-
Notifications
You must be signed in to change notification settings - Fork 10
/
MhyDrvIO.h
68 lines (66 loc) · 1.48 KB
/
MhyDrvIO.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#pragma once
class MhyDrvIO
{
private:
struct MHY_IO_CTL
{
const DWORD InitDrvSeedArray = 0x80034000;
const DWORD ReadKernelMem = 0x83064000;
const DWORD RWProcMem = 0x81074000;
} io_ctls;
typedef struct
{
DWORD d1;
DWORD d2;
DWORD64 q1;
} InitSeedData, * PInitSeedData;
typedef struct
{
union _HeadData
{
DWORD result;
DWORD64 KernelAddr;
} HeadData;
ULONG Size;
} ReadKernelData, * PReadKernelData;
typedef struct
{
DWORD64 randomKey;
DWORD Action;
DWORD Unknown0;
DWORD PID;
DWORD Unknown1;
DWORD64 DestAddr;
DWORD64 SrcAddr;
ULONG Size;
ULONG Unknown2;
} ReadWriteProcData, * PReadWriteProcData;
const char* drvFileName = NULL;
const char* ioFileName = "\\\\?\\\\mhyprot2";
const char* serviceName = "mhyprot2";
const char* drvSysName = "mhyprot2.Sys";
HANDLE hDevice = NULL;
DWORD64 seedmap[312] = { 0 };
bool InitDrv();
void UnloadDrv();
bool ConnectDrv();
bool SetupDrv();
DWORD64 GetKey(DWORD64 seed);
void CryptData(PVOID data, DWORD size);
bool IoControl(DWORD ControlCode, PVOID Data, DWORD Size);
bool InitSeedArray();
public:
MhyDrvIO(const char* drvFileNameIn)
{
if (!drvFileNameIn) throw "drvFileName can not be null";
this->drvFileName = drvFileNameIn;
this->InitDrv();
}
~MhyDrvIO()
{
this->UnloadDrv();
}
bool ReadKernelMem(DWORD64 addr, DWORD size, void* outBuff);
bool ReadProcMem(DWORD pid, DWORD64 addr, DWORD size, void* outBuff);
bool WriteProcMem(DWORD pid, DWORD64 addr, DWORD size, void* inBuff);
};