C++ (Cpp) TriggerTypeConfusion示例

示例#1

文件： TypeConfusion.c 项目： Debug-Orz/HackSysExtremeVulnerableDriver

/// <summary>
/// Type Confusion Ioctl Handler
/// </summary>
/// <param name="pIrp">The pointer to IRP</param>
/// <param name="pIoStackIrp">The pointer to IO_STACK_LOCATION structure</param>
/// <returns>NTSTATUS</returns>
NTSTATUS TypeConfusionIoctlHandler(IN PIRP pIrp, IN PIO_STACK_LOCATION pIoStackIrp) {
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PTYPE_CONFUSION_USER_OBJECT pTypeConfusionUserObject = NULL;

    UNREFERENCED_PARAMETER(pIrp);
    PAGED_CODE();

    pTypeConfusionUserObject = (PTYPE_CONFUSION_USER_OBJECT)
                                pIoStackIrp->Parameters.DeviceIoControl.Type3InputBuffer;

    if (pTypeConfusionUserObject) {
        status = TriggerTypeConfusion(pTypeConfusionUserObject);
    }

    return status;
}

示例#2

文件： TypeConfusion.c 项目： GeassDB/HackSysExtremeVulnerableDriver

/// <summary>
/// Type Confusion Ioctl Handler
/// </summary>
/// <param name="Irp">The pointer to IRP</param>
/// <param name="IrpSp">The pointer to IO_STACK_LOCATION structure</param>
/// <returns>NTSTATUS</returns>
NTSTATUS TypeConfusionIoctlHandler(IN PIRP Irp, IN PIO_STACK_LOCATION IrpSp) {
    NTSTATUS Status = STATUS_UNSUCCESSFUL;
    PUSER_TYPE_CONFUSION_OBJECT UserTypeConfusionObject = NULL;

    UNREFERENCED_PARAMETER(Irp);
    PAGED_CODE();

    UserTypeConfusionObject = (PUSER_TYPE_CONFUSION_OBJECT)
                               IrpSp->Parameters.DeviceIoControl.Type3InputBuffer;

    if (UserTypeConfusionObject) {
        Status = TriggerTypeConfusion(UserTypeConfusionObject);
    }

    return Status;
}