vrr/kdmapper
2
0
Fork 0
mirror of https://github.com/TheCruZ/kdmapper.git synced 2026-10-18 23:27:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Symbols refactor...

Browse source
This commit is contained in:
TheCruZ 2025-02-09 03:44:30 +01:00
parent c50e8dfaea
commit 19e12cf63a
28 changed files with 418 additions and 1084 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.gitignore vendored
View file

@ -3,4 +3,5 @@ kdmapper/x64
kdmapper/kdmapper.vcxproj.user
x64
HelloWorld/.vs
Intermediate
Intermediate
SymbolsFromPDB/offsets.ini

0
Tools/SymChk/dbghelp.dll → DbgHelp/dbghelp.dll
View file

0
Tools/SymChk/symsrv.dll → DbgHelp/symsrv.dll
View file

8
README.MD
View file

@ -4,7 +4,7 @@ Original creator https://github.com/z175
Updated and improved by https://github.com/TheCruZ
PDB offsets parser written by https://github.com/Mohi-eddine
Initial PDB offsets parser written by https://github.com/Mohi-eddine
Independent Pages allocation written by https://github.com/Herooyyy/
@ -34,9 +34,9 @@ KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map
Added param --PassAllocationPtr to pass allocation ptr as first param
Added the possibility to modify params before call driver entry
Now you can pass bytes directly to mapdriver function
Added PDB_OFFSETS macro that will allow the use of Offset PDB features (choose the target build or define in SymbolsHandler.hpp)
Added param --OffsetsPath "FilePath" to include your own offsets file path (if FilePath contains spaces, it must be enclosed in quotation marks)
Added param --DontUpdateOffset to execute without updating the offsets file (warning: you have to be sure that the offsets are not outdated to your current windows build, or you risk a potential BSOD)
Added PDB_OFFSETS macro that will allow the use of Offset PDB features (choose the target build)
Added param --offsetsPath "FilePath" to include your own offsets file path (if FilePath contains spaces, it must be enclosed in quotation marks)
Added param --dontUpdateOffsets to execute without updating the offsets file (warning: you have to be sure that the offsets are not outdated to your current windows build, or you risk a potential BSOD)
Introduced new project "SymbolsFromPDB" that will help KDMapper to adapt quickly to any windows updates by parsing the target .PDB files (PDB_OFFSETS macro must be defined to use this feature)
## Requirements:

113
SymbolsFromPDB/SimplestSymbolHandler.cpp Normal file
View file

@ -0,0 +1,113 @@
#include "SimplestSymbolHandler.h"
#include <windows.h>
#include <string>
#include <memory>
#include <filesystem>
#include <iostream>
#include <dbghelp.h>
#pragma comment( lib, "dbghelp.lib" )
SimplestSymbolHandler::SimplestSymbolHandler(std::wstring cachePath) {
process = (unsigned long long)GetCurrentProcess();
SymInitializeW((HANDLE)process, (L"cache*" + cachePath + L";SRV*http://msdl.microsoft.com/download/symbols").c_str(), FALSE);
SymSetOptions(SYMOPT_EXACT_SYMBOLS | SYMOPT_DEBUG);
}
SimplestSymbolHandler::~SimplestSymbolHandler() {
SymCleanup((HANDLE)process);
}
std::wstring SimplestSymbolHandler::GetPDB(const std::wstring binaryPath) {
SYMSRV_INDEX_INFOW info{};
info.sizeofstruct = sizeof(SYMSRV_INDEX_INFOW);
bool result = SymSrvGetFileIndexInfoW(binaryPath.c_str(), &info, 0);
if (!result)
{
std::wcout << "[-] Failed to find binary info. Error: " << GetLastError() << std::endl;
return {};
}
void* id;
DWORD idType;
if (info.guid == GUID{}) { // GUID is zeroed
id = &info.sig;
idType = SSRVOPT_DWORDPTR;
}
else {
id = &info.guid;
idType = SSRVOPT_GUIDPTR;
}
auto pdbPath = std::make_unique<wchar_t[]>(4096);
bool found = SymFindFileInPathW(
(HANDLE)process,
NULL,
info.pdbfile,
id,
info.age,
0,
idType,
pdbPath.get(),
NULL,
NULL
);
return std::wstring(pdbPath.get());
}
std::vector<ULONG64> SimplestSymbolHandler::GetOffset(std::wstring pdbPath, std::vector<std::wstring> symbolName) {
DWORD64 BaseAddr = 0x40000;
DWORD FileSize = (DWORD)std::filesystem::file_size(pdbPath);
// Load symbols for the module
std::wcout << "[+] Loading Symbols From " << pdbPath << std::endl;
DWORD64 ModBase = SymLoadModuleExW(
(HANDLE)process, // Process handle of the current process
NULL, // Handle to the module's image file (not needed)
pdbPath.c_str(), // Path/name of the file
NULL, // User-defined short name of the module (it can be NULL)
BaseAddr, // Base address of the module (cannot be NULL if .PDB file is used, otherwise it can be NULL)
FileSize, // Size of the file (cannot be NULL if .PDB file is used, otherwise it can be NULL)
NULL,
NULL
);
if (ModBase == 0)
{
std::wcout << "[-] Error: SymLoadModule64() failed. Error code: " << GetLastError() << std::endl;
return {};
}
SYMBOL_INFO_PACKAGEW SymInfoPackage{};
SymInfoPackage.si.SizeOfStruct = sizeof(SYMBOL_INFOW);
SymInfoPackage.si.MaxNameLen = sizeof(SymInfoPackage.name);//MAX_SYM_NAME + 1;
std::vector<ULONG64> offsets{};
for (const auto& sym : symbolName) {
BOOL bRet = SymFromNameW(
(HANDLE)process,
sym.c_str(),
&SymInfoPackage.si
);
if (!bRet || !SymInfoPackage.si.Address)
{
std::wcout << "[-] Error: SymFromName() failed. Sym: " << sym << " || Error code: " << GetLastError() << std::endl;
SymUnloadModule64(GetCurrentProcess(), ModBase);
return {};
}
// Display information about the symbol
std::wcout << "[+] Symbol " << sym << " Offset: " << (DWORD)(SymInfoPackage.si.Address - ModBase) << std::endl;
offsets.push_back((DWORD)(SymInfoPackage.si.Address - ModBase));
}
SymUnloadModule64(GetCurrentProcess(), ModBase);
return offsets;
}

25
SymbolsFromPDB/SimplestSymbolHandler.h Normal file
View file

@ -0,0 +1,25 @@
#pragma once
#include <string>
#include <vector>
struct SymNeeded {
std::wstring binaryName;
std::wstring symbolName;
};
//Require dbghelp.dll and symsrv.dll
class SimplestSymbolHandler {
public:
SimplestSymbolHandler(std::wstring cachePath);
~SimplestSymbolHandler();
std::wstring GetPDB(const std::wstring binaryPath);
std::vector<unsigned long long> GetOffset(std::wstring pdbPath, std::vector<std::wstring> symbolName);
private:
unsigned long long process; //HANDLE but we don't want to share the windows.h include
};

