Closed DemQn closed 4 years ago
PVOID GetKernelModule(const char* module_name)
{
ULONG bytes = 0;
NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, 0, bytes, &bytes);
if (!bytes)
return 0;
PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x454E4F45); // 'ENON'
status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes);
if (!NT_SUCCESS(status))
return 0;
PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;
PVOID module_base = 0, module_size = 0;
for (ULONG i = 0; i < modules->NumberOfModules; i++)
{
if (strcmp((char*)module[i].FullPathName, module_name) == 0)
{
module_base = module[i].ImageBase;
module_size = (PVOID)module[i].ImageSize;
break;
}
}
if (modules)
ExFreePoolWithTag(modules, 0x454E4F45);
if (module_base <= 0)
return 0;
return module_base;
}
PVOID NTAPI RtlxFindExportedRoutineByName(_In_ PVOID DllBase, _In_ const char* ExportName)
{
PULONG NameTable;
PUSHORT OrdinalTable;
PIMAGE_EXPORT_DIRECTORY ExportDirectory;
LONG Low = 0, Mid = 0, High, Ret;
USHORT Ordinal;
PVOID Function;
ULONG ExportSize;
PULONG ExportTable;
ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &ExportSize);
if (!ExportDirectory)
return NULL;
NameTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNames);
OrdinalTable = (PUSHORT)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNameOrdinals);
High = ExportDirectory->NumberOfNames - 1;
for (Low = 0; Low <= High; Low++)
{
Ret = strcmp(ExportName, (PCHAR)DllBase + NameTable[Low]);
if (Ret == 0)
break;
}
if (High < Low)
return NULL;
Ordinal = OrdinalTable[Low];
if (Ordinal >= ExportDirectory->NumberOfFunctions)
return NULL;
ExportTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfFunctions);
Function = (PVOID)((ULONG_PTR)DllBase + ExportTable[Ordinal]);
return Function;
}
PVOID GetKernelModuleExport(const char* module_name, LPCSTR routine_name)
{
PVOID lpModule = GetKernelModule(module_name);
if (!lpModule)
return NULL;
return RtlxFindExportedRoutineByName(lpModule, routine_name);
}
PVOID adrNtGdiDdDDISubmitCommand = GetKernelModuleExport("\\SystemRoot\\System32\\win32kbase.sys", "NtGdiDdDDISubmitCommand");
using dxgk_submit_command_t = `int64_t(__fastcall*)(void * data);
u need to include some Windows DDI headers
sample from MSDN: https://github.com/microsoft/Windows-driver-samples/blob/master/video/KMDOD/bdd.hxx
PVOID GetKernelModule(const char* module_name) { ULONG bytes = 0; NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, 0, bytes, &bytes); if (!bytes) return 0; PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x454E4F45); // 'ENON' status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes); if (!NT_SUCCESS(status)) return 0; PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules; PVOID module_base = 0, module_size = 0; for (ULONG i = 0; i < modules->NumberOfModules; i++) { if (strcmp((char*)module[i].FullPathName, module_name) == 0) { module_base = module[i].ImageBase; module_size = (PVOID)module[i].ImageSize; break; } } if (modules) ExFreePoolWithTag(modules, 0x454E4F45); if (module_base <= 0) return 0; return module_base; } PVOID NTAPI RtlxFindExportedRoutineByName(_In_ PVOID DllBase, _In_ const char* ExportName) { PULONG NameTable; PUSHORT OrdinalTable; PIMAGE_EXPORT_DIRECTORY ExportDirectory; LONG Low = 0, Mid = 0, High, Ret; USHORT Ordinal; PVOID Function; ULONG ExportSize; PULONG ExportTable; ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &ExportSize); if (!ExportDirectory) return NULL; NameTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNames); OrdinalTable = (PUSHORT)((ULONG_PTR)DllBase + ExportDirectory->AddressOfNameOrdinals); High = ExportDirectory->NumberOfNames - 1; for (Low = 0; Low <= High; Low++) { Ret = strcmp(ExportName, (PCHAR)DllBase + NameTable[Low]); if (Ret == 0) break; } if (High < Low) return NULL; Ordinal = OrdinalTable[Low]; if (Ordinal >= ExportDirectory->NumberOfFunctions) return NULL; ExportTable = (PULONG)((ULONG_PTR)DllBase + ExportDirectory->AddressOfFunctions); Function = (PVOID)((ULONG_PTR)DllBase + ExportTable[Ordinal]); return Function; } PVOID GetKernelModuleExport(const char* module_name, LPCSTR routine_name) { PVOID lpModule = GetKernelModule(module_name); if (!lpModule) return NULL; return RtlxFindExportedRoutineByName(lpModule, routine_name); } PVOID adrNtGdiDdDDISubmitCommand = GetKernelModuleExport("\\SystemRoot\\System32\\win32kbase.sys", "NtGdiDdDDISubmitCommand"); using dxgk_submit_command_t = `int64_t(__fastcall*)(void * data);
Can you provide a project file?
u need to include some Windows DDI headers
sample from MSDN: https://github.com/microsoft/Windows-driver-samples/blob/master/video/KMDOD/bdd.hxx
I've tried several different files from that sample but none seem to work d3dkmthk.h - gets rid of errors but causes several undefined UINT, BYTE, ect errors
stupid issue but i dont know what to do:
https://i.imgur.com/uftOQKz.png and
uint8_t* submit_command_address = reinterpret_cast<uint8_t*>(NtGdiDdDDISubmitCommand);
https://i.imgur.com/gSpkHJY.png please help me with it