A
A
Artemy Koshar2020-06-14 16:06:29
UEFI
Artemy Koshar, 2020-06-14 16:06:29

Allocation of executable memory?

Not so long ago I started learning programming for EFI Shell drivers.
As it was understandable, I ran into confusion, I ran tests on Windows 1903 and memory allocation worked successfully.
As soon as I switched to version 1909, I encountered the PAGE_FAULT_IN_NONPAGED_AREA error, part of the code:

Client:

void* local_image_base = VirtualAlloc(nullptr, image_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
  uint64_t kernel_image_base = efi_driver::AllocatePool(iqvw64e_device_handle, nt::NonPagedPool, image_size);//Выделяем исполняемый пул
  
  do
  {
    if (!kernel_image_base)
    {
      std::cout << "[-] Ошибка при выделение памяти" << std::endl;
      break;
    }
    memcpy(local_image_base, raw_image.data(), nt_headers->OptionalHeader.SizeOfHeaders);
    const PIMAGE_SECTION_HEADER current_image_section = IMAGE_FIRST_SECTION(nt_headers);
    for (auto i = 0; i < nt_headers->FileHeader.NumberOfSections; ++i)
    {
      auto local_section = reinterpret_cast<void*>(reinterpret_cast<uint64_t>(local_image_base) + current_image_section[i].VirtualAddress);
      memcpy(local_section, reinterpret_cast<void*>(reinterpret_cast<uint64_t>(raw_image.data()) + current_image_section[i].PointerToRawData), current_image_section[i].SizeOfRawData);
    }
    RelocateImageByDelta(portable_executable::GetRelocs(local_image_base), kernel_image_base - nt_headers->OptionalHeader.ImageBase);
    
    if (!ResolveImports(iqvw64e_device_handle, portable_executable::GetImports(local_image_base)))
    {
      std::cout << "[-] Ошибка при исправление импорта" << std::endl;
      break;
    }

    if (!efi_driver::WriteMemory(iqvw64e_device_handle, kernel_image_base, local_image_base, image_size))
    {
      std::cout << "[-] Ошибка записи в память" << std::endl;
      break;
    }

    VirtualFree(local_image_base, 0, MEM_RELEASE);

    const uint64_t address_of_entry_point = kernel_image_base + nt_headers->OptionalHeader.AddressOfEntryPoint;
    long status = 0; // NTSTATUS
    efi_driver::MemoryCommand* cmd = new efi_driver::MemoryCommand();
    cmd->operation = 5;
    cmd->magic = COMMAND_MAGIC;

    uintptr_t data[10];
    data[0] = address_of_entry_point;
    data[1] = (uintptr_t)&status;

    memcpy(&cmd->data, &data[0], sizeof(data));

    efi_driver::SendCommand(cmd);//Ошибка


Driver:
if (cmd->operation == 0) 
    {
        CopyMem(cmd->data[0], cmd->data[1], cmd->size);    

        return EFI_SUCCESS;
    }

    // Вызов ExAllocatePool
    if (cmd->operation == 1) 
    {
        void* function = cmd->data[0]; // Получение адреса функции (через клиент)
        ExAllocatePool exalloc = (ExAllocatePool)function;
        int temp = cmd->data[1];
        uintptr_t allocbase = exalloc(temp, cmd->data[2]);
        *(uintptr_t*)cmd->data[3] = allocbase;
    }

    // Вызов ExFreePool
    if (cmd->operation == 2) 
    {
        void* function = cmd->data[0];
        ExFreePool exfree = (ExFreePool)function;
        exfree(cmd->data[1]);
    }

    // Вызов любой функции (__stdcall)
    if (cmd->operation == 3) 
    {
        void* function = cmd->data[0];
        StandardFuncStd stand = (StandardFuncStd)function;
        stand();
    }

    // Вызов любой функции (__fastcall)
    if (cmd->operation == 4) 
    {
        void* function = cmd->data[0];
        StandardFuncFast stand = (StandardFuncFast)function;
        stand();
    }

    // Вызов точки входа в драйвер
    if (cmd->operation == 5) 
    {
        void* function = cmd->data[0];
        DriverEntry entry = (DriverEntry)function;
        int status = entry(0, 0);
        *(int*)cmd->data[1] = status;
    }


Error (photo)
5ee6209ac6227885244235.png

Processor: Intel i9-9900k
Motherboard: Z390

Any solutions to the problem?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question