Skip to content

Commit 34085b4

Browse files
DoubleLabyrinthDoubleLabyrinth
committed
First commit
0 parents  commit 34085b4

25 files changed

+2510
-0
lines changed

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.vs/
2+
bin/
3+
obj/
4+
asset/pki-architecture.xml
5+

‎CustomKernelSignersPersistent/CustomKernelSignersPersistent.vcxproj

+139
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{912F26A3-E2FA-4503-AF55-1980A05845E1}</ProjectGuid>
23+
<TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
24+
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
25+
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
26+
<Configuration>Debug</Configuration>
27+
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
28+
<RootNamespace>CustomKernelSignersPersistent</RootNamespace>
29+
<WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
30+
</PropertyGroup>
31+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
32+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
33+
<TargetVersion>Windows10</TargetVersion>
34+
<UseDebugLibraries>true</UseDebugLibraries>
35+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
36+
<ConfigurationType>Driver</ConfigurationType>
37+
<DriverType>WDM</DriverType>
38+
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
39+
</PropertyGroup>
40+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
41+
<TargetVersion>Windows10</TargetVersion>
42+
<UseDebugLibraries>false</UseDebugLibraries>
43+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
44+
<ConfigurationType>Driver</ConfigurationType>
45+
<DriverType>WDM</DriverType>
46+
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
49+
<TargetVersion>Windows10</TargetVersion>
50+
<UseDebugLibraries>true</UseDebugLibraries>
51+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
52+
<ConfigurationType>Driver</ConfigurationType>
53+
<DriverType>WDM</DriverType>
54+
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
55+
</PropertyGroup>
56+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
57+
<TargetVersion>Windows10</TargetVersion>
58+
<UseDebugLibraries>false</UseDebugLibraries>
59+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
60+
<ConfigurationType>Driver</ConfigurationType>
61+
<DriverType>WDM</DriverType>
62+
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
63+
</PropertyGroup>
64+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
65+
<ImportGroup Label="ExtensionSettings">
66+
</ImportGroup>
67+
<ImportGroup Label="PropertySheets">
68+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
69+
</ImportGroup>
70+
<PropertyGroup Label="UserMacros" />
71+
<PropertyGroup />
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
73+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
74+
<TargetName>ckspdrv</TargetName>
75+
<OutDir>$(SolutionDir)bin\$(Platform)-$(ConfigurationName)\</OutDir>
76+
<IntDir>$(SolutionDir)obj\$(Platform)-$(ConfigurationName)\$(ProjectName)\</IntDir>
77+
<TimeStampServer />
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
80+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
81+
<TargetName>ckspdrv</TargetName>
82+
<OutDir>$(SolutionDir)bin\$(Platform)-$(ConfigurationName)\</OutDir>
83+
<IntDir>$(SolutionDir)obj\$(Platform)-$(ConfigurationName)\$(ProjectName)\</IntDir>
84+
<TimeStampServer />
85+
</PropertyGroup>
86+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
87+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
88+
<TimeStampServer />
89+
<TargetName>ckspdrv</TargetName>
90+
<OutDir>$(SolutionDir)bin\$(Platform)-$(ConfigurationName)\</OutDir>
91+
<IntDir>$(SolutionDir)obj\$(Platform)-$(ConfigurationName)\$(ProjectName)\</IntDir>
92+
</PropertyGroup>
93+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
94+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
95+
<TimeStampServer />
96+
<TargetName>ckspdrv</TargetName>
97+
<OutDir>$(SolutionDir)bin\$(Platform)-$(ConfigurationName)\</OutDir>
98+
<IntDir>$(SolutionDir)obj\$(Platform)-$(ConfigurationName)\$(ProjectName)\</IntDir>
99+
</PropertyGroup>
100+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
101+
<DriverSign>
102+
<FileDigestAlgorithm>
103+
</FileDigestAlgorithm>
104+
</DriverSign>
105+
</ItemDefinitionGroup>
106+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
107+
<DriverSign>
108+
<FileDigestAlgorithm>
109+
</FileDigestAlgorithm>
110+
</DriverSign>
111+
</ItemDefinitionGroup>
112+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
113+
<DriverSign>
114+
<FileDigestAlgorithm>
115+
</FileDigestAlgorithm>
116+
</DriverSign>
117+
</ItemDefinitionGroup>
118+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
119+
<DriverSign>
120+
<FileDigestAlgorithm>
121+
</FileDigestAlgorithm>
122+
</DriverSign>
123+
</ItemDefinitionGroup>
124+
<ItemGroup>
125+
<FilesToPackage Include="$(TargetPath)" />
126+
</ItemGroup>
127+
<ItemGroup>
128+
<ClInclude Include="cksp_defs.h" />
129+
</ItemGroup>
130+
<ItemGroup>
131+
<ClCompile Include="cksp_entry.c" />
132+
<ClCompile Include="cksp_irp_null.c" />
133+
<ClCompile Include="cksp_main.c" />
134+
<ClCompile Include="cksp_unload.c" />
135+
</ItemGroup>
136+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
137+
<ImportGroup Label="ExtensionTargets">
138+
</ImportGroup>
139+
</Project>

