Skip to content

Commit

Permalink
Make code to support 20H2.
Browse files Browse the repository at this point in the history
  • Loading branch information
@BlackINT3
BlackINT3 committed Nov 19, 2020
1 parent cf0aebd commit e797d24
Show file tree
Hide file tree
Showing 4 changed files with 136 additions and 13 deletions.
32 changes: 31 additions & 1 deletion src/OpenArk/kernel/kernel.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,36 @@ void Kernel::onTabChanged(int index)
CommonMainTabObject::onTabChanged(index);
}

std::string OsReleaseNumber()
{
/*
//c++11
std::map<DWORD, DWORD> tables = {
{ 10240, 1507 }, { 10586, 1511} ,{ 14393, 1607 } ,{ 15063, 1703 } ,{ 16299, 1709 } ,{ 17134, 1803 } ,
{ 17763, 1809 }, { 18362, 1903 } ,{ 18363, 1909 } ,{ 19041, 2004 }, { 19042, 20H2 }
};*/

std::pair<DWORD, std::string> pairs[] = {
std::make_pair(10240, "1507"),
std::make_pair(10586, "1511"),
std::make_pair(14393, "1607"),
std::make_pair(15063, "1703"),
std::make_pair(16299, "1709"),
std::make_pair(17134, "1803"),
std::make_pair(17763, "1809"),
std::make_pair(18362, "1903"),
std::make_pair(18363, "1909"),
std::make_pair(19041, "2004"),
std::make_pair(19042, "20H2"),
};
std::map<DWORD, std::string> tables(pairs, pairs+_countof(pairs));

DWORD build = UNONE::OsBuildNumber();
auto it = tables.find(build);
if (it != tables.end())
return it->second;
return "";
}
void Kernel::InitKernelEntryView()
{
kerninfo_model_ = new QStandardItemModel;
Expand Down Expand Up @@ -234,7 +264,7 @@ void Kernel::InitKernelEntryView()
auto major = UNONE::OsMajorVer();
AddSummaryUpItem(tr("MajorVersion"), DWordToDecQ(major));
AddSummaryUpItem(tr("MiniorVersion"), DWordToDecQ(UNONE::OsMinorVer()));
if (major >= 10) AddSummaryUpItem(tr("ReleaseNumber"), DWordToDecQ(UNONE::OsReleaseNumber()));
if (major >= 10) AddSummaryUpItem(tr("ReleaseNumber"), StrToQ(OsReleaseNumber()));
AddSummaryUpItem(tr("BuildNumber"), DWordToDecQ(UNONE::OsBuildNumber()));
AddSummaryUpItem(tr("MajorServicePack"), DWordToDecQ(info.wServicePackMajor));
AddSummaryUpItem(tr("MiniorServicePack"), DWordToDecQ(info.wServicePackMinor));
Expand Down
66 changes: 65 additions & 1 deletion src/OpenArkDrv/common/common.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,76 @@

ARK_DRIVER ArkDrv;

/*++
Description:
get os version
Arguments:
void
Return:
NTOS_VERSION
--*/
NTOS_VERSION_X OsNtVersion()
{
RTL_OSVERSIONINFOEXW info;
if (!KNONE::OsGetVersionInfo(info)) return _NTOS_UNKNOWN;

