nefarius/SmartArrayControllerTool
1
0
Fork 0
Code

Added more display friendly dumping

Browse Source
This commit is contained in:
Benjamin Höglinger-Stelzer 2023-06-25 16:46:11 +02:00
parent 6181e8632c
commit 1ef60bc4c5
2 changed files with 33 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -6,6 +6,10 @@ Trying to figure out which requests the [HP ProLiant Array Configuration Utility
Heavily work in progress 🔥
## Details
The ACU sends a couple of `IOCTL_SCSI_MINIPORT` IOCTLs with custom payloads on controller selection;
## 3rd party sources
- [HP ProLiant Array Configuration Utility for Windows 64-bit](https://support.hpe.com/connect/s/softwaredetails?language=en_US&softwareId=MTX_669f83062c7b492083c2aa7125)

28
SmartArrayControllerTool/SmartArrayControllerTool.cpp
View File

@ -17,12 +17,16 @@
// STL
//
#include <algorithm>
#include <codecvt>
#include <iomanip>
#include <iostream>
#include <locale>
#include <sstream>
#include <vector>
std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
//
// Sends a sample request, sniffed from the official HP Array Configuration Utility
//
@ -72,6 +76,16 @@ void MiniportExample(HANDLE handle)
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
PSRB_IO_CONTROL pIoControl = (PSRB_IO_CONTROL)&payload[0];
std::wcout << L"[I] - HeaderLength: " << std::dec << pIoControl->HeaderLength << std::endl;
std::wcout << L"[I] - Signature: " << converter.from_bytes((const char*)pIoControl->Signature) << std::endl;
std::wcout << L"[I] - Timeout: " << std::dec << pIoControl->Timeout << std::endl;
std::wcout << L"[I] - ControlCode: " << std::hex << pIoControl->ControlCode << std::endl;
std::wcout << L"[I] - ReturnCode: " << std::dec << pIoControl->ReturnCode << std::endl;
std::wcout << L"[I] - Length: " << std::dec << pIoControl->Length << std::endl;
std::wcout << std::endl;
DWORD bytesReturned = 0;
BOOL ret = DeviceIoControl(
handle,
@ -87,8 +101,20 @@ void MiniportExample(HANDLE handle)
if (ret)
{
std::wcout << L"Request succeeded" << std::endl;
std::wcout << std::endl;
const std::vector<char> buffer((PUCHAR)payload, (PUCHAR)payload + ARRAYSIZE(payload));
std::wcout << L"[O] - HeaderLength: " << std::dec << pIoControl->HeaderLength << std::endl;
std::wcout << L"[O] - Signature: " << converter.from_bytes((const char*)pIoControl->Signature) << std::endl;
std::wcout << L"[O] - Timeout: " << std::dec << pIoControl->Timeout << std::endl;
std::wcout << L"[O] - ControlCode: " << std::hex << pIoControl->ControlCode << std::endl;
std::wcout << L"[O] - ReturnCode: " << std::dec << pIoControl->ReturnCode << std::endl;
std::wcout << L"[O] - Length: " << std::dec << pIoControl->Length << std::endl;
std::wcout << std::endl;
//
// Skips sizeof(SRB_IO_CONTROL) and only dumps the data buffer afterwards
//
const std::vector<char> buffer((PUCHAR)payload + pIoControl->HeaderLength, (PUCHAR)payload + pIoControl->HeaderLength + pIoControl->Length);
std::wostringstream ss;