‎CustomKernelSignersPersistent/CustomKernelSignersPersistent.vcxproj.filters

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
<Filter Include="Driver Files">
17+
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
18+
<Extensions>inf;inv;inx;mof;mc;</Extensions>
19+
</Filter>
20+
</ItemGroup>
21+
<ItemGroup>
22+
<ClInclude Include="cksp_defs.h">
23+
<Filter>Header Files</Filter>
24+
</ClInclude>
25+
</ItemGroup>
26+
<ItemGroup>
27+
<ClCompile Include="cksp_entry.c">
28+
<Filter>Source Files</Filter>
29+
</ClCompile>
30+
<ClCompile Include="cksp_irp_null.c">
31+
<Filter>Source Files</Filter>
32+
</ClCompile>
33+
<ClCompile Include="cksp_unload.c">
34+
<Filter>Source Files</Filter>
35+
</ClCompile>
36+
<ClCompile Include="cksp_main.c">
37+
<Filter>Source Files</Filter>
38+
</ClCompile>
39+
</ItemGroup>
40+
</Project>

‎CustomKernelSignersPersistent/CustomKernelSignersPersistent.vcxproj.user

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup>
4+
<ShowAllFiles>true</ShowAllFiles>
5+
</PropertyGroup>
6+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
7+
<SignMode>Off</SignMode>
8+
<CrossCertificateFile>
9+
</CrossCertificateFile>
10+
<ProductionCertificate>
11+
</ProductionCertificate>
12+
</PropertyGroup>
13+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
14+
<SignMode>Off</SignMode>
15+
<CrossCertificateFile>
16+
</CrossCertificateFile>
17+
<ProductionCertificate>
18+
</ProductionCertificate>
19+
</PropertyGroup>
20+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
21+
<SignMode>Off</SignMode>
22+
<CrossCertificateFile>
23+
</CrossCertificateFile>
24+
<ProductionCertificate>
25+
</ProductionCertificate>
26+
</PropertyGroup>
27+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
28+
<SignMode>Off</SignMode>
29+
<CrossCertificateFile>
30+
</CrossCertificateFile>
31+
<ProductionCertificate>
32+
</ProductionCertificate>
33+
</PropertyGroup>
34+
</Project>

‎CustomKernelSignersPersistent/cksp_defs.h

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#pragma once
2+
#include <ntifs.h>
3+
4+
NTSTATUS NTAPI ZwQueryLicenseValue(
5+
_In_ PUNICODE_STRING ValueName,
6+
_Out_opt_ PULONG Type,
7+
_Out_writes_bytes_to_opt_(DataSize, *ResultDataSize) PVOID Data,
8+
_In_ ULONG DataSize,
9+
_Out_ PULONG ResultDataSize
10+
);
11+
12+
NTSTATUS NTAPI ExUpdateLicenseData(
13+
_In_ ULONG cbBytes,
14+
_In_reads_bytes_(cbBytes) PVOID lpBytes
15+
);
16+
17+
typedef enum _CKSP_WORKER_ACTION {
18+
CkspWorkerActionNone = 0,
19+
CkspWorkerActionStop = 1
20+
} CKSP_WORKER_ACTION;
21+
22+
typedef struct _CKSP_WORKER_CONTEXT {
23+
UNICODE_STRING LaunchDriverServiceName;
24+
HANDLE ProductOptionsKeyChangeEventHandle;
25+
PKEVENT ProductOptionsKeyChangeEventObject;
26+
HANDLE ProductOptionsKey;
27+
PKEY_VALUE_PARTIAL_INFORMATION ProductPolicyValueInfo;
28+
ULONG ProductPolicyValueInfoSize;
29+
CKSP_WORKER_ACTION Action;
30+
} CKSP_WORKER_CONTEXT, *PCKSP_WORKER_CONTEXT;
31+
32+
extern PCKSP_WORKER_CONTEXT g_CkspWorkerContext;
33+
extern HANDLE g_CkspWorkerThreadHandle;
34+
extern PVOID g_CkspWorkerThreadObject;
35+
36+
NTSTATUS NTAPI DriverEntry(
37+
_In_ PDRIVER_OBJECT DriverObject,
38+
_In_ PUNICODE_STRING RegistryPath
39+
);
40+
41+
VOID NTAPI DriverUnload(
42+
_In_ PDRIVER_OBJECT DriverObject
43+
);
44+
45+
NTSTATUS NTAPI IrpNullHandler(
46+
_In_ PDEVICE_OBJECT DeviceObject,
47+
_In_ PIRP Irp
48+
);
49+
50+
//
51+
// CKSP routines
52+
//
53+
54+
NTSTATUS CkspInitContext(
55+
_In_ PCKSP_WORKER_CONTEXT Context,
56+
_In_ PDRIVER_OBJECT DriverObject,
57+
_In_ PUNICODE_STRING RegistryPath
58+
);
59+
60+
VOID CkspClearContext(
61+
_In_ PCKSP_WORKER_CONTEXT Context
62+
);
63+
64+
VOID NTAPI CkspWorker(
65+
_In_ PVOID StartContext
66+
);
67+
68+
VOID CkspDeferUnloadAsPossible(
69+
_In_ PCKSP_WORKER_CONTEXT Context
70+
);
71+
72+