switch (info.dwMajorVersion) {
case 5: {
if (info.dwMinorVersion == 1) {
if (info.wServicePackMajor == 1) return _NTOS_WINXPSP1;
if (info.wServicePackMajor == 2) return _NTOS_WINXPSP2;
if (info.wServicePackMajor == 3) return _NTOS_WINXPSP3;
return _NTOS_WINXP;
}
if (info.dwMinorVersion == 2) {
if (info.wServicePackMajor == 1) return _NTOS_WIN2003SP1;
if (info.wServicePackMajor == 2) return _NTOS_WIN2003SP2;
return _NTOS_WIN2003;
}
break;
} case 6: {
if (info.dwMinorVersion == 0) {
if (info.wServicePackMajor == 1) return _NTOS_WINVISTASP1;
if (info.wServicePackMajor == 2) return _NTOS_WINVISTASP2;
return _NTOS_WINVISTA;
}
if (info.dwMinorVersion == 1) {
if (info.wServicePackMajor == 1) return _NTOS_WIN7SP1;
return _NTOS_WIN7;
}
if (info.dwMinorVersion == 2) {
return _NTOS_WIN8;
}
if (info.dwMinorVersion == 3) {
return _NTOS_WIN81;
}
break;
} case 10: {
if (info.dwBuildNumber == 10240) return _NTOS_WIN10_1507;
if (info.dwBuildNumber == 10586) return _NTOS_WIN10_1511;
if (info.dwBuildNumber == 14393) return _NTOS_WIN10_1607;
if (info.dwBuildNumber == 15063) return _NTOS_WIN10_1703;
if (info.dwBuildNumber == 16299) return _NTOS_WIN10_1709;
if (info.dwBuildNumber == 17134) return _NTOS_WIN10_1803;
if (info.dwBuildNumber == 17763) return _NTOS_WIN10_1809;
if (info.dwBuildNumber == 18362) return _NTOS_WIN10_1903;
if (info.dwBuildNumber == 18363) return _NTOS_WIN10_1909;
if (info.dwBuildNumber == 19041) return _NTOS_WIN10_2004;
if (info.dwBuildNumber == 19042) return _NTOS_WIN10_20H2;
}
default:
break;
}
return _NTOS_UNKNOWN;
}


BOOLEAN InitArkDriver(PDRIVER_OBJECT drvobj, PDEVICE_OBJECT devobj)
{
ArkDrv.drvobj = drvobj;
ArkDrv.devobj = devobj;

ArkDrv.ver = KNONE::OsNtVersion();
ArkDrv.ver = OsNtVersion();
ArkDrv.major = KNONE::OsMajorVersion();
ArkDrv.minor = KNONE::OsMinorVersion();
ArkDrv.build = KNONE::OsBuildNumber();
Expand Down
31 changes: 30 additions & 1 deletion src/OpenArkDrv/common/common.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,38 @@ typedef struct _ARK_DRIVER {

extern ARK_DRIVER ArkDrv;

typedef enum {
_NTOS_UNKNOWN,
_NTOS_WINXP,
_NTOS_WINXPSP1,
_NTOS_WINXPSP2,
_NTOS_WINXPSP3,
_NTOS_WIN2003,
_NTOS_WIN2003SP1,
_NTOS_WIN2003SP2,
_NTOS_WINVISTA,
_NTOS_WINVISTASP1,
_NTOS_WINVISTASP2,
_NTOS_WIN7,
_NTOS_WIN7SP1,
_NTOS_WIN8,
_NTOS_WIN81,
_NTOS_WIN10_1507, //10240
_NTOS_WIN10_1511, //10586
_NTOS_WIN10_1607, //14393
_NTOS_WIN10_1703, //15063
_NTOS_WIN10_1709, //16299
_NTOS_WIN10_1803, //17134
_NTOS_WIN10_1809, //17763
_NTOS_WIN10_1903, //18362
_NTOS_WIN10_1909, //18363
_NTOS_WIN10_2004, //19041
_NTOS_WIN10_20H2, //19042
} NTOS_VERSION_X, *PNTOS_VERSION_X;

BOOLEAN InitArkDriver(PDRIVER_OBJECT drvobj, PDEVICE_OBJECT devobj);

PVOID GetNtRoutineAddress(IN PCWSTR name);

NTSTATUS DuplicateInputBuffer(IN PIRP irp, PVOID &inbuf);
NTSTATUS ReleaseInputBuffer(IN PIRP irp, PVOID &inbuf);
NTSTATUS ReleaseInputBuffer(IN PIRP irp, PVOID &inbuf);
20 changes: 10 additions & 10 deletions src/OpenArkDrv/knotify/notify-lib.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ FORCEINLINE ULONG GetThreadNotifyMaximum()
}
FORCEINLINE ULONG GetImageNotifyMaximum()
{
if (ArkDrv.ver >= NTOS_WIN7SP1) return 64;
if (ArkDrv.ver >= _NTOS_WIN7SP1) return 64;
else return 8;
}
FORCEINLINE ULONG GetRegistryNotifyMaximum()
Expand All @@ -125,7 +125,7 @@ PEX_CALLBACK GetProcessNotifyCallback()