31
SymbolsFromPDB/Src/DataStructs.h
View file

@ -1,31 +0,0 @@
/*
#####################
# MoHieDDiNNe Codes #
#####################
*/
#pragma once
#include "Defines.h"
#define Elements_Count(Array,Type) (sizeof(Array) / sizeof(Type))
typedef struct _SYM_INFO
{
PVOID SymbolAddress;
PCSTR SymbolName;
DWORD NameLen;
DWORD SymbolOffset;
}SYM_INFO, * PSYM_INFO;
typedef struct _SYM_INFO_ARRAY
{
PSYM_INFO SymbolsArray;
SIZE_T ElementsCount;
}SYM_INFO_ARRAY, * PSYM_INFO_ARRAY;
typedef struct _SYMBOLS_DATA
{
PCSTR PDBFileName;
SYM_INFO_ARRAY SymbolsInfoArray;
}SYMBOLS_DATA, *PSYMBOLS_DATA;

10
SymbolsFromPDB/Src/Defines.h
View file

@ -1,10 +0,0 @@
/*
#####################
# MoHieDDiNNe Codes #
#####################
*/
#pragma once
#include <stdio.h>
#include <windows.h>

459
SymbolsFromPDB/Src/SymbolsHandler.c
View file

@ -1,459 +0,0 @@
#include "SymbolsHandler.h"
BOOLEAN GenerateOffsetFile()
{
SYM_INFO NtOsKernelFunctionsInfo[] = {
{NULL,"MmAllocateIndependentPagesEx",0,0 },
{NULL,"MmFreeIndependentPages",0,0 },
{NULL,"PiDDBLock",0,0 },
{NULL,"PiDDBCacheTable",0,0 },
{NULL,"MmSetPageProtection",0,0 },
//Keep Adding Here
};
SYM_INFO WdFilterFunctionsInfo[] = {
{NULL,"MpBmDocOpenRules",0,0 },
{NULL,"MpFreeDriverInfoEx",0,0 },
//Keep Adding Here
};
SYM_INFO CIFunctionsInfo[] = {
{NULL,"g_KernelHashBucketList",0,0 },
{NULL,"g_HashCacheLock",0,0 },
//Keep Adding Here
};
SYMBOLS_DATA SymsData[] = {
{NTOSKRNL_PATH ,NtOsKernelFunctionsInfo ,Elements_Count(NtOsKernelFunctionsInfo,SYM_INFO) },
{WDFILTER_PATH ,WdFilterFunctionsInfo ,Elements_Count(WdFilterFunctionsInfo,SYM_INFO) },
{CIDLL_PATH ,CIFunctionsInfo ,Elements_Count(CIFunctionsInfo,SYM_INFO) },
};
for(int FunctionsInfoIdx = 0 ; FunctionsInfoIdx < Elements_Count(SymsData, SYMBOLS_DATA) ;++FunctionsInfoIdx)
{
printf("\n");
if (!InitKernelSymbolsList(SymsData[FunctionsInfoIdx].PDBFileName, &SymsData[FunctionsInfoIdx].SymbolsInfoArray))
{
printf("Error: Failed To Get One Or More Function Offset.\n");
return FALSE;
}
}
HANDLE FileHandle = CreateFile(SYM_OFFSETS_PATH, GENERIC_WRITE, FILE_SHARE_READ,
NULL, CREATE_ALWAYS, 0, NULL);
if (!FileHandle || FileHandle == INVALID_HANDLE_VALUE)
{
printf("Error: Failed To Create Symbols Offset FileHandle.\n");
return FALSE;
}
PBYTE Buffer = NULL;
SIZE_T OffsetSize = 2 + sizeof(SymsData->SymbolsInfoArray.SymbolsArray->SymbolOffset) * 2;
SIZE_T BufferSize = 0;
DWORD BufferOffset = 0;
for (int FunctionsInfoIdx = 0; FunctionsInfoIdx < Elements_Count(SymsData, SYMBOLS_DATA); ++FunctionsInfoIdx)
{
//counting number of bytes
SIZE_T BytesCount = 0;
for (int FunctionIdx = 0; FunctionIdx < SymsData[FunctionsInfoIdx].SymbolsInfoArray.ElementsCount; ++FunctionIdx)
{
BytesCount += SymsData[FunctionsInfoIdx].SymbolsInfoArray.SymbolsArray[FunctionIdx].NameLen;
BytesCount += OffsetSize;
BytesCount += 2;//for '\n' and ','
}
BufferSize += BytesCount;
}
if (!BufferSize)
{
printf("Error: Failed To Get FileHandle Buffer Size.\n");
goto FailExit;
}
Buffer = malloc(BufferSize);
if (!Buffer)
{
printf("Error: Failed To Allocate Memory For FileHandle Buffer.\n");
goto FailExit;
}
for (int FunctionsInfoIdx = 0; FunctionsInfoIdx < Elements_Count(SymsData, SYMBOLS_DATA); ++FunctionsInfoIdx)
{
//writing data
for (int FunctionIdx = 0; FunctionIdx < SymsData[FunctionsInfoIdx].SymbolsInfoArray.ElementsCount; ++FunctionIdx)
{
memcpy(Buffer + BufferOffset, SymsData[FunctionsInfoIdx].SymbolsInfoArray.SymbolsArray[FunctionIdx].SymbolName, SymsData[FunctionsInfoIdx].SymbolsInfoArray.SymbolsArray[FunctionIdx].NameLen);
BufferOffset += SymsData[FunctionsInfoIdx].SymbolsInfoArray.SymbolsArray[FunctionIdx].NameLen;
*(Buffer + BufferOffset) = ',';
++BufferOffset;
snprintf((Buffer + BufferOffset), (size_t)(1 + OffsetSize), "0x%08X", SymsData[FunctionsInfoIdx].SymbolsInfoArray.SymbolsArray[FunctionIdx].SymbolOffset);//+1 for NULL terminator
BufferOffset += OffsetSize;
*(Buffer + BufferOffset) = '\n';
++BufferOffset;
}
}
BOOL IsWritten = WriteFile(
FileHandle,
Buffer,
BufferSize,
NULL,
NULL);
CloseHandle(FileHandle);
free(Buffer);
if (!IsWritten)
{
printf("Error: Failed To Write To Symbols Offset FileHandle.\n");
return FALSE;
}
return TRUE;
FailExit:
CloseHandle(FileHandle);
return FALSE;
}
BOOLEAN InitKernelSymbolsList(
IN PATH_TYPE FilePath,
IN OUT PSYM_INFO_ARRAY pSymbolsArray)
{
if (!FilePath || !pSymbolsArray)
return FALSE;
BOOL bRet = FALSE;
BOOL Result = TRUE;
// Set options
DWORD Options = SymGetOptions();
// SYMOPT_DEBUG option asks DbgHelp to print additional troubleshooting
// messages to debug output - use the debugger's Debug Output window
// to view the messages
Options |= SYMOPT_DEBUG;
SymSetOptions(Options);
// Initialize DbgHelp and load symbols for all modules of the current process
bRet = SymInitialize(
GetCurrentProcess(), // Process handle of the current process
NULL, // No user-defined search path -> use default
FALSE // Do not load symbols for modules in the current process
);
if (!bRet)
{
printf("Error: SymInitialize() failed. Error code: %u \n", GetLastError());
return 0;
}
do
{
// Determine the base address and the file size
PATH_TYPE pFileName = FilePath;
DWORD64 BaseAddr = 0;
DWORD FileSize = 0;
if (!GetFileParams(pFileName, &BaseAddr, &FileSize))
{
printf(("Error: Cannot obtain file parameters (internal error).\n"));
Result = FALSE;
break;
}
// Load symbols for the module
#ifdef UNICODE
printf("-> Loading Symbols From %ls ... \n", pFileName);
DWORD64 ModBase = SymLoadModuleExW(
GetCurrentProcess(), // Process handle of the current process
NULL, // Handle to the module's image file (not needed)
pFileName, // Path/name of the file
NULL, // User-defined short name of the module (it can be NULL)
BaseAddr, // Base address of the module (cannot be NULL if .PDB file is used, otherwise it can be NULL)
FileSize, // Size of the file (cannot be NULL if .PDB file is used, otherwise it can be NULL)
NULL,
NULL
);
#else
printf("-> Loading Symbols From %s ... \n",pFileName);
DWORD64 ModBase = SymLoadModule64(
GetCurrentProcess(), // Process handle of the current process
NULL, // Handle to the module's image file (not needed)
pFileName, // Path/name of the file
