Function main

SinMapper/SinMapper/main.cpp:4–164

#include "drv_image/drv_image.hpp"

int main(int argument_count, char** argument_array)
{
	if (argument_count != 4 || std::filesystem::path(argument_array[1]).extension().string().compare(".sys") || std::filesystem::path(argument_array[2]).extension().string().compare(".sys"))
	{
		std::printf("[-] usage: sinmapper.exe driver.sys signed_driver.sys .section_name\n");
		return -1;
	}

	if (std::filesystem::exists(argument_array[1]) == false)
	{
		std::printf("[-] driver [%s] does not exist\n", argument_array[1]);
		return -1;
	}

	if (util::get_module_base(argument_array[2]))
	{
		std::printf("[-] signed driver [%s] already loaded\n", argument_array[2]);
		return -1;
	}

	std::ifstream drv_buffer_str(argument_array[1], std::ios::binary);
	std::vector<std::uint8_t>drv_buffer(std::istreambuf_iterator<char>(drv_buffer_str), {});

	const auto nt_headers = portable_executable::get_nt_headers(drv_buffer.data());

	if (nt_headers->Signature != IMAGE_NT_SIGNATURE)
	{
		std::printf("[-] invalid nt signature of target file\n");
		return -1;
	}

	std::uint32_t image_size = nt_headers->OptionalHeader.SizeOfImage;

	potential_drivers signed_driver = util::get_driver_info(argument_array[2], argument_array[3], image_size);

	if (signed_driver.number_of_sections == 0)
	{
		std::printf("[-] failed to get info for potential driver.\n");
		return -1;
	}

	NTSTATUS load_status = driver::load(signed_driver.file_path, signed_driver.file_name);
	std::uintptr_t signed_module_base = util::get_module_base(signed_driver.file_name.c_str());

	if ((load_status != STATUS_SUCCESS && load_status != 0x1) || !signed_module_base)
	{
		printf("[-] failed to load [%s] [0x%x]\n", signed_driver.file_name.c_str(), load_status);
		return -1;
	}

	std::printf("[+] loaded [%s] at [%p] with result [0x%x]\n", signed_driver.file_name, signed_module_base, load_status);

	std::uintptr_t start_map = signed_module_base + signed_driver.section_offset;

	std::printf("[+] target section [%s] offset [0x%x] size [0x%x] map start [%p]\n\n", argument_array[3], signed_driver.section_offset, signed_driver.section_size, start_map);

	static const auto kernel_base = util::get_module_base("ntoskrnl.exe");