diff --git a/include/Domito.h b/include/Domito.h index 1fc757b..27d24cb 100644 --- a/include/Domito.h +++ b/include/Domito.h @@ -3,6 +3,27 @@ #include +/* ___ + * / __|___ _ __ _ __ ___ _ _ + * | (__/ _ \ ' \| ' \/ _ \ ' \ + * \___\___/_|_|_|_|_|_\___/_||_| + * + */ + +// +// Library initialization tasks. Call one in your DriverEntry +// +_IRQL_requires_max_(PASSIVE_LEVEL) +EXTERN_C +void +DomitoInit(); + +_IRQL_requires_max_(PASSIVE_LEVEL) +EXTERN_C +void +DomitoShutdown(); + + /* __ __ __ __ _ * | \/ |___ _ __ ___ _ _ _ _ | \/ |__ _ _ _ __ _ __ _ ___ _ __ ___ _ _| |_ * | |\/| / -_) ' \/ _ \ '_| || | | |\/| / _` | ' \/ _` / _` / -_) ' \/ -_) ' \ _| diff --git a/src/Domito.cpp b/src/Domito.cpp index c628323..ff1a0a0 100644 --- a/src/Domito.cpp +++ b/src/Domito.cpp @@ -10,6 +10,61 @@ static QUERY_INFO_PROCESS ZwQueryInformationProcess; +static STRING G_FN_CiFreePolicyInfo = RTL_CONSTANT_STRING("CiFreePolicyInfo"); +static STRING G_FN_CiCheckSignedFile = RTL_CONSTANT_STRING("CiCheckSignedFile"); +static STRING G_FN_CiVerifyHashInCatalog = RTL_CONSTANT_STRING("CiVerifyHashInCatalog"); +static STRING G_FN_CiGetCertPublisherName = RTL_CONSTANT_STRING("CiGetCertPublisherName"); +static STRING G_FN_CiSetTrustedOriginClaimId = RTL_CONSTANT_STRING("CiSetTrustedOriginClaimId"); +static STRING G_FN_CiValidateFileObject = RTL_CONSTANT_STRING("CiValidateFileObject"); + +_IRQL_requires_max_(PASSIVE_LEVEL) +void +DomitoInit() +{ + const STRING ciModuleName = RTL_CONSTANT_STRING("\\SystemRoot\\system32\\CI.dll"); + PVOID driverBaseAddress = NULL, functionAddress = NULL; + + if (NT_SUCCESS(DomitoFindModuleBaseAddress(ciModuleName, &driverBaseAddress))) + { + if (NT_SUCCESS(DomitoFindExportedFunctionAddress(driverBaseAddress, G_FN_CiFreePolicyInfo, &functionAddress))) + { + G_CI.CiFreePolicyInfo = (t_CiFreePolicyInfo)functionAddress; + } + + if (NT_SUCCESS(DomitoFindExportedFunctionAddress(driverBaseAddress, G_FN_CiCheckSignedFile, &functionAddress))) + { + G_CI.CiCheckSignedFile = (t_CiCheckSignedFile)functionAddress; + } + + if (NT_SUCCESS(DomitoFindExportedFunctionAddress(driverBaseAddress, G_FN_CiVerifyHashInCatalog, &functionAddress))) + { + G_CI.CiVerifyHashInCatalog = (t_CiVerifyHashInCatalog)functionAddress; + } + + if (NT_SUCCESS(DomitoFindExportedFunctionAddress(driverBaseAddress, G_FN_CiGetCertPublisherName, &functionAddress))) + { + G_CI.CiGetCertPublisherName = (t_CiGetCertPublisherName)functionAddress; + } + + if (NT_SUCCESS(DomitoFindExportedFunctionAddress(driverBaseAddress, G_FN_CiSetTrustedOriginClaimId, &functionAddress))) + { + G_CI.CiSetTrustedOriginClaimId = (t_CiSetTrustedOriginClaimId)functionAddress; + } + + if (NT_SUCCESS(DomitoFindExportedFunctionAddress(driverBaseAddress, G_FN_CiValidateFileObject, &functionAddress))) + { + G_CI.CiValidateFileObject = (t_CiValidateFileObject)functionAddress; + } + } +} + +_IRQL_requires_max_(PASSIVE_LEVEL) +void +DomitoShutdown() +{ + +} + _Success_(return == STATUS_SUCCESS) _Must_inspect_result_