.                 Driver.Handle.Close();
  43.                 Driver.Handle = null;
  44.             }
  45.  
  46.             return Driver.UnloadDriver(Driver.SvcName);
  47.         }
  48.  
  49.         struct COPY_MEM
  50.         {
  51.             public Int64 localbuf;
  52.             public Int64 targetPtr;
  53.             public Int64 size;
  54.             public uint pid;
  55.             public byte write;
  56.         };
  57.  
  58.         public static Native.NTSTATUS ReadMemory(int pid, Int64 addr, Int64 size, object buffer)
  59.         {
  60.             if (Driver.Handle == null || Driver.Handle.IsInvalid)
  61.             {
  62.                 return Native.NTSTATUS.DeviceDoesNotExist;
  63.             }
  64.  
  65.             var info = new COPY_MEM();
  66.             var pinned = GCHandle.Alloc(buffer, GCHandleType.Pinned);
  67.  
  68.             info.pid = (uint)pid;
  69.             info.size = size;
  70.             info.write = 0;
  71.             info.localbuf = pinned.AddrOfPinnedObject().ToInt64();
  72.             info.targetPtr = addr;
  73.  
  74.             int bytes = 0;
  75.             if (!Native.DeviceIoControl(Driver.Handle, ReadMemCtlCode, info, (uint)Marshal.SizeOf(info), null, 0, ref bytes, IntPtr.Zero))
  76.             {
  77.                 return (Native.NTSTATUS)Marshal.GetLastWin32Error();
  78.             }
  79.  
  80.             return Native.NTSTATUS.Success;
  81.         }
  82.  
  83.         private static Native.NTSTATUS LoadDriver(string svcName, string path)
  84.         {
  85.             string regPath = "CurrentControlSet\\Services\\" + svcName;
  86.             RegistryKey svcKey = Registry.LocalMachine.CreateSubKey("SYSTEM\\" + regPath);
  87.             svcKey.SetValue("ImagePath", "\\??\\" + path);
  88.             svcKey.SetValue("Type", 1);
  89.  
  90.             Native.UNICODE_STRING uRegPath = new Native.UNICODE_STRING();
  91.  
  92.             bool enabled;
  93.             var status = Native.RtlAdjustPrivilege(Native.SeLoadDriverPrivilege, true,
  94.                 Native.ADJUST_PRIVILEGE_TYPE.AdjustCurrentProcess, out enabled);
  95.  
  96.             Native.RtlInitUnicodeString(ref uRegPath, "\\Registry\\Machine\\SYSTEM\\" + regPath);
  97.  
  98.             return Native.NtLoadDriver(ref uRegPath);
  99.         }
  100.  
  101.         private static Native.NTSTATUS UnloadDriver(string svcName)
  102.         {
  103.             string regPath = "CurrentControlSet\\Services\\" + svcName;
  104.  
  105.             Native.UNICODE_STRING uRegPath = new Native.UNICODE_STRING();
  106.  
  107.             bool enabled;
  108.             Native.NTSTATUS status = Native.RtlAdjustPrivilege(Native.SeLoadDriverPrivilege, true,
  109.                 Native.ADJUST_PRIVILEGE_TYPE.AdjustCurrentProcess, out enabled);
  110.  
  111.             Native.RtlInitUnicodeString(ref uRegPath, "\\Registry\\Machine\\SYSTEM\\" + regPath);
  112.  
  113.             status = Native.NtUnloadDriver(ref uRegPath);
  114.  
  115.             Registry.LocalMachine.DeleteSubKeyTree("SYSTEM\\" + regPath, false);
  116.  
  117.             return status;
  118.         }
  119.  
  120.         private static Native.NTSTATUS Reload(string path)
  121.         {
  122.             Driver.Unload();
  123.  
  124.             if (String.IsNullOrWhiteSpace(path))
  125.             {
  126.                 // TODO: Guess the driver file path
  127.                 return Native.NTSTATUS.ObjectPathNotFound;
  128.             }
  129.  
  130.             Native.NTSTATUS status = Driver.LoadDriver(Driver.SvcName, path);
  131.             if( status >= 0 )
  132.             {
  133.                 Driver.Handle = Native.CreateFile(Driver.SymLink, FileAccess.ReadWrite, FileShare.ReadWrite,
  134.                     IntPtr.Zero, FileMode.Open, 0, IntPtr.Zero);
  135.  
  136.                 if (Driver.Handle == null || Driver.Handle.IsInvalid)
  137.                 {
  138.                     return (Native.NTSTATUS)Marshal.GetLastWin32Error();
  139.                 }
  140.             }
  141.  
  142.             return Native.NTSTATUS.Success;
  143.         }
  144.  
  145.     }
  146. }

Download C#/C++ Reading memory from a driver