io_rzk_windows.h File Reference

#include <rz_windows.h>
#include <rz_io.h>
#include <rz_lib.h>
#include <rz_types.h>
#include <rz_util.h>
#include <sys/types.h>

Go to the source code of this file.

Classes
struct	RzIOW32
struct	_PPA
struct	_RTL_PROCESS_MODULE_INFORMATION
struct	_RTL_PROCESS_MODULES

Macros
#define	RZK_DEVICE   "\\\\.\\rzk\\"
#define	IOCTL_CODE(DeviceType, Function, Method, Access)    (((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))
#define	CLOSE_DRIVER   IOCTL_CODE(0x22, 0x803, 0, 1 | 2)
#define	IOCTL_READ_PHYS_MEM   IOCTL_CODE(0x22, 0x807, 0, 1 | 2)
#define	IOCTL_READ_KERNEL_MEM   IOCTL_CODE(0x22, 0x804, 0, 1 | 2)
#define	IOCTL_WRITE_KERNEL_MEM   IOCTL_CODE(0x22, 0x805, 0, 1 | 2)
#define	IOCTL_GET_PHYSADDR   IOCTL_CODE(0x22, 0x809, 0, 1 | 2)
#define	IOCTL_WRITE_PHYS_MEM   IOCTL_CODE(0x22, 0x808, 0, 1 | 2)
#define	IOCTL_GET_SYSTEM_MODULES   IOCTL_CODE(0x22, 0x80a, 0, 1 | 2)

Typedefs
typedef struct _PPA	PA
typedef struct _PPA *	PPA
typedef struct _RTL_PROCESS_MODULE_INFORMATION	RTL_PROCESS_MODULE_INFORMATION
typedef struct _RTL_PROCESS_MODULE_INFORMATION *	PRTL_PROCESS_MODULE_INFORMATION
typedef struct _RTL_PROCESS_MODULES	RTL_PROCESS_MODULES
typedef struct _RTL_PROCESS_MODULES *	PRTL_PROCESS_MODULES

Functions
BOOL	StartStopService (LPCTSTR lpServiceName, BOOL bStop)
int	GetSystemModules (RzIO *io)
int	ReadKernelMemory (ut64 address, ut8 *buf, int len)
int	WriteKernelMemory (ut64 address, const ut8 *buf, int len)
int	Init (const char *driverPath)

Variables
HANDLE	gHandleDriver

Macro Definition Documentation

CLOSE_DRIVER

#define CLOSE_DRIVER   IOCTL_CODE(0x22, 0x803, 0, 1 | 2)

Definition at line 52 of file io_rzk_windows.h.

IOCTL_CODE

#define IOCTL_CODE	(		DeviceType,
			Function,
			Method,
			Access
	)		(((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))

Definition at line 45 of file io_rzk_windows.h.

IOCTL_GET_PHYSADDR

#define IOCTL_GET_PHYSADDR   IOCTL_CODE(0x22, 0x809, 0, 1 | 2)

Definition at line 56 of file io_rzk_windows.h.

IOCTL_GET_SYSTEM_MODULES

#define IOCTL_GET_SYSTEM_MODULES   IOCTL_CODE(0x22, 0x80a, 0, 1 | 2)

Definition at line 58 of file io_rzk_windows.h.

IOCTL_READ_KERNEL_MEM

#define IOCTL_READ_KERNEL_MEM   IOCTL_CODE(0x22, 0x804, 0, 1 | 2)

Definition at line 54 of file io_rzk_windows.h.

IOCTL_READ_PHYS_MEM

#define IOCTL_READ_PHYS_MEM   IOCTL_CODE(0x22, 0x807, 0, 1 | 2)

Definition at line 53 of file io_rzk_windows.h.

IOCTL_WRITE_KERNEL_MEM

#define IOCTL_WRITE_KERNEL_MEM   IOCTL_CODE(0x22, 0x805, 0, 1 | 2)

Definition at line 55 of file io_rzk_windows.h.

