Something went wrong. Try again.
Reactos
Something went wrong. Try again.
6.9 kB · 276 lines
C
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277#include "DriverTester.h"
static BOOLSetPrivilege(BOOL bSet){ TOKEN_PRIVILEGES tp; HANDLE hToken; LUID luid;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) { return FALSE; }
if(!LookupPrivilegeValue(NULL, SE_LOAD_DRIVER_NAME, &luid)) { CloseHandle(hToken); return FALSE; }
tp.PrivilegeCount = 1; tp.Privileges[0].Luid = luid;
if (bSet) { tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; } else { tp.Privileges[0].Attributes = 0; }
AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL); if (GetLastError() != ERROR_SUCCESS) { CloseHandle(hToken); return FALSE; }
CloseHandle(hToken);
return TRUE;}
BOOLConvertPath(LPCWSTR lpPath, LPWSTR lpDevice){ LPWSTR lpFullPath = NULL; DWORD size;
if (lpPath) { size = GetLongPathNameW(lpPath, 0, 0); if (!size) return FALSE;
size = (size + 1) * sizeof(WCHAR);
lpFullPath = HeapAlloc(GetProcessHeap(), 0, size); if (!lpFullPath) return FALSE;
if (GetLongPathNameW(lpPath, lpFullPath, size)) { HANDLE hDevice; POBJECT_NAME_INFORMATION pObjName; NTSTATUS Status; DWORD len;
hDevice = CreateFileW(lpFullPath, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
HeapFree(GetProcessHeap(), 0, lpFullPath);
if(hDevice == INVALID_HANDLE_VALUE) { wprintf(L"[%x] Failed to open %s\n", GetLastError(), DRIVER_NAME); return FALSE; }
size = MAX_PATH * sizeof(WCHAR); pObjName = HeapAlloc(GetProcessHeap(), 0, size); if (!pObjName) return FALSE;
Status = NtQueryObject(hDevice, ObjectNameInformation, pObjName, size, &size); if (Status == STATUS_SUCCESS) { len = pObjName->Name.Length / sizeof(WCHAR); wcsncpy(lpDevice, pObjName->Name.Buffer, len); lpDevice[len] = UNICODE_NULL;
HeapFree(GetProcessHeap(), 0, pObjName);
return TRUE; }
HeapFree(GetProcessHeap(), 0, pObjName); } }
return FALSE;}
BOOLNtStartDriver(LPCWSTR lpService){ WCHAR szDriverPath[MAX_PATH]; UNICODE_STRING DriverPath; NTSTATUS Status = -1;
wcscpy(szDriverPath, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\"); wcscat(szDriverPath, lpService);
RtlInitUnicodeString(&DriverPath, szDriverPath);
if (SetPrivilege(TRUE)) { Status = NtLoadDriver(&DriverPath); if (Status != STATUS_SUCCESS) { DWORD err = RtlNtStatusToDosError(Status); wprintf(L"NtUnloadDriver failed [%lu]\n", err); }
SetPrivilege(FALSE); }
return (Status == STATUS_SUCCESS);}
BOOLNtStopDriver(LPCWSTR lpService){ WCHAR szDriverPath[MAX_PATH]; UNICODE_STRING DriverPath; NTSTATUS Status = -1;
wcscpy(szDriverPath, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\"); wcscat(szDriverPath, lpService);
RtlInitUnicodeString(&DriverPath, szDriverPath);
if (SetPrivilege(TRUE)) { Status = NtUnloadDriver(&DriverPath); if (Status != STATUS_SUCCESS) { DWORD err = RtlNtStatusToDosError(Status); wprintf(L"NtUnloadDriver failed [%lu]\n", err); }
SetPrivilege(FALSE); }
return (Status == STATUS_SUCCESS);}
//// We shouldn't be able to call this from umode.// Returns true if//BOOLLoadVia_SystemLoadGdiDriverInformation(LPWSTR lpDriverPath){ NTSTATUS Status; SYSTEM_GDI_DRIVER_INFORMATION Buffer; DWORD bufSize;
bufSize = sizeof(SYSTEM_GDI_DRIVER_INFORMATION);
ZeroMemory(&Buffer, bufSize); RtlInitUnicodeString(&Buffer.DriverName, lpDriverPath);
if (SetPrivilege(TRUE)) { Status = NtSetSystemInformation(SystemLoadGdiDriverInformation, &Buffer, bufSize); if (Status == STATUS_PRIVILEGE_NOT_HELD) { wprintf(L"SystemLoadGdiDriverInformation can only be used in kmode.\n"); } else if (Status == STATUS_SUCCESS) { wprintf(L"SystemLoadGdiDriverInformation incorrectly loaded the driver\n"); NtUnloadDriver(&Buffer.DriverName);
return TRUE; } else { DWORD err = RtlNtStatusToDosError(Status); wprintf(L"LoadVia_SystemLoadGdiDriverInformation failed [%lu]\n", err); }
SetPrivilege(FALSE); }
return FALSE;}
BOOLLoadVia_SystemExtendServiceTableInformation(LPWSTR lpDriverPath){ NTSTATUS Status; UNICODE_STRING Buffer; DWORD bufSize;
RtlInitUnicodeString(&Buffer, lpDriverPath); bufSize = sizeof(UNICODE_STRING);
if (SetPrivilege(TRUE)) { Status = NtSetSystemInformation(SystemExtendServiceTableInformation, &Buffer, bufSize); if (Status == STATUS_PRIVILEGE_NOT_HELD) { wprintf(L"SystemExtendServiceTableInformation can only be used in kmode.\n"); } else if (Status == STATUS_SUCCESS) { wprintf(L"SystemExtendServiceTableInformation incorrectly loaded the driver\n"); NtUnloadDriver(&Buffer);
return TRUE; } else { DWORD err = RtlNtStatusToDosError(Status); wprintf(L"LoadVia_SystemExtendServiceTableInformation failed [%lu] - 0x%x\n", err, Status); }
SetPrivilege(FALSE); }
return FALSE;}