读取任意物理地址内容

Panel

今天碰到个问题，需要读取一块物理内存验证就写了这个小工具，有需要的自取一下

//R0
#include <ntifs.h>
#include <ntddk.h>
#include <wdmsec.h>
#define  _DEVICE_NAME L"\\device\\mydevice"
#define  _SYB_NAME   L"\\??\\sysmblicname"

#define CTL_CODE_BASE 0x8000
#define CTL_ALLCODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,CTL_CODE_BASE+i,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define  CTL_TALK   CTL_ALLCODE(1)

NTSTATUS DisPatchCreate(PDEVICE_OBJECT pDevice, PIRP pIrp)
{
    DbgPrint("创建成功\n");
    IoCompleteRequest(pIrp, 0);
    return STATUS_SUCCESS;
}

NTSTATUS ReadPhysicalMemory(PVOID addres)
{
    PHYSICAL_ADDRESS physicalAddress;
    PVOID mappedMemory;
    ULONG_PTR physicalMemoryOffset = addres;
    SIZE_T numberOfBytes = sizeof(ULONG); 

    physicalAddress.QuadPart = physicalMemoryOffset;

    mappedMemory = MmMapIoSpace(physicalAddress, numberOfBytes, MmNonCached);

    if (mappedMemory == NULL) {

        return STATUS_UNSUCCESSFUL;
    }

    ULONG value = *(PUCHAR)mappedMemory;

    for (size_t i = 0; i < 4; i++)
    {
        DbgPrint("Value at physical address 0x%llx: %x\n", physicalAddress.QuadPart, *((PUCHAR)mappedMemory+i));
    }

    MmUnmapIoSpace(mappedMemory, numberOfBytes);

    return STATUS_SUCCESS;
}

NTSTATUS DispatchControl(PDEVICE_OBJECT pDevice, PIRP pIrp)
{
    PVOID pBuff = pIrp->AssociatedIrp.SystemBuffer;
    PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
    ULONG CtlCode = pStack->Parameters.DeviceIoControl.IoControlCode;
    ULONG uLen = { 0 };
    uLen = strlen(pBuff);

    int addresss = *((int*)pBuff);

    switch (CtlCode)
    {
    case CTL_TALK:
    {
        DbgPrint("had connect\n");
        ReadPhysicalMemory(addresss);
        break;
    }
    default:
        break;
    }
    pIrp->IoStatus.Information = 0;
    pIrp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

VOID  UnloadDriver(PDRIVER_OBJECT pDriver)
{
    DbgPrint("卸载成功\n");
    if (pDriver->DeviceObject)
    {
        UNICODE_STRING uSymblicLinkname;
        RtlInitUnicodeString(&uSymblicLinkname, _SYB_NAME);
        IoDeleteSymbolicLink(&uSymblicLinkname);
        IoDeleteDevice(pDriver->DeviceObject);
    }
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegpath)
{

    DbgPrint("加载成功\n");
    pDriver->DriverUnload = UnloadDriver;
    UNICODE_STRING uDeviceName;
    UNICODE_STRING uSymbliclinkname;
    PDEVICE_OBJECT pDevice;
    RtlInitUnicodeString(&uDeviceName, _DEVICE_NAME);
    RtlInitUnicodeString(&uSymbliclinkname, _SYB_NAME);
    //IoCreateDevice(pDriver, 0, &uDeviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDevice);
    UNICODE_STRING sddl = RTL_CONSTANT_STRING(L"D:P(A;;GA;;;SY)(A;;GA;;;BA)");
    const GUID guidClassNPF = { 0x26e0d1e0L, 0x8189, 0x12e0, { 0x99, 0x14, 0x08, 0x00, 0x22, 0x30, 0x19, 0x04 } };
    NTSTATUS st =  IoCreateDeviceSecure(pDriver, 0, &uDeviceName, FILE_DEVICE_TRANSPORT,
        FILE_DEVICE_SECURE_OPEN, FALSE, &sddl, (LPCGUID)&guidClassNPF, &pDevice);

    if (!NT_SUCCESS(st))
    {
        DbgPrint("nonono\n");
    }
    else {
        DbgPrint("okokok\n");
    }

    IoCreateSymbolicLink(&uSymbliclinkname, &uDeviceName);
    pDevice->Flags &= ~DO_DEVICE_INITIALIZING;
    pDevice->Flags |= DO_BUFFERED_IO;
    pDriver->MajorFunction[IRP_MJ_CREATE] = DisPatchCreate;
    pDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchControl;
    return STATUS_SUCCESS;
}

//R3
#include <stdio.h>
#include <windows.h>
#define  _SYB_NAME   L"\\\\.\\sysmblicname"

#define CTL_CODE_BASE 0x8000
#define CTL_ALLCODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,CTL_CODE_BASE+i,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define  CTL_TALK   CTL_ALLCODE(1)

int main()
{
    HANDLE hDevice = CreateFile(_SYB_NAME, FILE_ALL_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (!hDevice)
    {
        printf("%x", GetLastError());
    }
    else
    {

        do
        {
            char inbuf[260] = { 0 };
            char outbuf[260] = { 0 };
            DWORD retlen = 0;
            printf("创建成功\n");
            printf("input:");
            scanf_s("%d", outbuf);
            int flag = DeviceIoControl(hDevice, CTL_TALK, outbuf, sizeof(outbuf), inbuf, 1, &retlen, NULL);
            if (!flag)
            {
                printf("控制码通信失败");
                printf("%d\n", GetLastError());
                getchar();
            }
        } while (1);

    }
    getchar();
}

bailexi

谢谢@Thanks！

流泪的小白

感谢分享

abc135246

感谢分享

cn2jp

C玩的好啊，我就学不会

Light紫星

需要配合r0驱动，难编译

nanaqilin

Light紫星 发表于 2024-2-27 10:46
需要配合r0驱动，难编译

驱动层代码你得下载个VS的开发包，然后才能编译，直接编译肯定是不行的

xiaoysm

感谢分享，谢谢

SinkerYZW

非常有用

tomcat117853

非常有用