NULL, // User-defined short name of the module (it can be NULL)
BaseAddr, // Base address of the module (cannot be NULL if .PDB file is used, otherwise it can be NULL)
FileSize // Size of the file (cannot be NULL if .PDB file is used, otherwise it can be NULL)
);
#endif
if (ModBase == 0)
{
printf("Error: SymLoadModule64() failed. Error code: %u \n", GetLastError());
Result = FALSE;
break;
}
#ifndef NDEBUG
printf("Load address: %I64x \n", ModBase);
#endif
// Obtain and display information about loaded symbols
#ifndef NDEBUG
ShowSymbolInfo(ModBase);
#endif
SYMBOL_INFO_PACKAGE SymInfoPackage = { NULL };
SymInfoPackage.si.SizeOfStruct = sizeof(SYMBOL_INFO);
SymInfoPackage.si.MaxNameLen = sizeof(SymInfoPackage.name);//MAX_SYM_NAME + 1;
// space for the name of the symbol
for (int i = 0; i < pSymbolsArray->ElementsCount; ++i)
{
PCSTR SymName = pSymbolsArray->SymbolsArray[i].SymbolName;
bRet = SymFromName(
GetCurrentProcess(), // Process handle of the current process
SymName, // Symbol name
&SymInfoPackage.si // Address of the SYMBOL_INFO structure (inside "sip" object)
);
if (!bRet || !SymInfoPackage.si.Address)
{
printf("Error: SymFromName() failed. Sym: %s || Error code: %u \n", pSymbolsArray->SymbolsArray[i].SymbolName, GetLastError());
Result = FALSE;
}
else
{
// Display information about the symbol
pSymbolsArray->SymbolsArray[i].SymbolOffset = (DWORD)(SymInfoPackage.si.Address - ModBase);
pSymbolsArray->SymbolsArray[i].NameLen = SymInfoPackage.si.NameLen;
printf("Symbol %s Offset: %X\n", SymName, pSymbolsArray->SymbolsArray[i].SymbolOffset);
}
}
// Unload symbols for the module
bRet = SymUnloadModule64(GetCurrentProcess(), ModBase);
if (!bRet)
{
printf("Error: Unload Symbols failed. Error code: %u \n", GetLastError());
}
} while (0);
// Deinitialize DbgHelp
bRet = SymCleanup(GetCurrentProcess());
if (!bRet)
{
printf("Error: Sym Cleanup failed. Error code: %u \n", GetLastError());
return 0;
}
// Complete
return Result;
}
///////////////////////////////////////////////////////////////////////////////
// Functions
//
BOOLEAN GetFileParams(IN
PATH_TYPE pFileName,
OUT uintptr_t* BaseAddr,
OUT DWORD* FileSize)
{
// Check parameters
if (!pFileName || !BaseAddr || !FileSize)
{
return FALSE;
}
// Determine the extension of the file
PATH_TYPE szFileExt[_MAX_EXT] = { 0 };
#ifdef UNICODE
_wsplitpath_s(pFileName, NULL, 0, NULL, 0, NULL, 0, szFileExt, _MAX_EXT);
#else
_splitpath_s(pFileName, NULL, 0, NULL, 0, NULL, 0, szFileExt, _MAX_EXT);
#endif
// Is it .PDB file ?
#ifdef UNICODE
if (_wcsicmp(szFileExt, L".PDB") == 0)
#else
if (_stricmp(szFileExt, ".PDB") == 0)
#endif
{
// Yes, it is a .PDB file
// Determine its size, and use a dummy base address
*BaseAddr = 0x10000000; // it can be any non-zero value, but if we load symbols
// from more than one file, memory regions specified
// for different files should not overlap
// (region is "base address + file size")
if (!_GetFileSize(pFileName, FileSize))
{
return FALSE;
}
}
else
{
// It is not a .PDB file
// Base address and file size can be 0
*BaseAddr = 0;
*FileSize = 0;
return FALSE;
}
// Complete
return TRUE;
}
BOOLEAN _GetFileSize(
IN PATH_TYPE pFileName,
OUT DWORD* FileSize)
{
// Check parameters
if (!pFileName || !FileSize)
{
return FALSE;
}
// Open the file
HANDLE hFile = CreateFile(pFileName, GENERIC_READ, FILE_SHARE_READ,
NULL, OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
printf("CreateFile() failed. Error: %u \n", GetLastError());
return FALSE;
}
// Obtain the size of the file
*FileSize = GetFileSize(hFile, NULL);
if (*FileSize == INVALID_FILE_SIZE)
{
printf("GetFileSize() failed. Error: %u \n", GetLastError());
// and continue ...
}
// Close the file
if (!CloseHandle(hFile))
{
printf("CloseHandle() failed. Error: %u \n", GetLastError());
// and continue ...
}
// Complete
return (*FileSize != INVALID_FILE_SIZE);
}
#ifndef NDEBUG
void ShowSymbolInfo(
IN uintptr_t ModBase)
{
// Get module information
IMAGEHLP_MODULE ModuleInfo;
memset(&ModuleInfo, 0, sizeof(ModuleInfo));
ModuleInfo.SizeOfStruct = sizeof(ModuleInfo);
BOOL bRet = SymGetModuleInfo64(GetCurrentProcess(), ModBase, &ModuleInfo);
if (!bRet)
{
printf("Error: SymGetModuleInfo64() failed. Error code: %u \n", GetLastError());
return;
}
// Display information about symbols
// Kind of symbols
switch (ModuleInfo.SymType)
{
case SymNone:
printf("No symbols available for the module.\n");
break;
case SymExport:
printf("Loaded symbols: Exports\n");
break;
case SymCoff:
printf("Loaded symbols: COFF\n");
break;
case SymCv:
printf("Loaded symbols: CodeView\n");
break;
case SymSym:
printf("Loaded symbols: SYM\n");
break;
case SymVirtual:
printf("Loaded symbols: Virtual\n");
break;
case SymPdb:
printf("Loaded symbols: PDB\n");
break;
case SymDia:
printf("Loaded symbols: DIA\n");
break;
case SymDeferred:
printf("Loaded symbols : Deferred\n"); // not actually loaded
break;
default:
printf("Loaded symbols: Unknown format.\n");
break;
}
// Image name
if (strlen(ModuleInfo.ImageName) > 0)
{
printf("Image name: %s \n", ModuleInfo.ImageName);
}
// Loaded image name
if (strlen(ModuleInfo.LoadedImageName) > 0)
{
printf("Loaded image name: %s \n", ModuleInfo.LoadedImageName);
}
// Loaded PDB name
if (strlen(ModuleInfo.LoadedPdbName) > 0)
{
printf("PDB file name: %s \n", ModuleInfo.LoadedPdbName);
}
// Is debug information unmatched ?
// (It can only happen if the debug information is contained
// in a separate file (.DBG or .PDB)
if (ModuleInfo.PdbUnmatched || ModuleInfo.DbgUnmatched)
{
printf("Warning: Unmatched symbols. \n");
}
// Contents
// Line numbers available ?
printf("Line numbers: %s \n", ModuleInfo.LineNumbers ? "Available" : "Not available");
// Global symbols available ?
printf("Global symbols: %s \n", ModuleInfo.GlobalSymbols ? "Available" : "Not available");
// Type information available ?
printf("Type information: %s \n", ModuleInfo.TypeInfo ? "Available" : "Not available");
// Source indexing available ?
printf("Source indexing: %s \n", ModuleInfo.SourceIndexed ? "Yes" : "No");
// Public symbols available ?
printf("Public symbols: %s \n", ModuleInfo.Publics ? "Available" : "Not available");
}
#endif