PEX_CALLBACK callback = NULL;
#ifdef _AMD64_
if (ArkDrv.ver >= NTOS_WINVISTA && ArkDrv.ver < NTOS_WIN7) {
if (ArkDrv.ver >= _NTOS_WINVISTA && ArkDrv.ver < _NTOS_WIN7) {
for (PUCHAR ptr1 = routine; ptr1 <= routine + 0x10; ptr1++) {
// e9 jmp
if (*ptr1 == 0xe9) {
Expand All @@ -143,7 +143,7 @@ PEX_CALLBACK GetProcessNotifyCallback()
}
}
}
} else if (ArkDrv.ver >= NTOS_WIN7 && ArkDrv.ver < NTOS_WIN8) {
} else if (ArkDrv.ver >= _NTOS_WIN7 && ArkDrv.ver < _NTOS_WIN8) {
for (PUCHAR ptr1 = routine; ptr1 <= routine + 0x10; ptr1++) {
// e9 jmp
if (*ptr1 == 0xe9) {
Expand All @@ -159,7 +159,7 @@ PEX_CALLBACK GetProcessNotifyCallback()
}
}
}
} else if (ArkDrv.ver >= NTOS_WIN8 && ArkDrv.ver < NTOS_WIN10_1507) {
} else if (ArkDrv.ver >= _NTOS_WIN8 && ArkDrv.ver < _NTOS_WIN10_1507) {
for (PUCHAR ptr1 = routine; ptr1 <= routine + 0x10; ptr1++) {
PUCHAR psp_routine = NULL;
//Win8 eb jmp
Expand All @@ -178,7 +178,7 @@ PEX_CALLBACK GetProcessNotifyCallback()
}
}
}
} else if (ArkDrv.ver >= NTOS_WIN10_1507) {
} else if (ArkDrv.ver >= _NTOS_WIN10_1507) {
//Win10 2004 0xe8 call
//Win10 1909 0xe8 call
//Win10 1903 0xe8 call
Expand Down Expand Up @@ -290,7 +290,7 @@ PEX_CALLBACK GetThreadNotifyCallback()

PEX_CALLBACK callback = NULL;
#ifdef _AMD64_
if (ArkDrv.ver >= NTOS_WINVISTA && ArkDrv.ver <= NTOS_WIN81) {
if (ArkDrv.ver >= _NTOS_WINVISTA && ArkDrv.ver <= _NTOS_WIN81) {
// lea rcx
for (PUCHAR ptr1 = routine; ptr1 <= routine + 0x30; ptr1++) {
if (*ptr1 == 0x48 && *(ptr1 + 1) == 0x8d && *(ptr1 + 2) == 0x0d) {
Expand All @@ -299,7 +299,7 @@ PEX_CALLBACK GetThreadNotifyCallback()
break;
}
}
} else if (ArkDrv.ver >= NTOS_WIN10_1507) {
} else if (ArkDrv.ver >= _NTOS_WIN10_1507) {
//Win10 2004 e8 call
//Win10 1909 e8 call
//Win10 1903 e8 call
Expand Down Expand Up @@ -391,9 +391,9 @@ BOOLEAN RemoveThreadNotify(ULONG64 routine)
PEX_CALLBACK GetImageNotifyCallback()
{
PUCHAR routine = NULL;
if (ArkDrv.ver >= NTOS_WINXP && ArkDrv.ver <= NTOS_WIN10_1703) {
if (ArkDrv.ver >= _NTOS_WINXP && ArkDrv.ver <= _NTOS_WIN10_1703) {
routine = (PUCHAR)GetNtRoutineAddress(L"PsSetLoadImageNotifyRoutine");
} else if (ArkDrv.ver >= NTOS_WIN10_1709 && ArkDrv.ver <= NTOS_WIN10_1903) {
} else if (ArkDrv.ver >= _NTOS_WIN10_1709 && ArkDrv.ver <= _NTOS_WIN10_20H2) {
routine = (PUCHAR)GetNtRoutineAddress(L"PsSetLoadImageNotifyRoutineEx");
}
if (!routine) return NULL;
Expand Down Expand Up @@ -477,7 +477,7 @@ PVOID GetRegistryNotifyCallback()
PVOID callback = NULL;

#ifdef _AMD64_
if (ArkDrv.ver >= NTOS_WINVISTA) {
if (ArkDrv.ver >= _NTOS_WINVISTA) {
// xor r8d, r8d
// lea rcx, CallbackListHead
for (PUCHAR ptr1 = routine; ptr1 <= routine + 0x100; ptr1++) {
Expand Down

0 comments on commit e797d24

Please sign in to comment.