‎CustomKernelSignersPersistent/cksp_entry.c

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#include "cksp_defs.h"
2+
3+
PCKSP_WORKER_CONTEXT g_CkspWorkerContext;
4+
HANDLE g_CkspWorkerThreadHandle;
5+
PVOID g_CkspWorkerThreadObject;
6+
7+
NTSTATUS NTAPI DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) {
8+
NTSTATUS Status;
9+
OBJECT_ATTRIBUTES ThreadAttribute;
10+
11+
//
12+
// We don't handle any IRQs
13+
//
14+
for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i)
15+
DriverObject->MajorFunction[i] = IrpNullHandler;
16+
17+
DriverObject->DriverUnload = DriverUnload;
18+
19+
//
20+
// Allocate CKSP context
21+
//
22+
g_CkspWorkerContext = (PCKSP_WORKER_CONTEXT)ExAllocatePoolWithTag(NonPagedPool, sizeof(CKSP_WORKER_CONTEXT), 'cksp');
23+
if (g_CkspWorkerContext == NULL) {
24+
Status = STATUS_NO_MEMORY;
25+
goto ON_DriverEntry_ERROR;
26+
}
27+
28+
//
29+
// Initialize CKSP context
30+
//
31+
Status = CkspInitContext(g_CkspWorkerContext, DriverObject, RegistryPath);
32+
if (!NT_SUCCESS(Status))
33+
goto ON_DriverEntry_ERROR;
34+
35+
//
36+
// Launch CkspWorker thread
37+
//
38+
InitializeObjectAttributes(&ThreadAttribute, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
39+
Status = PsCreateSystemThread(&g_CkspWorkerThreadHandle,
40+
THREAD_ALL_ACCESS,
41+
&ThreadAttribute,
42+
NULL,
43+
NULL,
44+
CkspWorker,
45+
g_CkspWorkerContext);
46+
if (!NT_SUCCESS(Status)) {
47+
goto ON_DriverEntry_ERROR;
48+
} else {
49+
//
50+
// never fail here
51+
//
52+
ObReferenceObjectByHandle(g_CkspWorkerThreadHandle,
53+
THREAD_ALL_ACCESS,
54+
*PsThreadType,
55+
KernelMode,
56+
&g_CkspWorkerThreadObject,
57+
NULL);
58+
}
59+
60+
return Status;
61+
62+
ON_DriverEntry_ERROR:
63+
if (g_CkspWorkerContext) {
64+
CkspClearContext(g_CkspWorkerContext);
65+
ExFreePoolWithTag(g_CkspWorkerContext, 'cksp');
66+
g_CkspWorkerContext = NULL;
67+
}
68+
return Status;
69+
}
70+

‎CustomKernelSignersPersistent/cksp_irp_null.c

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include "cksp_defs.h"
2+
3+
NTSTATUS NTAPI IrpNullHandler(_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp) {
4+
UNREFERENCED_PARAMETER(DeviceObject);
5+
6+
Irp->IoStatus.Information = 0;
7+
Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
8+
9+
IoCompleteRequest(Irp, IO_NO_INCREMENT);
10+
return STATUS_NOT_SUPPORTED;
11+
}
12+

0 commit comments

Comments
 (0)