Register for your free account! | Forgot your password?

Go Back   elitepvpers > The Black Market > Other Trading > Coders Trading
You last visited: Today at 22:28

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



Ring0 Driver just read 4 or 8 Bytes

Discussion on Ring0 Driver just read 4 or 8 Bytes within the Coders Trading forum part of the Other Trading category.

Reply
 
Old   #1


 
elite*gold: 0
Join Date: Dec 2015
Posts: 354
Received Thanks: 40
Ring0 Driver just read 4 or 8 Bytes

If someone can fix my problem i can offer up to 20€.... i guess my mistake is just a casting mistake....
When i try to read with my Kernel Driver a Value then it just read the first 4 or 8 byte... but when i want to read an vector i have to read all 3 floats with 3 reads^^

Usermode struct:
Code:
typedef struct _NEVERFORGET_READWRITE
{
	PVOID value;         // Buffer address
	ULONGLONG address;        // Target address
	ULONGLONG size;             // Buffer size
	ULONG     pid;              // Target process id
} NEVERFORGET_READWRITE, *PNEVERFORGET_READWRITE;
Usermode Read/Write:
HTML Code:
	template <typename T>
	T ReadProcessMemory(DWORD address) {
		DWORD bytes = 0;
		NEVERFORGET_READWRITE Output;
		Output.address = address;
		Output.pid = GetPid();
		Output.size = sizeof(T);

		if (DeviceIoControl(handleDriver, IOCTL_Read_NeverForgetMe, &Output, sizeof(Output), &Output, sizeof(Output), &bytes, NULL)) {
			//DWORD64 *intPtr = static_cast<DWORD64*>(Output.value);
			//T converted = *(T*)&intPtr;

			T converted = *(T*)&Output.value;
			return converted;
		}
		return{};
	}
	template <typename T>
	T WriteProcessMemory(DWORD address, T value) {
		DWORD bytes = 0;
		NEVERFORGET_READWRITE Output;
		Output.address = address;
		Output.pid = GetPid();
		Output.size = sizeof(T);
		void *voidPtr = &value;
		Output.value = voidPtr;
		if (DeviceIoControl(handleDriver, IOCTL_Write_NeverForgetMe, &Output, sizeof(Output), &Output, sizeof(Output), &bytes, NULL)) {
			DWORD64 *intPtr = static_cast<DWORD64*>(Output.value);
			T converted = *(T*)&intPtr;
			return converted;
		}
		return{};
	}
Kernel Struct:
Code:
typedef struct _NEVERFORGET_READWRITE
{
	PVOID value;         // Buffer address
	ULONGLONG address;        // Target address
	ULONGLONG size;             // Buffer size
	ULONG     pid;              // Target process id
} NEVERFORGET_READWRITE, *PNEVERFORGET_READWRITE;
Kernel read/write
Code:

NTSTATUS KeReadVirtualMemory(PEPROCESS Process, PVOID SourceAddress, PVOID TargetAddress, SIZE_T Size)
{
	SIZE_T Bytes;
	DbgPrint("[KeReadVirtualMemory]: %llx\n", SourceAddress);
	if (NT_SUCCESS(MmCopyVirtualMemory(Process, SourceAddress, PsGetCurrentProcess(), TargetAddress, Size, KernelMode, &Bytes))) {
		DbgPrint("[KeReadVirtualMemory] Output: %f\n", TargetAddress);
		return STATUS_SUCCESS;
	}
	else {
		return STATUS_ACCESS_DENIED;
	}


}
NTSTATUS KeWriteProcessMemory(PEPROCESS Process, PVOID SourceAddress, PVOID TargetAddress, SIZE_T Size)
{
	PEPROCESS SourceProcess = PsGetCurrentProcess();

	PEPROCESS TargetProcess = Process;
	SIZE_T Result;

	if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress, TargetProcess, TargetAddress, Size, KernelMode, &Result)))
		return STATUS_SUCCESS; // operation was successful
	else
		return STATUS_ACCESS_DENIED;

}







PSIZE_T bytes;

case IOCTL_Read_NeverForgetMe:
			if (inputBufferLength >= sizeof(NEVERFORGET_READWRITE) && ioBuffer) {
				PNEVERFORGET_READWRITE test = (PNEVERFORGET_READWRITE)ioBuffer;
				PEPROCESS Process;
				if (NT_SUCCESS(PsLookupProcessByProcessId((PVOID)(UINT_PTR)test->pid, &Process))) {
					KeReadVirtualMemory(Process, test->address,&test->value, test->size); //eig mit &
				}
				Bytes = sizeof(test);
				Irp->IoStatus.Status = STATUS_SUCCESS;
			}
			else {
				Irp->IoStatus.Status = STATUS_INFO_LENGTH_MISMATCH;
			}
			break;
		case IOCTL_Write_NeverForgetMe:
			if (inputBufferLength >= sizeof(NEVERFORGET_READWRITE) && ioBuffer) {
				PNEVERFORGET_READWRITE test = (PNEVERFORGET_READWRITE)ioBuffer;
				PEPROCESS Process;
				if (NT_SUCCESS(PsLookupProcessByProcessId((PVOID)(UINT_PTR)test->pid, &Process))){
					KeWriteProcessMemory(Process, test->value, test->address, test->size); //eig mit &
				}
				Bytes = sizeof(test);
				Irp->IoStatus.Status = STATUS_SUCCESS;
			}
			else {
				Irp->IoStatus.Status = STATUS_INFO_LENGTH_MISMATCH;
			}
			break;

	Irp->IoStatus.Information = Bytes;
BlackSkill88 is offline  
Old 03/14/2019, 12:27   #2 Trade Status: Unverified(?)
 
babyiloveyou12's Avatar
 
elite*gold: 0
Join Date: Feb 2012
Posts: 82
Received Thanks: 18
still need help
?
babyiloveyou12 is offline  
Reply

Tags
cast, kernel, read, ring0, write


Similar Threads Similar Threads
WTS H1Z1 KoTK Private Cheat with Ring0 Driver Loader
09/27/2016 - H1Z1 - 5 Replies
I'm selling 2 slots for a cheat I recently created for the new update of KoTK. After testing it for around 2 months we are sure of its safety. The cheat uses a signed driver to load an external overlay. Features: Player ESP Item ESP Toggleable Aimbot Head/Body works pretty well in any gun fight. THE CHEAT DOES NOT WORK ON WINDOWS 7 ONLY WINDOWS 10 and 8.1
[Selling] CS:GO LEAGUES HACK [AIMBOT-TRIGGERBOT-RING0 DRIVER-PRIVATE CERTIFICIATE]
02/28/2016 - Counter-Strike Trading - 0 Replies
http://i.hizliresim.com/dkgqbp.png CS:GO LEAGUES HACK http://hatscripts.com/addskype/eyeessoftware.png SKYPE: eyeessoftware
2 Bytes oder 4 Bytes ?
02/13/2010 - Kal Online - 3 Replies
Erm wenn ich nach cooldowns schaue für Mockery mit der UCE such ich dann mit 2 Bytes oder 4 Bytes ??



All times are GMT +1. The time now is 22:28.


Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2025 elitepvpers All Rights Reserved.