// LibUsageExample // Check project properties -> VC++ Directories -> Include Directories // Check project properties -> VC++ Directories -> Library Directories // Check project properties -> Linker -> Input -> Additional Dependencies // #include #include #include #include #include HANDLE iqvw64e_device_handle; LONG WINAPI SimplestCrashHandler(EXCEPTION_POINTERS* ExceptionInfo) { if (ExceptionInfo && ExceptionInfo->ExceptionRecord) Log(L"[!!] Crash at addr 0x" << ExceptionInfo->ExceptionRecord->ExceptionAddress << L" by 0x" << std::hex << ExceptionInfo->ExceptionRecord->ExceptionCode << std::endl); else Log(L"[!!] Crash" << std::endl); if (iqvw64e_device_handle) intel_driver::Unload(iqvw64e_device_handle); return EXCEPTION_EXECUTE_HANDLER; } int paramExists(const int argc, wchar_t** argv, const wchar_t* param) { size_t plen = wcslen(param); for (int i = 1; i < argc; i++) { if (wcslen(argv[i]) == plen + 1ull && _wcsicmp(&argv[i][1], param) == 0 && argv[i][0] == '/') { // with slash return i; } else if (wcslen(argv[i]) == plen + 2ull && _wcsicmp(&argv[i][2], param) == 0 && argv[i][0] == '-' && argv[i][1] == '-') { // with double dash return i; } } return -1; } void help() { Log(L"\r\n\r\n[!] Incorrect Usage!" << std::endl); Log(L"[+] Usage: kdmapper.exe [--free][--mdl][--PassAllocationPtr] driver" << std::endl); } bool callbackExample(ULONG64* param1, ULONG64* param2, ULONG64 allocationPtr, ULONG64 allocationSize, ULONG64 mdlptr) { UNREFERENCED_PARAMETER(param1); UNREFERENCED_PARAMETER(param2); UNREFERENCED_PARAMETER(allocationPtr); UNREFERENCED_PARAMETER(allocationSize); UNREFERENCED_PARAMETER(mdlptr); Log("[+] Callback example called" << std::endl); /* This callback occurs before call driver entry and can be usefull to pass more customized params in the last step of the mapping procedure since you know now the mapping address and other things */ return true; } int wmain(const int argc, wchar_t** argv) { SetUnhandledExceptionFilter(SimplestCrashHandler); bool free = paramExists(argc, argv, L"free") > 0; bool mdlMode = paramExists(argc, argv, L"mdl") > 0; bool indPagesMode = paramExists(argc, argv, L"indPages") > 0; bool passAllocationPtr = paramExists(argc, argv, L"PassAllocationPtr") > 0; if (free) { Log(L"[+] Free pool memory after usage enabled" << std::endl); } if (mdlMode) { Log(L"[+] Mdl memory usage enabled" << std::endl); } if (indPagesMode) { Log(L"[+] Allocate Independent Pages mode enabled" << std::endl); } if (passAllocationPtr) { Log(L"[+] Pass Allocation Ptr as first param enabled" << std::endl); } int drvIndex = -1; for (int i = 1; i < argc; i++) { if (std::filesystem::path(argv[i]).extension().string().compare(".sys") == 0) { drvIndex = i; break; } } if (drvIndex <= 0) { help(); return -1; } const std::wstring driver_path = argv[drvIndex]; if (!std::filesystem::exists(driver_path)) { Log(L"[-] File " << driver_path << L" doesn't exist" << std::endl); return -1; } iqvw64e_device_handle = intel_driver::Load(); if (iqvw64e_device_handle == INVALID_HANDLE_VALUE) return -1; std::vector raw_image = { 0 }; if (!utils::ReadFileToMemory(driver_path, &raw_image)) { Log(L"[-] Failed to read image to memory" << std::endl); intel_driver::Unload(iqvw64e_device_handle); return -1; } kdmapper::AllocationMode mode = kdmapper::AllocationMode::AllocatePool; if (mdlMode && indPagesMode) { Log(L"[-] Too many allocation modes" << std::endl); intel_driver::Unload(iqvw64e_device_handle); return -1; } else if (mdlMode) { mode = kdmapper::AllocationMode::AllocateMdl; } else if (indPagesMode) { mode = kdmapper::AllocationMode::AllocateIndependentPages; } NTSTATUS exitCode = 0; if (!kdmapper::MapDriver(iqvw64e_device_handle, raw_image.data(), 0, 0, free, true, mode, passAllocationPtr, callbackExample, &exitCode)) { Log(L"[-] Failed to map " << driver_path << std::endl); intel_driver::Unload(iqvw64e_device_handle); return -1; } if (!intel_driver::Unload(iqvw64e_device_handle)) { Log(L"[-] Warning failed to fully unload vulnerable driver " << std::endl); } Log(L"[+] success" << std::endl); }