1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
#include <ntddk.h>
#include <except.h>
DRIVER_INITIALIZE DriverEntry;
DRIVER_UNLOAD DriverUnload;
extern NTSTATUS NTAPI ZwProtectVirtualMemory(_In_ HANDLE ProcessHandle,
_In_ _Out_ PVOID * BaseAddress,
_In_ _Out_ PULONG NumberOfBytesToProtect,
_In_ ULONG NewAccessProtection,
_Out_ PULONG OldAccessProtection);
extern NTSTATUS NTAPI ZwQuerySystemInformation(_In_ int SystemInformationClass,
_Inout_ PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength);
extern NTSTATUS NTAPI WrapperZwQuerySystemInformation(_In_ int SystemInformationClass,
_Inout_ PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength);
int example_exception_handler(_In_ EXCEPTION_POINTERS * lpEP)
{
(void)lpEP;
DbgPrint("Exception handler called!\n");
return EXCEPTION_EXECUTE_HANDLER;
}
static void another_seh_test()
{
DbgPrint("Another SEH test..\n");
__dpptry(example_exception_handler, anotherseh)
{
*(int *)0 = 0;
}
__dppexcept(anotherseh)
{
DbgPrint("Success!\n");
}
__dpptryend(anotherseh);
}
static void zw_test()
{
NTSTATUS ret;
ULONG memoryNeeded = 0;
ret = ZwQuerySystemInformation(0x5, NULL, 0, &memoryNeeded);
if (ret != STATUS_INFO_LENGTH_MISMATCH || !memoryNeeded)
{
DbgPrint("ZwQuerySystemInformation failed with 0x%lX (memory needed: %lu)\n", ret, memoryNeeded);
}
memoryNeeded = 0;
ret = WrapperZwQuerySystemInformation(0x5, NULL, 0, &memoryNeeded);
if (ret != STATUS_INFO_LENGTH_MISMATCH || !memoryNeeded)
{
DbgPrint("ZwQuerySystemInformation failed 0x%lX (memory needed: %lu)\n", ret, memoryNeeded);
}
}
NTSTATUS DriverEntry(struct _DRIVER_OBJECT * DriverObject, PUNICODE_STRING RegistryPath)
{
(void)DriverObject;
(void)RegistryPath;
DbgPrint("%s\n", "Hello ring0!");
DbgPrint("Testing SEH..\n");
__dpptry(example_exception_handler, testseh)
{
*(int *)0 = 0;
DbgPrint("You should never see this text!\n");
}
__dppexcept(testseh)
{
DbgPrint("Success! SEH seems to work.\n");
}
__dpptryend(testseh);
another_seh_test();
zw_test();
DbgPrint("%s\n", "Disable/Enable Interrupts!");
_disable();
_enable();
DbgPrint("%s\n", "Done with Disable/Enable Interrupts!");
return STATUS_SUCCESS;
}
VOID DriverUnload(struct _DRIVER_OBJECT * DriverObject)
{
(void)DriverObject;
DbgPrint("%s\n", "Bye ring0!");
}
|