voidmap - GitLite

KO | EN

gitlite — search

#python #hacktoberfest #react #golang #android #deep-learning #linux #macos #java #windows #vue #pytorch #ios #open-source

voidmap

(★ 103)

Using CVE-2021-40449 to manual map kernel mode driver

File Explorer

Download Latest Version (.zip)

- - caller.c
  - caller.h
  - console.c
  - console.h
  - general.h
  - main.c
  - mapper.c
  - mapper.h
  - utils.c
  - utils.h
  - voidmap.vcxproj
  - voidmap.vcxproj.filters
- voidmap.sln
.gitignore
LICENSE.txt
README.md

# Installation Guide

1. Get the code

git clone https://github.com/SamuelTulach/voidmap

Downloads the entire project code from GitHub to your computer.

cd voidmap

Moves into the project folder you just downloaded.

2. .NET

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
.NET SDK The SDK required for the dotnet command.

cd voidmap

This project's files live in a subfolder, so move into it first.

dotnet restore

Downloads the packages the project depends on.

dotnet run

Builds the project and runs it immediately.

✅ After dotnet run, check the message or address shown in the terminal.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# voidmap
A very simple driver manual mapper that exploits CVE-2021-40449 to get arbitrary function executed at a given address with a single given argument. It's based on an [expoit PoC CallbackHell](https://github.com/ly4k/CallbackHell). Tested on Windows 10 Pro For Workstations 1809 17763.379 (64-bit), but realistically anything around that time should be supported.

It does the following:
- Disables SMEP (and possibly SMAP) by rewriting cr4 register value
- Jumps into usermode code that manual maps the desired driver
- Enables SMEP (and possibly SMAP) again

There are two main problems with this approach:
- Manual mapped driver will be in a pool allocated by ExAllocatePool. If you want to use this for anything more serious you should consider finding a better way of memory allocation so it can't be dumped so easily.
- There is no easy way to read the original cr4 value which means that I had to hardcode the value that was there on my system. While it *should* be the same for most modern CPUs, you should still double-check that the value is correct.

Video:

[![IMAGE ALT TEXT HERE](https://img.youtube.com/vi/9zHR2Lz1GrM/0.jpg)](https://www.youtube.com/watch?v=9zHR2Lz1GrM)