More experiments

This commit is contained in:
momo5502 2022-04-14 21:19:06 +02:00
parent e2f73e0aeb
commit 00e31a84f5
4 changed files with 14 additions and 15 deletions

View File

@ -44,24 +44,21 @@ namespace
debug_log("Pid: %d | Address: %p\n", request->process_id, request->target_address); debug_log("Pid: %d | Address: %p\n", request->process_id, request->target_address);
auto current_proc = process::get_current_process(); const auto process_handle = process::find_process_by_id(request->process_id);
if (current_proc) if (!process_handle || !process_handle.is_alive())
{
debug_log("Current: %p\n", current_proc.get_id());
}
//debug_log("Current: %lld\n",PsGetCurrentProcessId());
/*const auto process_handle = process::find_process_by_id(request->process_id);
if(process_handle && process_handle.is_alive())
{ {
debug_log("Bad process\n"); debug_log("Bad process\n");
return; return;
} }
process::scoped_process_attacher attacher{process_handle}; const auto name = process_handle.get_image_filename();
if (name)
{
debug_log("Attaching to %s\n", name);
}
debug_log("Original: %s\n", request->target_address);*/ //process::scoped_process_attacher attacher{process_handle};
//debug_log("Original: %s\n", request->target_address);
} }
_Function_class_(DRIVER_DISPATCH) NTSTATUS io_ctl_handler( _Function_class_(DRIVER_DISPATCH) NTSTATUS io_ctl_handler(

View File

@ -58,14 +58,14 @@ namespace process
return KeWaitForSingleObject(this->handle_, Executive, KernelMode, FALSE, &zero_time) != STATUS_WAIT_0; return KeWaitForSingleObject(this->handle_, Executive, KernelMode, FALSE, &zero_time) != STATUS_WAIT_0;
} }
HANDLE process_handle::get_id() const uint32_t process_handle::get_id() const
{ {
if(!this->handle_) if(!this->handle_)
{ {
return 0; return 0;
} }
PsGetProcessId(this->handle_); return uint32_t(uint64_t(PsGetProcessId(this->handle_)));
} }
const char* process_handle::get_image_filename() const const char* process_handle::get_image_filename() const

View File

@ -19,7 +19,7 @@ namespace process
operator PEPROCESS() const; operator PEPROCESS() const;
bool is_alive() const; bool is_alive() const;
HANDLE get_id() const; uint32_t get_id() const;
const char* get_image_filename() const; const char* get_image_filename() const;

View File

@ -46,6 +46,8 @@ std::filesystem::path get_current_path()
void unsafe_main(const int /*argc*/, char* /*argv*/[]) void unsafe_main(const int /*argc*/, char* /*argv*/[])
{ {
printf("Pid: %lu\n", GetCurrentProcessId());
driver driver{get_current_path() / "driver.sys", "MomoLul"}; driver driver{get_current_path() / "driver.sys", "MomoLul"};
driver_device driver_device{"\\\\.\\HelloDev"}; driver_device driver_device{"\\\\.\\HelloDev"};