66
SymbolsFromPDB/Src/SymbolsHandler.h
View file

@ -1,66 +0,0 @@
/*
#####################
# MoHieDDiNNe Codes #
#####################
*/
#pragma once
///////////////////////////////////////////////////////////////////////////////
//
// some of the following functions are imported made by:
//
// Author: Oleg Starodumov
// https://www.debuginfo.com/examples/dbghelpexamples.html
//
#include "DataStructs.h"
#include <dbghelp.h>
#pragma comment( lib, "dbghelp.lib" )
#ifdef UNICODE
#define NTOSKRNL_PATH L".\\Tools\\Symbols\\ntkrnlmp.pdb"
#define WDFILTER_PATH L".\\Tools\\Symbols\\WdFilter.pdb"
#define CIDLL_PATH L".\\Tools\\Symbols\\ci.pdb"
#define SYM_OFFSETS_PATH L"SymbolsOffset.txt"
#define PATH_TYPE PCWSTR
#else
#define NTOSKRNL_PATH ".\\Tools\\Symbols\\ntkrnlmp.pdb"
#define WDFILTER_PATH ".\\Tools\\Symbols\\WdFilter.pdb"
#define CIDLL_PATH ".\\Tools\\Symbols\\ci.pdb"
#define FUNCOFFSET_PATH "SymbolsOffset.txt"
#define PATH_TYPE PCSTR
#endif
BOOLEAN GenerateOffsetFile(
void
);
BOOLEAN InitKernelSymbolsList(
IN PATH_TYPE FilePath,
IN OUT PSYM_INFO_ARRAY pSymbolsArray
);
BOOLEAN GetFileParams(IN
PATH_TYPE pFileName,
OUT uintptr_t* BaseAddr,
OUT DWORD* FileSize
);
BOOLEAN _GetFileSize(
IN PATH_TYPE pFileName,
OUT DWORD* FileSize
);
#ifndef NDEBUG
void ShowSymbolInfo(
IN uintptr_t ModBase
);
#endif

20
SymbolsFromPDB/Src/main.c
View file

@ -1,20 +0,0 @@
#include "SymbolsHandler.h"
int main()
{
if (system("\"\"%cd%\"\\Tools\\SymCheck.bat\"") != 0)
{
printf("\nSymCheck.bat Hash Failed.\n\n");
system("pause");
return -1;
}
if(!GenerateOffsetFile())
{
system("pause");
return -1;
}
printf("\n>> Successfully Generated Offsets File. <<\n\n");
return 0;
}

8
SymbolsFromPDB/SymbolsFromPDB.vcxproj
View file

@ -92,13 +92,11 @@
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="Src\main.c" />
<ClCompile Include="Src\SymbolsHandler.c" />
<ClCompile Include="SimplestSymbolHandler.cpp" />
<ClCompile Include="main.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="Src\DataStructs.h" />
<ClInclude Include="Src\Defines.h" />
<ClInclude Include="Src\SymbolsHandler.h" />
<ClInclude Include="SimplestSymbolHandler.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">

12
SymbolsFromPDB/SymbolsFromPDB.vcxproj.filters
View file

@ -15,21 +15,15 @@
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="Src\main.c">
<ClCompile Include="main.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="Src\SymbolsHandler.c">
<ClCompile Include="SimplestSymbolHandler.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="Src\SymbolsHandler.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="Src\Defines.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="Src\DataStructs.h">
<ClInclude Include="SimplestSymbolHandler.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>

91
SymbolsFromPDB/main.cpp Normal file
View file

@ -0,0 +1,91 @@
//TheCruZ Remake
#include <windows.h>
#include <vector>
#include <string>
#include <filesystem>
#include <iostream>
#include <fstream>
#include "SimplestSymbolHandler.h"
std::wstring GetCurrentAppFolder() {
wchar_t buffer[1024];
GetModuleFileNameW(NULL, buffer, 1024);
std::wstring::size_type pos = std::wstring(buffer).find_last_of(L"\\/");
return std::wstring(buffer).substr(0, pos);
}
int main()
{
std::vector<std::wstring> targetBinaries = {
L"C:\\Windows\\System32\\ntoskrnl.exe",
L"C:\\Windows\\System32\\ci.dll"
};
if (std::filesystem::exists(L"C:\\Windows\\System32\\drivers\\WdFilter.sys")) {
targetBinaries.push_back(L"C:\\Windows\\System32\\drivers\\WdFilter.sys");
}
else if (std::filesystem::exists(L"C:\\Windows\\System32\\drivers\\wd\\WdFilter.sys")) {
targetBinaries.push_back(L"C:\\Windows\\System32\\drivers\\wd\\WdFilter.sys");
}
else {
std::cout << "[-] Error: WdFilter.sys not found." << std::endl;
return -1;
}
std::vector<SymNeeded> symbolsToRetrieve{
{ L"ntoskrnl.exe", L"MmAllocateIndependentPagesEx" },
{ L"ntoskrnl.exe", L"MmFreeIndependentPages" },
{ L"ntoskrnl.exe", L"PiDDBLock" },
{ L"ntoskrnl.exe", L"PiDDBCacheTable" },
{ L"ntoskrnl.exe", L"MmSetPageProtection" },
{ L"WdFilter.sys", L"MpBmDocOpenRules" },
{ L"WdFilter.sys", L"MpFreeDriverInfoEx" },
{ L"ci.dll", L"g_KernelHashBucketList" },
{ L"ci.dll", L"g_HashCacheLock" },
};
SimplestSymbolHandler handler(GetCurrentAppFolder() + L"\\Symbols");
for (const auto& binPath : targetBinaries) {
auto pdbPath = handler.GetPDB(binPath);
if (pdbPath.empty()) {
std::wcout << L"[-] Failed to get symbol for " << binPath << std::endl;
return -1;
}
std::vector<std::wstring> symbolsForThisFile{};
for (const auto& sym : symbolsToRetrieve) {
if (binPath.find(sym.binaryName) == std::wstring::npos) {
continue;
}
symbolsForThisFile.push_back(sym.symbolName);
}
auto offsets = handler.GetOffset(pdbPath, symbolsForThisFile);
if (offsets.size() != symbolsForThisFile.size()) {
std::wcout << L"[-] Failed to get offsets for " << binPath << std::endl;
return -1;
}
// Save as init format in offsets.ini
std::wofstream ofs(GetCurrentAppFolder() + L"\\offsets.ini", std::ofstream::out | std::ofstream::app);
if (!ofs.is_open()) {
std::wcout << L"[-] Failed to open offsets.ini" << std::endl;
return -1;
}
auto filename = std::filesystem::path(binPath).filename().wstring();
ofs << L"[" << filename << L"]" << std::endl;
for (size_t i = 0; i < symbolsForThisFile.size(); i++) {
ofs << symbolsForThisFile[i] << L"=" << std::dec << offsets[i] << std::endl;
}
ofs << std::endl;
}
return 0;
}

