| 25 | |
| 26 | |
| 27 | PVOID ApiSetEnsurePointerDeviceHasMonitorHook(PDEVICE_OBJECT DeviceObject) |
| 28 | { |
| 29 | |
| 30 | #pragma region Validation |
| 31 | { |
| 32 | if (ExGetPreviousMode() != UserMode) { |
| 33 | return oApiSetEditionSetProcessWindowStationEntryPointPointer(DeviceObject); |
| 34 | } |
| 35 | |
| 36 | Communication comm = {}; |
| 37 | size_t read; |
| 38 | |
| 39 | |
| 40 | if (!NT_SUCCESS(Core::ReadVirtual(Core::GetKernelDirBase(), (uint64_t)DeviceObject, (uint8_t*)&comm, sizeof(Communication), &read)) || comm.key != COMMUNICATION_KEY) { |
| 41 | printf("[mapper] Invalid Usermode Call\n"); |
| 42 | return oApiSetEditionSetProcessWindowStationEntryPointPointer(DeviceObject); |
| 43 | } |
| 44 | } |
| 45 | #pragma endregion |
| 46 | |
| 47 | auto comm = (Communication*)DeviceObject; |
| 48 | |
| 49 | printf("[mapper] called w reason -> 0x%p\n", comm->key); |
| 50 | printf("[mapper] called w request -> 0x%p\n", comm->request); |
| 51 | |
| 52 | switch (comm->request) |
| 53 | { |
| 54 | case Request::READPROCESSMEMORY: |
| 55 | { |
| 56 | if (!NT_SUCCESS(Core::ReadProcessMemory(comm->processID, |
| 57 | comm->address, |
| 58 | comm->buffer, |
| 59 | comm->size, |
| 60 | &comm->read))) |
| 61 | { |
| 62 | printf("[mapper] failed a read to -> 0x%llx\n", comm->address); |
| 63 | } |
| 64 | |
| 65 | } break; |
| 66 | case Request::WRITEPROCESSMEMORY: |
| 67 | { |
| 68 | |
| 69 | if (!NT_SUCCESS(Core::WriteProcessMemory(comm->processID, |
| 70 | comm->address, |
| 71 | comm->buffer, |
| 72 | comm->size, |
| 73 | &comm->written))) |
| 74 | { |
| 75 | printf("[mapper] failed a write to -> 0x%llx\n", comm->address); |
| 76 | }; |
| 77 | } break; |
| 78 | case Request::GETMODULEBASE: |
| 79 | { |
| 80 | printf("comm->processID: %d, comm->moduleName: %s\n", comm->processID, comm->moduleName); |
| 81 | uint64_t baseAddress = NULL; |
| 82 | if (NT_SUCCESS(Core::GetModuleBaseAddress(comm->processID, comm->moduleName, &baseAddress))) |
| 83 | comm->buffer = (uint64_t)baseAddress; |
| 84 | else |
nothing calls this directly
no test coverage detected