4 ms·
Extremely useful source for Direct Kernel Object Manipulation. [0] Say I am a Windows driver, and I am running on a system thread. I can do something like this
by therein 4y ago
Extremely useful source for Direct Kernel Object Manipulation. [0]
Say I am a Windows driver, and I am running on a system thread. I can do something like this:
PKTHREAD currentThread = KeGetCurrentThread();
PVOID win32ThreadPtr = (PVOID)((char*)currentThread + OFFSET_win32ThreadOffset);
memcpy(win32ThreadPtr, &newWin32Value, sizeof(PVOID));
PVOID processPtr = (PVOID)((char*)currentThread + OFFSET_processOffset);
memcpy(processPtr, &newProcess, sizeof(PEPROCESS));
PVOID clientIdPtr = (PVOID)((char*)currentThread + OFFSET_CID);
memcpy(clientIdPtr, &newClientId, sizeof(CLIENT_ID));
And "spoof" these values for my thread which would allow me to make calls to Win32 APIs and I can draw on screen from kernel.
PKTHREAD is a pointer to an opaque structure but not opaque to you if you look at Vergilius. Sometimes Microsoft only documents the first N bytes of a struct while the rest is left opaque to us as well. Vergilius where you'd most likely find yourself looking at to find the offsets at which a field is found in a struct for each Windows build.
Basically many of these structs are known to be inputs to and outputs of documented and undocumented Windows APIs. And the lesser known ones are inner fields or references from these, or used in unexported functions and discussed in circles interested in this niche.
[0] https://en.wikipedia.org/wiki/Direct_kernel_object_manipulation https://en.wikipedia.org/wiki/Direct_kernel_object_manipulat...