vmcall / dxgkrnl_hook

C++ graphics kernel subsystem hook
481 stars 140 forks source link

stupid issue but i dont know what to do #3

Closed DemQn closed 4 years ago

DemQn commented 5 years ago

stupid issue but i dont know what to do:

// HOOK INFO
    using dxgk_submit_command_t = int64_t(__fastcall*)(D3DKMT_SUBMITCOMMAND * data);

https://i.imgur.com/uftOQKz.png and uint8_t* submit_command_address = reinterpret_cast<uint8_t*>(NtGdiDdDDISubmitCommand); https://i.imgur.com/gSpkHJY.png please help me with it

ivanpos2015 commented 5 years ago
PVOID GetKernelModule(const char* module_name)
{
    ULONG bytes = 0;
    NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, 0, bytes, &bytes);
    if (!bytes)
        return 0;

    PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x454E4F45); // 'ENON'
    status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes);
    if (!NT_SUCCESS(status))
        return 0;

    PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;
    PVOID module_base = 0, module_size = 0;
    for (ULONG i = 0; i < modules->NumberOfModules; i++)
    {
        if (strcmp((char*)module[i].FullPathName, module_name) == 0)
        {
            module_base = module[i].ImageBase;
            module_size = (PVOID)module[i].ImageSize;
            break;
        }
    }

    if (modules)
        ExFreePoolWithTag(modules, 0x454E4F45);

    if (module_base <= 0)
        return 0;

    return module_base;
}

PVOID NTAPI RtlxFindExportedRoutineByName(_In_ PVOID DllBase, _In_ const char* ExportName)
{
    PULONG NameTable;
    PUSHORT OrdinalTable;
    PIMAGE_EXPORT_DIRECTORY ExportDirectory;
    LONG Low = 0, Mid = 0, High, Ret;
    USHORT Ordinal;
    PVOID Function;
    ULONG ExportSize;
    PULONG ExportTable;

    ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &ExportSize);
    if (!ExportDirectory)
        return NULL;

    NameTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNames);
    OrdinalTable = (PUSHORT)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNameOrdinals);
    High = ExportDirectory->NumberOfNames - 1; 
    for (Low = 0; Low <= High; Low++) 
    {
        Ret = strcmp(ExportName, (PCHAR)DllBase + NameTable[Low]);
        if (Ret == 0) 
            break;
    }

    if (High < Low)
        return NULL;

    Ordinal = OrdinalTable[Low]; 
    if (Ordinal >= ExportDirectory->NumberOfFunctions)
        return NULL;

    ExportTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfFunctions);
    Function = (PVOID)((ULONG_PTR)DllBase + ExportTable[Ordinal]);
    return Function;
}

PVOID GetKernelModuleExport(const char* module_name, LPCSTR routine_name)
{
    PVOID lpModule = GetKernelModule(module_name);
    if (!lpModule)
        return NULL;

    return RtlxFindExportedRoutineByName(lpModule, routine_name);
} 

PVOID adrNtGdiDdDDISubmitCommand = GetKernelModuleExport("\\SystemRoot\\System32\\win32kbase.sys", "NtGdiDdDDISubmitCommand");

using dxgk_submit_command_t = `int64_t(__fastcall*)(void * data);
r1cky33 commented 5 years ago

u need to include some Windows DDI headers

sample from MSDN: https://github.com/microsoft/Windows-driver-samples/blob/master/video/KMDOD/bdd.hxx

ironxu commented 5 years ago
PVOID GetKernelModule(const char* module_name)
{
  ULONG bytes = 0;
  NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, 0, bytes, &bytes);
  if (!bytes)
      return 0;

  PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x454E4F45); // 'ENON'
  status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes);
  if (!NT_SUCCESS(status))
      return 0;

  PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;
  PVOID module_base = 0, module_size = 0;
  for (ULONG i = 0; i < modules->NumberOfModules; i++)
  {
      if (strcmp((char*)module[i].FullPathName, module_name) == 0)
      {
          module_base = module[i].ImageBase;
          module_size = (PVOID)module[i].ImageSize;
          break;
      }
  }

  if (modules)
      ExFreePoolWithTag(modules, 0x454E4F45);

  if (module_base <= 0)
      return 0;

  return module_base;
}

PVOID NTAPI RtlxFindExportedRoutineByName(_In_ PVOID DllBase, _In_ const char* ExportName)
{
  PULONG NameTable;
  PUSHORT OrdinalTable;
  PIMAGE_EXPORT_DIRECTORY ExportDirectory;
  LONG Low = 0, Mid = 0, High, Ret;
  USHORT Ordinal;
  PVOID Function;
  ULONG ExportSize;
  PULONG ExportTable;

  ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &ExportSize);
  if (!ExportDirectory)
      return NULL;

  NameTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNames);
  OrdinalTable = (PUSHORT)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNameOrdinals);
  High = ExportDirectory->NumberOfNames - 1; 
  for (Low = 0; Low <= High; Low++) 
  {
      Ret = strcmp(ExportName, (PCHAR)DllBase + NameTable[Low]);
      if (Ret == 0) 
          break;
  }

  if (High < Low)
      return NULL;

  Ordinal = OrdinalTable[Low]; 
  if (Ordinal >= ExportDirectory->NumberOfFunctions)
      return NULL;

  ExportTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfFunctions);
  Function = (PVOID)((ULONG_PTR)DllBase + ExportTable[Ordinal]);
  return Function;
}

PVOID GetKernelModuleExport(const char* module_name, LPCSTR routine_name)
{
  PVOID lpModule = GetKernelModule(module_name);
  if (!lpModule)
      return NULL;

  return RtlxFindExportedRoutineByName(lpModule, routine_name);
} 

PVOID adrNtGdiDdDDISubmitCommand = GetKernelModuleExport("\\SystemRoot\\System32\\win32kbase.sys", "NtGdiDdDDISubmitCommand");

using dxgk_submit_command_t = `int64_t(__fastcall*)(void * data);

Can you provide a project file?

CowNation commented 4 years ago

u need to include some Windows DDI headers

sample from MSDN: https://github.com/microsoft/Windows-driver-samples/blob/master/video/KMDOD/bdd.hxx

I've tried several different files from that sample but none seem to work d3dkmthk.h - gets rid of errors but causes several undefined UINT, BYTE, ect errors