104
Tools/SymCheck.bat
View file

@ -1,104 +0,0 @@
@ECHO OFF
SETLOCAL
set SymCheck="%cd%"\Tools\SymChk\symchk.exe
set SymbolsDir="%cd%"\Tools\Symbols\
set MS_Files=%SymbolsDir%MS_Files\
set "PDB_Files[0]=ntkrnlmp.pdb"
set "PDB_Files[1]=WdFilter.pdb"
set "PDB_Files[2]=ci.pdb"
set "FilesPath[0]=%systemroot%\System32\ntoskrnl.exe"
set "FilesPath[1]=%systemroot%\System32\drivers\wd\WdFilter.sys"
if not exist %FilesPath[1]% (
set "FilesPath[1]=%systemroot%\System32\drivers\WdFilter.sys"
)
set "FilesPath[2]=%systemroot%\System32\ci.dll"
set /a "Index=0"
:for_loop
call set Path=%%FilesPath[%Index%]%%
echo #################################
echo Getting Symbols For %Path%...
%SymCheck% /r %Path% /s SRV*%MS_Files%*http://msdl.microsoft.com/download/symbols
echo #################################
if %ERRORLEVEL% NEQ 0 (
exit %ERRORLEVEL%
)
call set Target=%%PDB_Files[%Index%]%%
dir /b /s %MS_Files%%Target%\ > fileslist.txt
if %ERRORLEVEL% NEQ 0 (
exit %ERRORLEVEL%
)
setlocal EnableDelayedExpansion
set /a "Line=0"
set "Paths[0]=crap"
for /f "tokens=* delims=" %%i in (fileslist.txt) do (
if !Line! GTR 1 (
echo #################################
echo Symbols Conflict Deleting %MS_Files%%Target% And Retrying
echo #################################
rmdir /s /q %MS_Files%%Target%
if %ERRORLEVEL% NEQ 0 (
pause
exit %ERRORLEVEL%
)
if exist %SymbolsDir%%Target% (
del %SymbolsDir%%Target%
if %ERRORLEVEL% NEQ 0 (
pause
exit %ERRORLEVEL%
)
)
goto for_loop
)
set "Paths[!Line!]="%%i""
set /a "Line+=1"
)
del fileslist.txt
if %ERRORLEVEL% NEQ 0 (
exit %ERRORLEVEL%
)
set SymPath=%Paths[1]%
if not exist %SymPath% (
echo #################################
echo - Symbols File Does Not Exist: %SymPath%
echo - Warning: If You Force The Software To Run Your PC Will Crash
echo #################################
if exist %SymbolsDir%%Target% (del "%SymbolsDir%%Target%")
pause
exit -1
)
if not exist %SymbolsDir%%Target% (
echo copying %SymPath% to "%SymbolsDir%
%systemroot%\System32\xcopy /q/y %SymPath% %SymbolsDir%
if not exist %SymbolsDir%%Target% (
echo #################################
echo - Failed To Copy PDB File: %Target%
echo - Warning: If You Force The Software To Run Your PC Will Crash
echo #################################
pause
exit -1
)
)
set /a "Index+=1"
if not defined PDB_Files[!Index!] goto exit_for_loop
goto for_loop
:exit_for_loop
echo #################################
echo Batch Script Done!
echo #################################
ENDLOCAL
::pause
exit %ERRORLEVEL%

BIN
Tools/SymChk/SymbolCheck.dll
View file

Binary file not shown.

BIN
Tools/SymChk/symchk.exe
View file

Binary file not shown.

82
kdmapper/KDSymbolsHandler.cpp Normal file
View file

@ -0,0 +1,82 @@
#include "KDSymbolsHandler.h"
//for use in KDMapper
#ifdef PDB_OFFSETS
#include <string>
#include <vector>
#include <filesystem>
#include <fstream>
#include <iostream>
#include "utils.hpp"
bool KDSymbolsHandler::ReloadFile(std::wstring path, std::wstring updater) {
symbols.clear();
if (updater.empty() && !std::filesystem::exists(path) ||
!updater.empty() && !std::filesystem::exists(updater)) {
std::wcout << L"[-] Offsets file (" << path << L") or updater (" << updater << L") not found" << std::endl;
return false;
}
if (!updater.empty()) {
path = utils::GetCurrentAppFolder() + L"\\offsets.ini"; //default name if update is requested
//delete old file
std::filesystem::remove(path);
std::string cmd = "\"" + std::string(updater.begin(), updater.end()) + "\"";
auto exitCode = system(cmd.c_str());
if (exitCode != 0) {
std::wcout << L"[-] Failed to update offsets" << std::endl;
return false;
}
}
//load file with ini format
std::wifstream file(path);
if (!file.is_open()) {
std::wcout << L"[-] Failed to open offsets file" << std::endl;
return false;
}
std::wstring line;
std::wstring currentSection;
while (std::getline(file, line)) {
if (line.empty() || line[0] == L';' || line[0] == L'#') {
continue;
}
if (line[0] == L'[') {
currentSection = line.substr(1, line.size() - 2);
continue;
}
auto pos = line.find(L'=');
if (pos == std::wstring::npos) {
continue;
}
auto name = line.substr(0, pos);
auto offset = line.substr(pos + 1);
symOffset sym{};
sym.name = name;
sym.offset = std::stoull(offset, nullptr, 10);
std::wcout << L"[+] Loaded " << currentSection << L" - " << sym.name << L" - 0x" << std::hex << sym.offset << std::endl;
symbols.push_back(sym);
}
std::wcout << L"[+] " << symbols.size() << L" Symbols Loaded" << std::endl;
return true;
}
unsigned long long KDSymbolsHandler::GetOffset(std::wstring name) {
for (auto sym : symbols) {
if (sym.name == name) {
return sym.offset;
}
}
return 0;
}
#endif

