HEVD Failed to `CreateFileA` Windows 7

[Nordgaren]

Hello! I am trying to do some debugging with WinDBG, and I need to trigger BufferOverflowStackIoctlHandler, but I can't get a handle to the device for some reason? I am using the latest HEVD and I have Windows 7 updated as far as I can get it (two security updates that VMWare forums recommended, although I am using a virtualbox machine)

IDK if I have a broken driver, or not. OSRLoader said everything was successful, and I can view the functions in memory in WinDBG (but I can't if I try to look at it in Cheat Engine, but apparently that is because the drive is paged to disk. This would be a cool view if someone knew how to breakpoint one of the vulnerable functions with Cheat Engine, as I really like the view of the memory in that program).

    HANDLE hevd = CreateFileA(
            "\\\\.\\HackSysExtremeVulnerableDriver",
            0xC0000000,
            0,
            0,
            0x3,
            0,
            0);

    printf("Driver: %p, Last Error: %d", hevd, GetLastError());

hevd = kernel32.CreateFileA(
        "\\\\.\\HackSysExtremeVulnerableDriver", 
        0xC0000000, 
        0, 
        None, 
        0x3, 
        0, 
        None)

 if (not hevd) or (hevd == -1):
    print("[!] Failed to retrieve handle to device-driver with error-code: " + str(GetLastError()))
    sys.exit(1)
else:
    print("[*] Successfully retrieved handle to device-driver: " + str(hevd))

the terminal is the c program and sublime text is running the python program. The python script outputs error code 3, but the C version seems to return an invalid handle, but no issue with GetLastError. Any ideas?

Cheat Engine issue if you are curious and have any input! https://github.com/cheat-engine/cheat-engine/issues/2417

[Nordgaren]

Oh yea, I am on Windows 7 x64. Should I be on x86? I just noticed on the README ti says windows 7 x86 and Windows 10 x64.

Maybe I should try HEVD 2?

[Nordgaren]

OKAY, so HEVD3 DOES work, but CreateFileA doesn't work in python 3.8.11. It just errors with a GetLastError of 3. I used python 2.2.7 to get the handle. Sorry about the bother!

EDIT: If anyone reads this and is having the same problem and you NEED to use python3, you can put b in front of your driver file name for CreateFileA. Seems like Python3 uses wide strings by default.

CreateFileA(
        b"\\\\.\\HackSysExtremeVulnerableDriver", 
        0xC0000000, 
        0, 
        None, 
        0x3, 
        0, 
        None)