Skip to content

Instantly share code, notes, and snippets.

@Pai-Po

Pai-Po/IoCreateDeviceSecure.c

Last active December 17, 2019 02:57
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Pai-Po/a1f1c02d2438beb0c7b2e67a8e8d14d5 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Pai-Po/a1f1c02d2438beb0c7b2e67a8e8d14d5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Pai-Po revised this gist Dec 17, 2019. 1 changed file with 6 additions and 2 deletions.
    8 changes: 6 additions & 2 deletions IoCreateDeviceSecure.c
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,8 @@

    // Copyright (c) 2019 Po. All rights reserved.
    // Created on 2019-12-16
    // Author: Po


    {
    status = IoCreateDevice(
    DrvObj,
    @@ -39,7 +43,7 @@
    *RtlSubAuthoritySid( pUserSID, 3 ) = 3914385833;
    *RtlSubAuthoritySid( pUserSID, 4 ) = 1000;
    SetObjectSID( hFile, pUserSID );
    ExFreePoolWithTag( pUserSID );
    ExFreePoolWithTag( pUserSID, 'OPOP');
    ObCloseHandle( hFile, KernelMode );
    }
    }
  2. Pai-Po renamed this gist Dec 17, 2019. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → IoCreateDeviceSecure.c
    View file
    File renamed without changes.
  3. Pai-Po created this gist Dec 17, 2019.
    117 changes: 117 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,117 @@

    {
    status = IoCreateDevice(
    DrvObj,
    0,
    &ustrDevName,
    FILE_DEVICE_UNKNOWN,
    0,
    FALSE,
    &pDevObj );
    if ( NT_SUCCESS( status ) ) {
    POBJECT_TYPE* pObjType;
    HANDLE hFile;
    UNICODE_STRING ustrName;
    RtlInitUnicodeString( &ustrName, L"IoDeviceObjectType" );
    pObjType = (POBJECT_TYPE*)MmGetSystemRoutineAddress( &ustrName );

    status = ObOpenObjectByPointer(
    pDevObj,
    OBJ_KERNEL_HANDLE,
    NULL,
    0,
    *pObjType,
    KernelMode,
    &hFile );
    if ( NT_SUCCESS( status ) ) {
    //S-1-5-21-2919905370-567116316-3914385833-1000
    PSID pUserSID = NULL;
    ULONG ulSubAuthCont = 5;
    SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
    ULONG ulSID = sizeof( SID ) + ( ulSubAuthCont - 1 ) * sizeof( ULONG );
    pUserSID = ExAllocatePoolWithTag( NonPagedPool, ulSID, 'OPOP' );
    if ( pUserSID ) {
    RtlZeroMemory( pUserSID, ulSID );
    RtlInitializeSid( pUserSID, &NtAuthority, (UCHAR)ulSubAuthCont );
    *RtlSubAuthoritySid( pUserSID, 0 ) = 21;
    *RtlSubAuthoritySid( pUserSID, 1 ) = 2919905370;
    *RtlSubAuthoritySid( pUserSID, 2 ) = 567116316;
    *RtlSubAuthoritySid( pUserSID, 3 ) = 3914385833;
    *RtlSubAuthoritySid( pUserSID, 4 ) = 1000;
    SetObjectSID( hFile, pUserSID );
    ExFreePoolWithTag( pUserSID );
    ObCloseHandle( hFile, KernelMode );
    }
    }
    }
    }

    /* currently support only one sid */
    NTSTATUS SetObjectSID( HANDLE FileHandle, PSID Sid ) {
    PVOID pDacl = NULL;
    ULONG ulDaclLen = 0;
    SECURITY_DESCRIPTOR sa;
    NTSTATUS status = STATUS_UNSUCCESSFUL;

    status = RtlCreateSecurityDescriptor(
    &sa,
    SECURITY_DESCRIPTOR_REVISION );

    if ( !NT_SUCCESS( status ) )
    goto _error;

    ulDaclLen = sizeof( ACL ) + sizeof( ACCESS_ALLOWED_ACE ) + RtlLengthSid( Sid );

    pDacl = ExAllocatePoolWithTag( PagedPool, ulDaclLen, 'lcaD' );

    if ( pDacl == NULL ) {
    status = STATUS_INSUFFICIENT_RESOURCES;
    goto _error;
    }

    status = RtlCreateAcl( pDacl, ulDaclLen, ACL_REVISION );

    if ( !NT_SUCCESS( status ) )
    goto _error;


    status = RtlAddAccessAllowedAce( pDacl,
    ACL_REVISION,
    FILE_ALL_ACCESS,
    Sid );

    if ( !NT_SUCCESS( status ) )
    goto _error;

    status = RtlSetDaclSecurityDescriptor( &sa,
    TRUE,
    pDacl,
    FALSE );

    if ( !NT_SUCCESS( status ) )
    goto _error;

    sa.Control |= SE_DACL_PRESENT;
    sa.Control |= SE_DACL_DEFAULTED;
    sa.Control |= SE_DACL_PROTECTED;
    //sa.Control |= SE_SELF_RELATIVE;

    status = ZwSetSecurityObject(
    FileHandle,
    DACL_SECURITY_INFORMATION,
    &sa );
    if ( !NT_SUCCESS( status ) )
    goto _error;


    goto _exit;
    _error:
    _exit:

    if ( pDacl ) {
    ExFreePoolWithTag( pDacl, 'lcaD' );
    pDacl = NULL;
    }

    return status;
    }