IOCTL_WRITE_PHYS_MEM

#define IOCTL_WRITE_PHYS_MEM   IOCTL_CODE(0x22, 0x808, 0, 1 | 2)

Definition at line 57 of file io_rzk_windows.h.

RZK_DEVICE

#define RZK_DEVICE   "\\\\.\\rzk\\"

Definition at line 43 of file io_rzk_windows.h.

Typedef Documentation

PA

typedef struct _PPA PA

PPA

typedef struct _PPA * PPA

PRTL_PROCESS_MODULE_INFORMATION

typedef struct _RTL_PROCESS_MODULE_INFORMATION * PRTL_PROCESS_MODULE_INFORMATION

PRTL_PROCESS_MODULES

typedef struct _RTL_PROCESS_MODULES * PRTL_PROCESS_MODULES

RTL_PROCESS_MODULE_INFORMATION

typedef struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION

RTL_PROCESS_MODULES

typedef struct _RTL_PROCESS_MODULES RTL_PROCESS_MODULES

Function Documentation

GetSystemModules()

int GetSystemModules

(

RzIO *

io

)

Definition at line 94 of file io_rzk_windows.c.

                               {
    DWORD bRead = 0;
    int i;
    LPVOID lpBufMods = NULL;
    int bufmodsize = 1024 * 1024;
    if (gHandleDriver) {
        if (!(lpBufMods = malloc(bufmodsize))) {
            eprintf("[rzk] GetSystemModules: Error can't allocate %i bytes of memory.\n", bufmodsize);
            return -1;
        }
        if (DeviceIoControl(gHandleDriver, IOCTL_GET_SYSTEM_MODULES, lpBufMods, bufmodsize, lpBufMods, bufmodsize, &bRead, NULL)) {
            PRTL_PROCESS_MODULES pm = (PRTL_PROCESS_MODULES)lpBufMods;
            PRTL_PROCESS_MODULE_INFORMATION pMod = pm->Modules;
            for (i = 0; i < pm->NumberOfModules; i++) {
                const char *fileName = GetFileName((const char *)pMod[i].FullPathName);
                io->cb_printf("f nt.%s 0x%x @ 0x%p\n", fileName, pMod[i].ImageSize, pMod[i].ImageBase);
            }
        }
    } else {
        eprintf("Driver not initialized.\n");
    }
    return 1;
}

References rz_io_t::cb_printf, DWORD, eprintf, test-lz4-speed::fileName, GetFileName(), gHandleDriver, i, IOCTL_GET_SYSTEM_MODULES, malloc(), _RTL_PROCESS_MODULES::Modules, NULL, and _RTL_PROCESS_MODULES::NumberOfModules.

Referenced by rzk__system().

Init()

int Init

(

const char *

driverPath

)

Definition at line 175 of file io_rzk_windows.c.

                                 {
    BOOL ret = FALSE;
    if (InitDriver() == FALSE) {
        if (strlen(driverPath)) {
            StartStopService(TEXT("rzk"), TRUE);
            RemoveService(TEXT("rzk"));
            eprintf("Installing driver: %s\n", driverPath);
            if (InstallService(driverPath, TEXT("rzk"), TEXT("rzk"))) {
                StartStopService(TEXT("rzk"), FALSE);
                ret = InitDriver();
            }
        } else {
            eprintf("Error initalizating driver, try rzk://pathtodriver\nEx: rizin.exe rzk://c:\\rzk.sys");
        }
    } else {
        eprintf("Driver present [OK]\n");
        ret = TRUE;
    }
    return ret;
}

References eprintf, FALSE, InitDriver(), InstallService(), RemoveService(), StartStopService(), and TRUE.

Referenced by rzk__open().

ReadKernelMemory()

int ReadKernelMemory	(	ut64	address,
		ut8 *	buf,
		int	len
	)

Definition at line 118 of file io_rzk_windows.c.

