GeezerVison is showing github.com — Kernal-Memory-ReadWrite/ReadWrite.c at master · fcccode/Kernal-Memory-ReadWrite

Expand file tree

ReadWrite.c

Copy path

More file actions

Latest commit

History

78 lines (63 loc) · 2.24 KB

ReadWrite.c

Copy path

File metadata and controls

78 lines (63 loc) · 2.24 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

#include <ntdef.h>

#include <ntifs.h>

DRIVER_INITIALIZE DriverEntry;

#pragma alloc_text(INIT, DriverEntry)

// API function from ntoskrnl.exe which we use

// to copy memory to and from an user process.

NTSTATUS NTAPI MmCopyVirtualMemory

(

PEPROCESS SourceProcess,

PVOID SourceAddress,

PEPROCESS TargetProcess,

PVOID TargetAddress,

SIZE_T BufferSize,

KPROCESSOR_MODE PreviousMode,

PSIZE_T ReturnSize

);

NTKERNELAPI

NTSTATUS

PsLookupProcessByProcessId(

_In_ HANDLE ProcessId,

_Outptr_ PEPROCESS *Process

);

NTSTATUS KeReadProcessMemory(PEPROCESS Process, PVOID SourceAddress, PVOID TargetAddress, SIZE_T Size)

{

// Since the process we are reading from is the input process, we set

// the source process variable for that.

PEPROCESS SourceProcess = Process;

// Since the "process" we read the output to is this driver

// we set the target process as the current module.

PEPROCESS TargetProcess = PsGetCurrentProcess();

SIZE_T Result;

if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress, TargetProcess, TargetAddress, Size, KernelMode, &Result)))

return STATUS_SUCCESS; // operation was successful

else

return STATUS_ACCESS_DENIED;

}

NTSTATUS KeWriteProcessMemory(PEPROCESS Process, PVOID SourceAddress, PVOID TargetAddress, SIZE_T Size)

{ // This write func is just like the read func, except vice versa.

// Since the process writing from is our module

// change the source process variable for that.

PEPROCESS SourceProcess = PsGetCurrentProcess();

// Since the process we write to is the input process

// we set the target process as the argument

PEPROCESS TargetProcess = Process;

SIZE_T Result;

if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress, TargetProcess, TargetAddress, Size, KernelMode, &Result)))

return STATUS_SUCCESS; // operation was successful

else

return STATUS_ACCESS_DENIED;

}

NTSTATUS DriverEntry(

_In_ struct _DRIVER_OBJECT *DriverObject,

_In_ PUNICODE_STRING RegistryPath

)

{

int Writeval = 666;

PEPROCESS Process; // our target process

// enter your process ID here.

PsLookupProcessByProcessId(4872, &Process); //lookup the process by it's id;

KeWriteProcessMemory(Process, &Writeval, 0x010F29B0, sizeof(__int32));

DbgPrint("Value of int i: %d", Writeval);

return STATUS_SUCCESS;

}