| 885 | } |
| 886 | |
| 887 | bool intel_driver::ClearPiDDBCacheTable() { //PiDDBCacheTable added on LoadDriver |
| 888 | std::ostringstream ss; |
| 889 | auto PiDDBLockPtr = FindPatternInSectionAtKernel("PAGE", intel_driver::ntoskrnlAddr, (PUCHAR)"\x8B\xD8\x85\xC0\x0F\x88\x00\x00\x00\x00\x65\x48\x8B\x04\x25\x00\x00\x00\x00\x66\xFF\x88\x00\x00\x00\x00\xB2\x01\x48\x8D\x0D\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x4C\x8B\x00\x24", "xxxxxx????xxxxx????xxx????xxxxx????x????xx?x"); // 8B D8 85 C0 0F 88 ? ? ? ? 65 48 8B 04 25 ? ? ? ? 66 FF 88 ? ? ? ? B2 01 48 8D 0D ? ? ? ? E8 ? ? ? ? 4C 8B ? 24 update for build 22000.132 |
| 890 | auto PiDDBCacheTablePtr = FindPatternInSectionAtKernel("PAGE", intel_driver::ntoskrnlAddr, (PUCHAR)"\x66\x03\xD2\x48\x8D\x0D", "xxxxxx"); // 66 03 D2 48 8D 0D |
| 891 | |
| 892 | if (PiDDBLockPtr == NULL) { // PiDDBLock pattern changes a lot from version 1607 of windows and we will need a second pattern if we want to keep simple as possible |
| 893 | PiDDBLockPtr = FindPatternInSectionAtKernel("PAGE", intel_driver::ntoskrnlAddr, (PUCHAR)"\x48\x8B\x0D\x00\x00\x00\x00\x48\x85\xC9\x0F\x85\x00\x00\x00\x00\x48\x8D\x0D\x00\x00\x00\x00\xE8\x00\x00\x00\x00\xE8", "xxx????xxxxx????xxx????x????x"); // 48 8B 0D ? ? ? ? 48 85 C9 0F 85 ? ? ? ? 48 8D 0D ? ? ? ? E8 ? ? ? ? E8 build 22449+ (pattern can be improved but just fine for now) |
| 894 | if (PiDDBLockPtr == NULL) { |
| 895 | PiDDBLockPtr = FindPatternInSectionAtKernel("PAGE", intel_driver::ntoskrnlAddr, (PUCHAR)"\x8B\xD8\x85\xC0\x0F\x88\x00\x00\x00\x00\x65\x48\x8B\x04\x25\x00\x00\x00\x00\x48\x8D\x0D\x00\x00\x00\x00\xB2\x01\x66\xFF\x88\x00\x00\x00\x00\x90\xE8\x00\x00\x00\x00\x4C\x8B\x00\x24", "xxxxxx????xxxxx????xxx????xxxxx????xx????xx?x"); // 8B D8 85 C0 0F 88 ? ? ? ? 65 48 8B 04 25 ? ? ? ? 48 8D 0D ? ? ? ? B2 01 66 FF 88 ? ? ? ? 90 E8 ? ? ? ? 4C 8B ? 24 update for build 26100.1000 |
| 896 | if (PiDDBLockPtr == NULL) { |
| 897 | Log::Error("Warning PiDDBLock not found", false); |
| 898 | return false; |
| 899 | } |
| 900 | else { |
| 901 | Log::Fine("PiDDBLock found with third pattern"); |
| 902 | PiDDBLockPtr += 19;//third pattern offset |
| 903 | } |
| 904 | } |
| 905 | else { |
| 906 | Log::Fine("PiDDBLock found with second pattern"); |
| 907 | PiDDBLockPtr += 16; //second pattern offset |
| 908 | } |
| 909 | } |
| 910 | else { |
| 911 | PiDDBLockPtr += 28; //first pattern offset |
| 912 | } |
| 913 | |
| 914 | if (PiDDBCacheTablePtr == NULL) { |
| 915 | PiDDBCacheTablePtr = FindPatternInSectionAtKernel("PAGE", intel_driver::ntoskrnlAddr, (PUCHAR)"\x48\x8B\xF9\x33\xC0\x48\x8D\x0D", "xxxxxxxx"); // 48 8B F9 33 C0 48 8D 0D |
| 916 | if (PiDDBCacheTablePtr == NULL) { |
| 917 | Log::Error("Warning PiDDBCacheTable not found", false); |
| 918 | return false; |
| 919 | } |
| 920 | else { |
| 921 | Log::Fine("PiDDBCacheTable found with second pattern"); |
| 922 | PiDDBCacheTablePtr += 2;//second pattern offset |
| 923 | } |
| 924 | } |
| 925 | |
| 926 | ss << "PiDDBLock Ptr 0x" << std::hex << PiDDBLockPtr; |
| 927 | Log::Fine(ss.str()); ss.str(""); |
| 928 | ss << "PiDDBCacheTable Ptr 0x" << std::hex << PiDDBCacheTablePtr; |
| 929 | Log::Fine(ss.str()); ss.str(""); |
| 930 | |
| 931 | PVOID PiDDBLock = ResolveRelativeAddress((PVOID)PiDDBLockPtr, 3, 7); |
| 932 | nt::PRTL_AVL_TABLE PiDDBCacheTable = (nt::PRTL_AVL_TABLE)ResolveRelativeAddress((PVOID)PiDDBCacheTablePtr, 6, 10); |
| 933 | //context part is not used by lookup, lock or delete why we should use it? |
| 934 | |
| 935 | if (!ExAcquireResourceExclusiveLite(PiDDBLock, true)) { |
| 936 | Log::Error("Can't lock PiDDBCacheTable", false); |
| 937 | return false; |
| 938 | } |
| 939 | Log::Fine("PiDDBLock Locked"); |
| 940 | |
| 941 | auto n = GetDriverNameW(); |
| 942 | |
| 943 | auto timestamp = portable_executable::GetNtHeaders((void*)intel_driver_resource::driver)->FileHeader.TimeDateStamp; |
| 944 | |