197
kdmapper/SymbolsHandler.cpp
View file

@ -1,197 +0,0 @@
#include "SymbolsHandler.hpp"
//for use in KDMapper
#ifdef PDB_OFFSETS
std::vector<SYM_INFO> SymbolsInfoArray{};
PTCHAR SymbolsOffsetFilePath = NULL;
inline DWORD Crc32Str(IN PCSTR Str)
{
if (!Str)
return 0;
DWORD Crc32 = 0;
size_t Index = 0;
while (*(Str + Index))
{
Crc32 = _mm_crc32_u8(Crc32, *(Str + Index));
++Index;
}
return Crc32;
}
BOOL GetSymbolsInfoFromFile(OUT std::vector<SYM_INFO> *pSymInfoArray, IN OPTIONAL bool UpdateOffsetsFile)
{
if (!pSymInfoArray)
{
printf("[-] Error: SymInfoArray Ptr is NULL.\n");
return FALSE;
}
pSymInfoArray->clear();
HANDLE hFile;
bool Failed = false;
do {
if (SymbolsOffsetFilePath)
{
hFile = CreateFile(SymbolsOffsetFilePath, GENERIC_READ, FILE_SHARE_READ,
NULL, OPEN_EXISTING, 0, NULL);
break;
}
RetryGeneratingFile:
if (Failed || UpdateOffsetsFile)
{
printf("[+] Generating Default Offsets File\n");
if (system(SYM_FROM_PDB_EXE) != 0)
{
printf("[-] Failed To Generate Symbols Offset File.\n");
return FALSE;
}
}
TryDefault:
hFile = CreateFile(SYM_OFFSETS_PATH, GENERIC_READ, FILE_SHARE_READ,
NULL, OPEN_EXISTING, 0, NULL);
} while (0);
if (!hFile || hFile == INVALID_HANDLE_VALUE)
{
if (!Failed)
{
if (SymbolsOffsetFilePath)
{
printf("[>] Warning: The Supplied File Path Is Invalid --> Switching To Default Offsets File.\n");
SymbolsOffsetFilePath = NULL;//Reset The Global Path Variable
goto TryDefault;
}
printf("[>] Warning: Failed To Access Default Offsets File --> Default File Is Not Valid.\n");
Failed = true;
goto RetryGeneratingFile;
}
#ifdef UNICODE
printf(("[-] Failed To Open Offsets File: %ls.\n-> Error: %u \n"), SYM_OFFSETS_PATH, GetLastError());
#else
printf(("[-] Failed To Open Offsets File: %s.\n-> Error: %u \n"), FUNCOFFSET_PATH, GetLastError());
#endif
return FALSE;
}
DWORD FileSize = GetFileSize(hFile, NULL);
if (!FileSize)
{
printf("[-] Error: Offset File Is Empty.\n");
CloseHandle(hFile);
return FALSE;
}
std::unique_ptr<char> BufferLocalPtr(new char[FileSize]);
PCHAR Buffer = BufferLocalPtr.get();
if (!Buffer)
{
printf("[-] Error: Failed To Allocate Memory For Offsets File Buffer.\n");
CloseHandle(hFile);
return FALSE;
}
BOOL IsRead = ReadFile(hFile, Buffer, FileSize, NULL, NULL);
CloseHandle(hFile);
if (!IsRead)
{
printf("[-] Error: Failed To Read Data From Offsets File.\n");
return FALSE;
}
SIZE_T Index = 0;
SIZE_T LinesCount = 0;
do {
if (Buffer[Index] == '\n')
{
++LinesCount;
}
++Index;
} while (Index < FileSize);
if (!LinesCount)
{
printf("[-] Error: Failed To Get Lines Count In Offsets File.\n");
return FALSE;
}
pSymInfoArray->reserve(LinesCount);
Index = 0;
SIZE_T Count = 0;
SIZE_T Line = 0;
SIZE_T CommaCount = 0;
SYM_INFO SymInfo;
do {
if (Buffer[Index] == ',')
{
std::string SymName(&Buffer[Index - Count], &Buffer[Index]);
SymInfo.Crc32Hash = Crc32Str(SymName.c_str());
Count = 0;
++CommaCount;
}
else if (Buffer[Index] == '\n')
{
Buffer[Index] = '\0';
DWORD Offset = NULL;
sscanf_s((PCSTR)(Buffer + Index - Count), "0x%X", &Offset);
SymInfo.SymbolOffset = Offset;
pSymInfoArray->emplace_back(SymInfo);
SymInfo.Crc32Hash = 0;
SymInfo.Crc32Hash = 0;
++Line;
Count = 0;
}
else
{
if (Count > MAX_SYM_NAME_LENGTH)
{
printf("Error: Max Symbol Length Exceeded.\n");
return FALSE;
}
++Count;
}
++Index;
} while (Index < FileSize);
if (!Line || (Line != CommaCount) || (Index != FileSize))
{
return FALSE;
}
return TRUE;
}
DWORD GetSymbolOffsetByHash(IN const std::vector<SYM_INFO>& SymInfoArray, IN DWORD SymHash)
{
if (SymInfoArray.empty() || !SymHash)
{
printf("[-] Error: Invalid Parameter.\n");
return 0;
}
for (SYM_INFO SymInfo:SymInfoArray)
{
if (SymInfo.Crc32Hash == SymHash)
{
return SymInfo.SymbolOffset;
}
}
return 0;
}
DWORD GetSymbolOffsetByName(IN const std::vector<SYM_INFO>& SymInfoArray, IN const std::string& SymName)
{
DWORD Hash = Crc32Str(SymName.c_str());
return GetSymbolOffsetByHash(SymInfoArray, Hash);
}
#endif

25
kdmapper/include/DataStructs.hpp
View file

@ -1,25 +0,0 @@
/*
#####################
# MoHieDDiNNe Codes #
#####################
*/
//for use in KDMapper
#pragma once
#define Elements_Count(Array,Type) (sizeof(Array) / sizeof(Type))
typedef struct _SYM_INFO
{
//PCSTR SymbolName;
DWORD SymbolOffset;
DWORD Crc32Hash;
}SYM_INFO, * PSYM_INFO;
//typedef struct SYM_INFO_ARRAY
//{
// PSYM_INFO SymbolsArray;
// SIZE_T ElementsCount;
//}SYM_INFO_ARRAY, * PSYM_INFO_ARRAY;

35
kdmapper/include/KDSymbolsHandler.h Normal file
View file

@ -0,0 +1,35 @@
//TheCruZ Remake
#ifdef PDB_OFFSETS
#include <string>
#include <vector>
#define SYM_FROM_PDB_EXE L"SymbolsFromPDB.exe"
struct symOffset {
unsigned long long offset{};
std::wstring name{};
};
class KDSymbolsHandler
{
public:
KDSymbolsHandler() {
};
static KDSymbolsHandler* GetInstance()
{
static KDSymbolsHandler instance{};
return &instance;
}
bool ReloadFile(std::wstring path, std::wstring updater);
unsigned long long GetOffset(std::wstring name);
private:
std::vector<symOffset> symbols{};
};
#endif

111
kdmapper/include/SymbolsHandler.hpp
View file

@ -1,111 +0,0 @@
/*
#####################
# MoHieDDiNNe Codes #
#####################
*/
//for use in KDMapper
#pragma once
#include <iostream>
#include <vector>
#include <stdio.h>
#include <intrin.h>
#include <Windows.h>//probably already included somewhere
#include "DataStructs.hpp"
///////////////////////////////////
//This macro is used to enable the use of the SymbolsHandler functions,if for any reasons you don't want to use PDB Offsets, you can still use the original method of sig scanning the kernel to get the target addresses
///*#####################*/
//#define PDB_OFFSETS
///*#####################*/
///////////////////////////////////
#ifdef PDB_OFFSETS
///////////////////////
//macro defines
#define MAX_SYM_NAME_LENGTH (DWORD)50 //could be increased if some symbols name are over 50 characters
#ifdef DEBUG
#ifdef UNICODE
#define SYM_OFFSETS_PATH (PCWSTR)L"..\\Bin\\SymbolsOffset.txt"
#else
#define SYM_OFFSETS_PATH (PCSTR)"..\\Bin\\SymbolsOffset.txt"
#endif
#else
#ifdef UNICODE
#define SYM_OFFSETS_PATH (PCWSTR)L".\\SymbolsOffset.txt"
#else
#define SYM_OFFSETS_PATH (PCSTR)".\\SymbolsOffset.txt"
#endif
#endif
#ifdef DEBUG
#define SYM_FROM_PDB_EXE (PCSTR)"cd ..\\Bin\\ && SymbolsFromPDB_Debug.exe"
#else
#define SYM_FROM_PDB_EXE (PCSTR)"SymbolsFromPDB.exe"
#endif
///////////////////////
extern std::vector<SYM_INFO> SymbolsInfoArray;
extern PTCHAR SymbolsOffsetFilePath;
inline DWORD Crc32Str(
IN PCSTR Str
);
BOOL GetSymbolsInfoFromFile(
OUT std::vector<SYM_INFO>* pSymInfoArray,
IN OPTIONAL bool UpdateOffsetsFile = true
);
DWORD GetSymbolOffsetByHash(
IN const std::vector<SYM_INFO>& pSymInfoArray,
IN DWORD SymHash
);
DWORD GetSymbolOffsetByName(
IN const std::vector<SYM_INFO>& pSymInfoArray,
IN const std::string& SymName
);
//just need this class to init the Symbols Info Array and clear it after main is done (usage of RAII).
class CSymInfo
{
std::vector<SYM_INFO>* m_pSymInfoArray{};
public:
bool m_IsValid = false;
public:
CSymInfo(std::vector<SYM_INFO> *pSymInfoArray)
{
m_IsValid = GetSymbolsInfoFromFile(pSymInfoArray);
if(m_IsValid)
{
m_pSymInfoArray = pSymInfoArray;
}
}
CSymInfo(std::vector<SYM_INFO>* pSymInfoArray ,const bool UpdateOffsetsFile)
{
m_IsValid = GetSymbolsInfoFromFile(pSymInfoArray, UpdateOffsetsFile);
if (m_IsValid)
{
m_pSymInfoArray = pSymInfoArray;
}
}
~CSymInfo()
{
if (m_pSymInfoArray)
m_pSymInfoArray->clear();
}
};
#endif

