norsefire/kernelmode/dispatch.cpp

#include "dispatch.hpp"

MOUSE_OBJECT mouse_obj = { 0 };

NTSTATUS dispatch::handler(PDEVICE_OBJECT device_object, PIRP irp)
{
	UNREFERENCED_PARAMETER(device_object);

	if (!mouse_obj.service_callback || !mouse_obj.mouse_device) { mouse::init_mouse(&mouse_obj); }

	NTSTATUS status = STATUS_INVALID_PARAMETER;
	ULONG bytes_io = 0;
	PIO_STACK_LOCATION pio = IoGetCurrentIrpStackLocation(irp);
	ULONG ioctl = pio->Parameters.DeviceIoControl.IoControlCode;

	if (ioctl == NF_GET_PROCESS_ID)
	{
		PNF_PROCESS_ID_REQUEST process_id_request = (PNF_PROCESS_ID_REQUEST)irp->AssociatedIrp.SystemBuffer;
		process_id_request->process_id = memory::get_process_id_by_name(IoGetCurrentProcess(), process_id_request->process_name);
		if (process_id_request->process_id) { status = STATUS_SUCCESS; }
		bytes_io = sizeof(NF_PROCESS_ID_REQUEST);
		DbgPrintEx(0, 0, "[norsefire]: NF_GET_PROCESS_ID\n");
	}
	else if (ioctl == NF_GET_MODULE)
	{
		PNF_MODULE_REQUEST module_request = (PNF_MODULE_REQUEST)irp->AssociatedIrp.SystemBuffer;
		PEPROCESS target_process = 0;
		if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)module_request->process_id, &target_process)))
		{
			KAPC_STATE apc;
			KeStackAttachProcess(target_process, &apc);
			ULONG base = memory::get_module_base(target_process, module_request->module_name);
			KeUnstackDetachProcess(&apc);
			if (base)
			{
				module_request->address = base;
				status = STATUS_SUCCESS;
			}
			bytes_io = sizeof(NF_MODULE_REQUEST);
			DbgPrintEx(0, 0, "[norsefire]: NF_GET_MODULE\n");
		}
	}
	else if (ioctl == NF_READ_MEMORY)
	{
		PNF_READ_REQUEST read_request = (PNF_READ_REQUEST)irp->AssociatedIrp.SystemBuffer;
		PEPROCESS target_process = 0;
		if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)read_request->process_id, &target_process)))
		{
			status = memory::read_memory(target_process, (void*)read_request->address, &read_request->buffer, read_request->size);
		}
		bytes_io = sizeof(NF_READ_REQUEST);
		DbgPrintEx(0, 0, "[norsefire]: NF_READ_MEMORY\n");
	}
	else if (ioctl == NF_WRITE_MEMORY)
	{
		PNF_WRITE_REQUEST write_request = (PNF_WRITE_REQUEST)irp->AssociatedIrp.SystemBuffer;
		PEPROCESS target_process = 0;
		if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)write_request->process_id, &target_process)))
		{
			status = memory::write_memory(target_process, &write_request->buffer, (void*)write_request->address, write_request->size);
		}
		bytes_io = sizeof(NF_WRITE_REQUEST);
		DbgPrintEx(0, 0, "[norsefire]: NF_WRITE_MEMORY\n");
	}
	else if (ioctl == NF_MOUSE_EVENT)
	{
		PNF_MOUSE_REQUEST mouse_request = (PNF_MOUSE_REQUEST)irp->AssociatedIrp.SystemBuffer;
		mouse::mouse_event(mouse_obj, mouse_request->x, mouse_request->y, mouse_request->button_flags);
		status = STATUS_SUCCESS;
		bytes_io = sizeof(NF_MOUSE_REQUEST);
		DbgPrintEx(0, 0, "[norsefire]: NF_MOUSE_EVENT\n");
	}
	else
	{
		status = STATUS_INVALID_PARAMETER;
		bytes_io = 0;
		DbgPrintEx(0, 0, "[norsefire]: NF_FAILED_REQUEST\n");
	}

	irp->IoStatus.Status = status;
	irp->IoStatus.Information = bytes_io;
	IoCompleteRequest(irp, IO_NO_INCREMENT);
	return status;
}

NTSTATUS dispatch::create_call(PDEVICE_OBJECT device_object, PIRP irp)
{
	UNREFERENCED_PARAMETER(device_object);
	irp->IoStatus.Status = STATUS_SUCCESS;
	irp->IoStatus.Information = 0;
	IoCompleteRequest(irp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

NTSTATUS dispatch::close_call(PDEVICE_OBJECT device_object, PIRP irp)
{
	UNREFERENCED_PARAMETER(device_object);
	irp->IoStatus.Status = STATUS_SUCCESS;
	irp->IoStatus.Information = 0;
	IoCompleteRequest(irp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}