                                                      {
    DWORD ret = -1, bRead = 0;
    LPVOID lpBuffer = NULL;
    int bufsize;
    PPA p;
    memset(buf, '\xff', len);
    if (gHandleDriver) {
        bufsize = sizeof(PA) + len;
        if (!(lpBuffer = malloc(bufsize))) {
            eprintf("[rzk] ReadKernelMemory: Error can't allocate %i bytes of memory.\n", bufsize);
            return -1;
        }
        p = (PPA)lpBuffer;
        p->address.QuadPart = address;
        p->len = len;
        if (DeviceIoControl(gHandleDriver, IOCTL_READ_KERNEL_MEM, lpBuffer, bufsize, lpBuffer, bufsize, &bRead, NULL)) {
            memcpy(buf, lpBuffer, len);
            ret = len;
        } else {
            ret = -1;
            // eprintf("[rzk] ReadKernelMemory: Error IOCTL_READ_KERNEL_MEM.\n");
        }
        free(lpBuffer);
    } else {
        eprintf("Driver not initialized.\n");
    }
    return ret;
}

References DWORD, eprintf, free(), gHandleDriver, IOCTL_READ_KERNEL_MEM, len, malloc(), memcpy(), memset(), NULL, and p.

Referenced by rzk__read().

StartStopService()

BOOL StartStopService	(	LPCTSTR	lpServiceName,
		BOOL	bStop
	)

Definition at line 43 of file io_rzk_windows.c.

                                                         {
    HANDLE hSCManager;
    HANDLE hService;
    SERVICE_STATUS ssStatus;
    BOOL ret = FALSE;
    hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
    if (hSCManager) {
        hService = OpenService(hSCManager, lpServiceName, SERVICE_START | DELETE | SERVICE_STOP);
        if (hService) {
            if (!bStop) {
                if (StartService(hService, 0, NULL)) {
                    eprintf("Service started [OK]\n");
                    ret = TRUE;
                } else {
                    eprintf("Service started [FAIL]\n");
                }
            } else {
                if (ControlService(hService, SERVICE_CONTROL_STOP, &ssStatus)) {
                    eprintf("Service Stopped [OK]\n");
                    ret = TRUE;
                } else {
                    eprintf("Service Stopped [FAIL]\n");
                }
            }
            CloseServiceHandle(hService);
            DeleteService(hService);
        }
        CloseServiceHandle(hSCManager);
    }
    return ret;
}

References eprintf, FALSE, HANDLE, NULL, and TRUE.

Referenced by Init(), and rzk__close().

WriteKernelMemory()

int WriteKernelMemory	(	ut64	address,
		const ut8 *	buf,
		int	len
	)

Definition at line 147 of file io_rzk_windows.c.

                                                             {
    DWORD ret = -1, bRead = 0;
    LPVOID lpBuffer = NULL;
    int bufsize;
    PPA p;
    if (gHandleDriver) {
        bufsize = sizeof(PA) + len;
        if (!(lpBuffer = malloc(bufsize))) {
            eprintf("[rzk] WriteKernelMemory: Error can't allocate %i bytes of memory.\n", bufsize);
            return -1;
        }
        p = (PPA)lpBuffer;
        p->address.QuadPart = address;
        p->len = len;
        memcpy(&p->buffer, buf, len);
        if (DeviceIoControl(gHandleDriver, IOCTL_WRITE_KERNEL_MEM, lpBuffer, bufsize, lpBuffer, bufsize, &bRead, NULL)) {
            ret = len;
        } else {
            eprintf("[rzk] WriteKernelMemory: Error IOCTL_WRITE_KERNEL_MEM.\n");
            ret = -1;
        }
        free(lpBuffer);
    } else {
        eprintf("Driver not initialized.\n");
    }
    return ret;
}

References DWORD, eprintf, free(), gHandleDriver, IOCTL_WRITE_KERNEL_MEM, len, malloc(), memcpy(), NULL, and p.

Referenced by rzk__write().

Variable Documentation

gHandleDriver

HANDLE gHandleDriver

extern

Definition at line 8 of file io_rzk_windows.c.

Referenced by GetSystemModules(), InitDriver(), ReadKernelMemory(), rzk__close(), and WriteKernelMemory().