5
kdmapper/include/utils.hpp
View file

@ -16,9 +16,7 @@
#include <fstream>
#include "nt.hpp"
#ifdef PDB_OFFSETS
#include "SymbolsHandler.hpp"
#endif
namespace utils
{
@ -29,4 +27,5 @@ namespace utils
BOOLEAN bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask);
uintptr_t FindPattern(uintptr_t dwAddress, uintptr_t dwLen, BYTE* bMask, const char* szMask);
PVOID FindSection(const char* sectionName, uintptr_t modulePtr, PULONG size);
std::wstring GetCurrentAppFolder();
}

22
kdmapper/intel_driver.cpp
View file

@ -1,5 +1,9 @@
#include "intel_driver.hpp"
#ifdef PDB_OFFSETS
#include "KDSymbolsHandler.h"
#endif
ULONG64 intel_driver::ntoskrnlAddr = 0;
char intel_driver::driver_name[100] = {};
@ -153,7 +157,7 @@ bool intel_driver::ClearWdFilterDriverList(HANDLE device_handle) {
}
#ifdef PDB_OFFSETS
uintptr_t MpBmDocOpenRules = GetSymbolOffsetByName(SymbolsInfoArray, "MpBmDocOpenRules");
uintptr_t MpBmDocOpenRules = KDSymbolsHandler::GetInstance()->GetOffset(L"MpBmDocOpenRules");
if (!MpBmDocOpenRules)
{
Log("[-] Failed To Get MpBmDocOpenRules." << std::endl);
@ -166,7 +170,7 @@ bool intel_driver::ClearWdFilterDriverList(HANDLE device_handle) {
uintptr_t RuntimeDriversArray = MpBmDocOpenRules + 0x68;
ReadMemory(device_handle, RuntimeDriversArray, &RuntimeDriversArray, sizeof(uintptr_t));
uintptr_t MpFreeDriverInfoEx = GetSymbolOffsetByName(SymbolsInfoArray,"MpFreeDriverInfoEx");
uintptr_t MpFreeDriverInfoEx = KDSymbolsHandler::GetInstance()->GetOffset(L"MpFreeDriverInfoEx");
if (!MpFreeDriverInfoEx)
{
Log("[-] Failed To Get MpFreeDriverInfoEx." << std::endl);
@ -457,7 +461,7 @@ uint64_t intel_driver::MmAllocateIndependentPagesEx(HANDLE device_handle, uint32
#ifdef PDB_OFFSETS
if (!kernel_MmAllocateIndependentPagesEx)
{
kernel_MmAllocateIndependentPagesEx = GetSymbolOffsetByName(SymbolsInfoArray,"MmAllocateIndependentPagesEx");
kernel_MmAllocateIndependentPagesEx = KDSymbolsHandler::GetInstance()->GetOffset(L"MmAllocateIndependentPagesEx");
if (!kernel_MmAllocateIndependentPagesEx) {
Log(L"[!] Failed to find MmAllocateIndependentPagesEx" << std::endl);
return 0;
@ -500,7 +504,7 @@ bool intel_driver::MmFreeIndependentPages(HANDLE device_handle, uint64_t address
if (!kernel_MmFreeIndependentPages)
{
#ifdef PDB_OFFSETS
kernel_MmFreeIndependentPages = GetSymbolOffsetByName(SymbolsInfoArray, "MmFreeIndependentPages");
kernel_MmFreeIndependentPages = KDSymbolsHandler::GetInstance()->GetOffset(L"MmFreeIndependentPages");
#else
kernel_MmFreeIndependentPages = intel_driver::FindPatternInSectionAtKernel(device_handle, "PAGE", intel_driver::ntoskrnlAddr,
(BYTE*)"\xBA\x00\x60\x00\x00\x48\x8B\xCB\xE8\x00\x00\x00\x00\x48\x8D\x8B\x00\xF0\xFF\xFF",
@ -538,7 +542,7 @@ BOOLEAN intel_driver::MmSetPageProtection(HANDLE device_handle, uint64_t address
if (!kernel_MmSetPageProtection)
{
#ifdef PDB_OFFSETS
kernel_MmSetPageProtection = GetSymbolOffsetByName(SymbolsInfoArray, "MmSetPageProtection");
kernel_MmSetPageProtection = KDSymbolsHandler::GetInstance()->GetOffset(L"MmSetPageProtection");
if (!kernel_MmSetPageProtection) {
Log(L"[!] Failed to find MmSetPageProtection" << std::endl);
return FALSE;
@ -850,14 +854,14 @@ intel_driver::PiDDBCacheEntry* intel_driver::LookupEntry(HANDLE device_handle, P
bool intel_driver::ClearPiDDBCacheTable(HANDLE device_handle) { //PiDDBCacheTable added on LoadDriver
#ifdef PDB_OFFSETS
DWORD PiDDBLockOffset = GetSymbolOffsetByName(SymbolsInfoArray, "PiDDBLock");
DWORD PiDDBLockOffset = KDSymbolsHandler::GetInstance()->GetOffset(L"PiDDBLock");
if (!PiDDBLockOffset)
{
Log(L"[-] Warning PiDDBLock not found" << std::endl);
return false;
}
DWORD PiDDBCacheTableOffset = GetSymbolOffsetByName(SymbolsInfoArray, "PiDDBCacheTable");
DWORD PiDDBCacheTableOffset = KDSymbolsHandler::GetInstance()->GetOffset(L"PiDDBCacheTable");
if (!PiDDBLockOffset)
{
Log(L"[-] Warning PiDDBCacheTable not found" << std::endl);
@ -1038,14 +1042,14 @@ bool intel_driver::ClearKernelHashBucketList(HANDLE device_handle) {
//Thanks @KDIo3 and @Swiftik from UnknownCheats
#ifdef PDB_OFFSETS
DWORD g_KernelHashBucketListOffset = GetSymbolOffsetByName(SymbolsInfoArray, "g_KernelHashBucketList");
DWORD g_KernelHashBucketListOffset = KDSymbolsHandler::GetInstance()->GetOffset(L"g_KernelHashBucketList");
if (!g_KernelHashBucketListOffset)
{
Log(L"[-] Can't Find g_KernelHashBucketList Offset" << std::endl);
return false;
}
DWORD g_HashCacheLockOffset = GetSymbolOffsetByName(SymbolsInfoArray, "g_HashCacheLock");
DWORD g_HashCacheLockOffset = KDSymbolsHandler::GetInstance()->GetOffset(L"g_HashCacheLock");
if (!g_KernelHashBucketListOffset)
{
Log(L"[-] Can't Find g_HashCacheLock Offset" << std::endl);

