denuvo-ref/hvpp
1
0
Fork 0
mirror of https://github.com/wbenny/hvpp synced 2026-08-17 04:26:04 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

add kernel_(begin/end)_address and (highest_user/system_range_start)_address to the "driver" namespace

Browse source
This commit is contained in:
Petr Benes 2019-10-29 15:51:09 +01:00
parent c7cba16b20
commit 7922700cfe
2 changed files with 70 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/hvpp/hvpp/lib/driver.h
View file

@ -6,6 +6,12 @@ namespace driver
extern void* begin_address;
extern void* end_address;
extern void* kernel_begin_address;
extern void* kernel_end_address;
extern void* highest_user_address;
extern void* system_range_start_address;
namespace common
{
using driver_initialize_fn = error_code_t(*)();

71
src/hvpp/hvpp/lib/win32/driver.cpp
View file

@ -6,6 +6,7 @@
#include <algorithm>
#include <ntddk.h>
#include <ntimage.h>
#ifdef min
# undef min
@ -20,6 +21,23 @@
//
#define ACCESS_FROM_CTL_CODE(ctrlCode) (((ULONG)(ctrlCode & 0x0000c000)) >> 14)
EXTERN_C
NTSYSAPI
PIMAGE_NT_HEADERS
NTAPI
RtlImageNtHeader(
_In_ PVOID BaseOfImage
);
EXTERN_C
NTSYSAPI
PVOID
NTAPI
RtlPcToFileHeader(
_In_ PVOID PcValue,
_Out_ PVOID* BaseOfImage
);
extern "C"
{
DRIVER_INITIALIZE DriverEntry;
@ -28,8 +46,14 @@ extern "C"
namespace driver
{
void* begin_address = nullptr;
void* end_address = nullptr;
void* begin_address = nullptr;
void* end_address = nullptr;
void* kernel_begin_address = nullptr;
void* kernel_end_address = nullptr;
void* highest_user_address = nullptr;
void* system_range_start_address = nullptr;
}
NTSTATUS
@ -165,17 +189,50 @@ DriverEntry(
DriverObject->MajorFunction[IRP_MJ_READ] = &DriverDispatch;
DriverObject->MajorFunction[IRP_MJ_WRITE] = &DriverDispatch;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = &DriverDispatch;
DriverObject->DriverUnload = &DriverUnload;
//
// Save the driver address range.
//
driver::begin_address = (PVOID)((ULONG_PTR)(DriverObject->DriverStart));
driver::end_address = (PVOID)((ULONG_PTR)(DriverObject->DriverStart) + DriverObject->DriverSize);
//
// Save the kernel address range.
//
PVOID ImageBase = NULL;
SIZE_T ImageSize = 0;
RtlPcToFileHeader((PVOID)&RtlPcToFileHeader, &ImageBase);
if (!ImageBase)
{
return STATUS_NOT_FOUND;
}
PIMAGE_NT_HEADERS NtHeaders = (PIMAGE_NT_HEADERS)(RtlImageNtHeader(ImageBase));
if (!NtHeaders)
{
return STATUS_NOT_FOUND;
}
ImageSize = NtHeaders->OptionalHeader.SizeOfImage;
driver::kernel_begin_address = (PVOID)((ULONG_PTR)(ImageBase));
driver::kernel_end_address = (PVOID)((ULONG_PTR)(ImageBase) + ImageSize);
//
// Save the highest user address and system range start address.
//
driver::highest_user_address = MmHighestUserAddress;
driver::system_range_start_address = MmSystemRangeStart;
auto err = driver::common::initialize(&driver::initialize,
&driver::destroy);
//
// #TODO: Make setting of `DriverUnload' optional.
//
DriverObject->DriverUnload = &DriverUnload;
return HvppErrorCodeToNtStatus(err);
}