Code Snippet for Use After Free Vulnerability in HackSys Extreme Vulnerable Driver

UseAfterFree.c

NTSTATUS HackSysHandleIoctlCreateBuffer(IN PIRP pIrp, IN PIO_STACK_LOCATION pIoStackIrp)
{
	PUSE_AFTER_FREE pUseAfterFree = NULL;
	SIZE_T inputBufferSize = 0;
	NTSTATUS status = STATUS_UNSUCCESSFUL;

	UNREFERENCED_PARAMETER(pIrp);
	UNREFERENCED_PARAMETER(pIoStackIrp);
	PAGED_CODE();

	status = CreateBuffer();
	
	return status;
}

NTSTATUS HackSysHandleIoctlUseBuffer(IN PIRP pIrp, IN PIO_STACK_LOCATION pIoStackIrp)
{
	PVOID pInputBuffer = NULL;
	SIZE_T inputBufferSize = 0;
	PUSE_AFTER_FREE pUseAfterFree = NULL;
	NTSTATUS status = STATUS_UNSUCCESSFUL;

	UNREFERENCED_PARAMETER(pIrp);
	PAGED_CODE();

	pInputBuffer = pIoStackIrp->Parameters.DeviceIoControl.Type3InputBuffer;
	inputBufferSize = sizeof(pUseAfterFree->buffer);

	if (pInputBuffer)
		status = UseBuffer(pInputBuffer, inputBufferSize);
	
	return status;
}

NTSTATUS HackSysHandleIoctlFreeBuffer(IN PIRP pIrp, IN PIO_STACK_LOCATION pIoStackIrp)
{
	NTSTATUS status = STATUS_UNSUCCESSFUL;

	UNREFERENCED_PARAMETER(pIrp);
	UNREFERENCED_PARAMETER(pIoStackIrp);
	PAGED_CODE();

	status = FreeBuffer();
	
	return status;
}