OD: Kernel Exploit

        if ( inputBufferLength >= 4 && outputBufferLength >= 4 )
        {
            *(ULONG *)UserBuffer = *(ULONG *)Type3InputBuffer;
            IoStatus->Information = sizeof(ULONG);
        }

 1 // extracted from haltypes.h
 2 
 3 typedef struct {
 4   ULONG                       Version;
 5   pHalQuerySystemInformation  HalQuerySystemInformation;
 6   pHalSetSystemInformation    HalSetSystemInformation;
 7   pHalQueryBusSlots           HalQueryBusSlots;
 8   ULONG                       Spare1;
 9   pHalExamineMBR              HalExamineMBR;
10 #if 1 /* Not present in WDK 7600 */
11   pHalIoAssignDriveLetters    HalIoAssignDriveLetters;
12 #endif
13   pHalIoReadPartitionTable    HalIoReadPartitionTable;
14   pHalIoSetPartitionInformation HalIoSetPartitionInformation;
15   pHalIoWritePartitionTable   HalIoWritePartitionTable;
16   pHalHandlerForBus           HalReferenceHandlerForBus;
17   pHalReferenceBusHandler     HalReferenceBusHandler;
18   pHalReferenceBusHandler     HalDereferenceBusHandler;
19   pHalInitPnpDriver           HalInitPnpDriver;
20   pHalInitPowerManagement     HalInitPowerManagement;
21   pHalGetDmaAdapter           HalGetDmaAdapter;
22   pHalGetInterruptTranslator  HalGetInterruptTranslator;
23   pHalStartMirroring          HalStartMirroring;
24   pHalEndMirroring            HalEndMirroring;
25   pHalMirrorPhysicalMemory    HalMirrorPhysicalMemory;
26   pHalEndOfBoot               HalEndOfBoot;
27   pHalMirrorVerify            HalMirrorVerify;
28   pHalGetAcpiTable            HalGetCachedAcpiTable;
29   pHalSetPciErrorHandlerCallback  HalSetPciErrorHandlerCallback;
30 #if defined(_IA64_)
31   pHalGetErrorCapList         HalGetErrorCapList;
32   pHalInjectError             HalInjectError;
33 #endif
34 } HAL_DISPATCH, *PHAL_DISPATCH;

 1 NTSTATUS
 2 NTAPI
 3 NtQueryIntervalProfile(IN KPROFILE_SOURCE ProfileSource,
 4                        OUT PULONG Interval)
 5 {
 6     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 7     ULONG ReturnInterval;
 8     NTSTATUS Status = STATUS_SUCCESS;
 9     PAGED_CODE();
10 
11     /* Check if we were called from user-mode */
12     if (PreviousMode != KernelMode)
13     {
14         /* Enter SEH Block */
15         _SEH2_TRY
16         {
17             /* Validate interval */
18             ProbeForWriteUlong(Interval);
19         }
20         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
21         {
22             /* Return the exception code */
23             _SEH2_YIELD(return _SEH2_GetExceptionCode());
24         }
25         _SEH2_END;
26     }
27 
28     /* Query the Interval */
29     ReturnInterval = (ULONG)KeQueryIntervalProfile(ProfileSource);
30 
31     /* Enter SEH block for return */
32     _SEH2_TRY
33     {
34         /* Return the data */
35         *Interval = ReturnInterval;
36     }
37     _SEH2_EXCEPT(ExSystemExceptionFilter())
38     {
39         /* Get the exception code */
40         Status = _SEH2_GetExceptionCode();
41     }
42     _SEH2_END;
43 
44     /* Return Success */
45     return Status;
46 }

 1 typedef enum _KPROFILE_SOURCE
 2 {
 3     ProfileTime,
 4     ProfileAlignmentFixup,
 5     ProfileTotalIssues,
 6     ProfilePipelineDry,
 7     ProfileLoadInstructions,
 8     ProfilePipelineFrozen,
 9     ProfileBranchInstructions,
10     ProfileTotalNonissues,
11     ProfileDcacheMisses,
12     ProfileIcacheMisses,
13     ProfileCacheMisses,
14     ProfileBranchMispredictions,
15     ProfileStoreInstructions,
16     ProfileFpInstructions,
17     ProfileIntegerInstructions,
18     Profile2Issue,
19     Profile3Issue,
20     Profile4Issue,
21     ProfileSpecialInstructions,
22     ProfileTotalCycles,
23     ProfileIcacheIssues,
24     ProfileDcacheAccesses,
25     ProfileMemoryBarrierCycles,
26     ProfileLoadLinkedIssues,
27     ProfileMaximum
28 } KPROFILE_SOURCE;

 1 ULONG NTAPI KeQueryIntervalProfile    (    IN KPROFILE_SOURCE     ProfileSource    )    
 2 Definition at line 219 of file profobj.c.
 3 
 4 {
 5     HAL_PROFILE_SOURCE_INFORMATION ProfileSourceInformation;
 6     ULONG ReturnLength, Interval;
 7     NTSTATUS Status;
 8 
 9     /* Check what profile this is */
10     if (ProfileSource == ProfileTime)
11     {
12         /* Return the time interval */
13         Interval = KiProfileTimeInterval;
14     }
15     else if (ProfileSource == ProfileAlignmentFixup)
16     {
17         /* Return the alignment interval */
18         Interval = KiProfileAlignmentFixupInterval;
19     }
20     else
21     {
22         /* Request it from HAL */
23         ProfileSourceInformation.Source = ProfileSource;
24         Status = HalQuerySystemInformation(HalProfileSourceInformation,
25                                            sizeof(HAL_PROFILE_SOURCE_INFORMATION),
26                                            &ProfileSourceInformation,
27                                            &ReturnLength);
28 
29         /* Check if HAL handled it and supports this profile */
30         if (NT_SUCCESS(Status) && (ProfileSourceInformation.Supported))
31         {
32             /* Get the interval */
33             Interval = ProfileSourceInformation.Interval;
34         }
35         else
36         {
37             /* Unsupported or invalid source, fail */
38             Interval = 0;
39         }
40     }
41 
42     /* Return the interval we got */
43     return Interval;
44 }

* 提权到 SYSTEM：修改当前进程的 token 为 SYSTEM 进程的 token，这样当前进程便具备了 SYSTEM 权限。
* 恢复内核 Hook/Inline Hook：大部分安全软件通过 Hook 系统内核函数实现防御。可以通过恢复这些 Hook 来突破安全软件，甚至瓦解整个防御体系。
* 添加调用门/中断门/任务门/陷阱门：四门机制是出入 Ring0/Ring3 的重要手段。在系统中成功添加一个门，就能在后续代码中*出入 Ring0、Ring3。