9
kdmapper/kdmapper.vcxproj
View file

@ -204,7 +204,7 @@
<UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
</Link>
<PostBuildEvent>
<Command>xcopy "$(SolutionDir)Tools" "$(SolutionDir)$(Platform)\$(Configuration)\Tools" /E /H /C /Y /I</Command>
<Command>xcopy "$(SolutionDir)DbgHelp\*" "$(SolutionDir)$(Platform)\$(Configuration)" /H /C /Y</Command>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='lib-Release|x64'">
@ -248,7 +248,7 @@
<UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
</Link>
<PostBuildEvent>
<Command>xcopy "$(SolutionDir)Tools" "$(SolutionDir)$(Platform)\lib\Tools" /E /H /C /Y /I</Command>
<Command>xcopy "$(SolutionDir)DbgHelp\*" "$(SolutionDir)$(Platform)\lib" /H /C /Y</Command>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemGroup>
@ -257,18 +257,17 @@
<ClCompile Include="kdmapper.cpp" />
<ClCompile Include="portable_executable.cpp" />
<ClCompile Include="service.cpp" />
<ClCompile Include="SymbolsHandler.cpp" />
<ClCompile Include="KDSymbolsHandler.cpp" />
<ClCompile Include="utils.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="include\DataStructs.hpp" />
<ClInclude Include="include\intel_driver.hpp" />
<ClInclude Include="include\intel_driver_resource.hpp" />
<ClInclude Include="include\kdmapper.hpp" />
<ClInclude Include="include\nt.hpp" />
<ClInclude Include="include\portable_executable.hpp" />
<ClInclude Include="include\service.hpp" />
<ClInclude Include="include\SymbolsHandler.hpp" />
<ClInclude Include="include\KDSymbolsHandler.h" />
<ClInclude Include="include\utils.hpp" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

7
kdmapper/kdmapper.vcxproj.filters
View file

@ -7,7 +7,7 @@
<ClCompile Include="portable_executable.cpp" />
<ClCompile Include="service.cpp" />
<ClCompile Include="utils.cpp" />
<ClCompile Include="SymbolsHandler.cpp" />
<ClCompile Include="KDSymbolsHandler.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="include\utils.hpp">
@ -31,8 +31,9 @@
<ClInclude Include="include\intel_driver_resource.hpp">
<Filter>include</Filter>
</ClInclude>
<ClInclude Include="include\SymbolsHandler.hpp" />
<ClInclude Include="include\DataStructs.hpp" />
<ClInclude Include="include\KDSymbolsHandler.h">
<Filter>include</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<Filter Include="include">

52
kdmapper/main.cpp
View file

@ -8,6 +8,10 @@
#include "kdmapper.hpp"
#ifdef PDB_OFFSETS
#include "KDSymbolsHandler.h"
#endif
HANDLE iqvw64e_device_handle;
@ -96,7 +100,7 @@ void PauseIfParentIsExplorer() {
void help() {
Log(L"\r\n\r\n[!] Incorrect Usage!" << std::endl);
#ifdef PDB_OFFSETS
Log(L"[+] Usage: kdmapper.exe [--DontUpdateOffset | --OffsetsPath \"FilePath\"][--free | --indPages][--PassAllocationPtr] driver" << std::endl);
Log(L"[+] Usage: kdmapper.exe [--dontUpdateOffsets [--offsetsPath \"FilePath\"]][--free | --indPages][--PassAllocationPtr] driver" << std::endl);
#else
Log(L"[+] Usage: kdmapper.exe [--free | --indPages][--PassAllocationPtr] driver" << std::endl);
#endif
@ -106,27 +110,6 @@ void help() {
int wmain(const int argc, wchar_t** argv) {
SetUnhandledExceptionFilter(SimplestCrashHandler);
#ifdef PDB_OFFSETS
bool UpdateOffset = !(paramExists(argc, argv, L"DontUpdateOffset") > 0);
int FilePathParamIdx = paramExists(argc, argv, L"OffsetsPath");
if (FilePathParamIdx > 0)
{
SymbolsOffsetFilePath = argv[FilePathParamIdx + 1];
#ifdef UNICODE
printf("[+] Setting Offsets File Path To: %ls\n", SymbolsOffsetFilePath);
#else
printf("[+] Setting Offsets File Path To: %s\n", SymbolsOffsetFilePath);
#endif
}
CSymInfo SymInfo(&SymbolsInfoArray, UpdateOffset);
if (!SymInfo.m_IsValid) {
Log(L"[-] Error: Failed To Get Symbols Info.\n");
PauseIfParentIsExplorer();
return -1;
}
#endif
bool free = paramExists(argc, argv, L"free") > 0;
bool indPagesMode = paramExists(argc, argv, L"indPages") > 0;
bool passAllocationPtr = paramExists(argc, argv, L"PassAllocationPtr") > 0;
@ -149,6 +132,23 @@ int wmain(const int argc, wchar_t** argv) {
Log(L"[+] Pass Allocation Ptr as first param enabled" << std::endl);
}
#ifdef PDB_OFFSETS
bool UpdateOffset = !(paramExists(argc, argv, L"dontUpdateOffsets") > 0);
int FilePathParamIdx = paramExists(argc, argv, L"offsetsPath");
std::wstring offsetFilePath = utils::GetCurrentAppFolder() + L"\\offsets.ini";
if (UpdateOffset && FilePathParamIdx > 0) {
Log("[-] Can't set --offsetsPath without set --dontUpdateOffsets" << std::endl);
help();
return -1;
}
if (FilePathParamIdx > 0) {
offsetFilePath = argv[FilePathParamIdx + 1];
Log("[+] Setting Offsets File Path To: " << offsetFilePath << std::endl);
}
#endif
int drvIndex = -1;
for (int i = 1; i < argc; i++) {
if (std::filesystem::path(argv[i]).extension().string().compare(".sys") == 0) {
@ -170,6 +170,14 @@ int wmain(const int argc, wchar_t** argv) {
return -1;
}
#ifdef PDB_OFFSETS
if (!KDSymbolsHandler::GetInstance()->ReloadFile(offsetFilePath, UpdateOffset ? utils::GetCurrentAppFolder() + L"\\" + SYM_FROM_PDB_EXE : L"")) {
Log(L"[-] Error: Failed To Get Symbols Info." << std::endl);
PauseIfParentIsExplorer();
return -1;
}
#endif
iqvw64e_device_handle = intel_driver::Load();
if (iqvw64e_device_handle == INVALID_HANDLE_VALUE) {

7
kdmapper/utils.cpp
View file

@ -110,4 +110,11 @@ PVOID utils::FindSection(const char* sectionName, uintptr_t modulePtr, PULONG si
}
}
return 0;
}
std::wstring utils::GetCurrentAppFolder() {
wchar_t buffer[1024];
GetModuleFileNameW(NULL, buffer, 1024);
std::wstring::size_type pos = std::wstring(buffer).find_last_of(L"\\/");
return std::wstring(buffer).substr(0, pos);
}