diff --git a/FileDelete/FileDelete/FileDelete.inf b/FileDelete/FileDelete/FileDelete.inf deleted file mode 100644 index 22fc82d..0000000 --- a/FileDelete/FileDelete/FileDelete.inf +++ /dev/null @@ -1,32 +0,0 @@ -; -; FileDelete.inf -; - -[Version] -Signature="$WINDOWS NT$" -Class=System -ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} -Provider=%ManufacturerName% -DriverVer= -CatalogFile=FileDelete.cat - -[DestinationDirs] -DefaultDestDir = 12 - - -[SourceDisksNames] -1 = %DiskName%,,,"" - -[SourceDisksFiles] - - -[Manufacturer] -%ManufacturerName%=Standard,NT$ARCH$ - -[Standard.NT$ARCH$] - - -[Strings] -ManufacturerName="" ;TODO: Replace with your manufacturer name -ClassName="" -DiskName="FileDelete Source Disk" diff --git a/FileDelete/FileDelete/FileDelete.vcxproj b/FileDelete/FileDelete/FileDelete.vcxproj deleted file mode 100644 index 4d25d85..0000000 --- a/FileDelete/FileDelete/FileDelete.vcxproj +++ /dev/null @@ -1,163 +0,0 @@ - - - - - Debug - Win32 - - - Release - Win32 - - - Debug - x64 - - - Release - x64 - - - Debug - ARM - - - Release - ARM - - - Debug - ARM64 - - - Release - ARM64 - - - - {DD29F5EE-2A5A-4790-9C77-043EF43990BA} - {dd38f7fc-d7bd-488b-9242-7d8754cde80d} - v4.5 - 12.0 - Debug - Win32 - FileDelete - - - - Windows10 - true - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - false - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - true - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - false - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - true - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - false - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - true - WindowsKernelModeDriver10.0 - Driver - WDM - - - Windows10 - false - WindowsKernelModeDriver10.0 - Driver - WDM - - - - - - - - - - - DbgengKernelDebugger - - - DbgengKernelDebugger - - - DbgengKernelDebugger - true - - - DbgengKernelDebugger - true - - - DbgengKernelDebugger - - - DbgengKernelDebugger - - - DbgengKernelDebugger - - - DbgengKernelDebugger - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/FileDelete/FileDelete/ProcessReference.cpp b/FileDelete/FileDelete/ProcessReference.cpp index 59f2169..a8051f8 100644 --- a/FileDelete/FileDelete/ProcessReference.cpp +++ b/FileDelete/FileDelete/ProcessReference.cpp @@ -15,11 +15,17 @@ ProcessReference::~ProcessReference() { } -NTSTATUS ProcessReference::init(size_t pid, bool attach) { +NTSTATUS ProcessReference::init(size_t pid, bool attach) +{ CHECK(PsLookupProcessByProcessId(reinterpret_cast(pid), &m_process)); m_attach = attach; - if (attach) { - m_apc_state = (KAPC_STATE*)ExAllocatePool(NonPagedPool, sizeof(KAPC_STATE)); + if (attach) + { + m_apc_state = (KAPC_STATE*)ExAllocatePool2(NonPagedPool, sizeof(KAPC_STATE), '2cba'); + if (NULL == m_apc_state) + m_apc_state = (KAPC_STATE*)ExAllocatePoolZero(NonPagedPool, sizeof(KAPC_STATE), '2cba'); + if (NULL == m_apc_state) + return STATUS_MEMORY_NOT_ALLOCATED; KeStackAttachProcess(m_process, m_apc_state); } return STATUS_SUCCESS; diff --git a/FileDelete/FileDelete/handle.cpp b/FileDelete/FileDelete/handle.cpp index 608b822..5e74c73 100644 --- a/FileDelete/FileDelete/handle.cpp +++ b/FileDelete/FileDelete/handle.cpp @@ -5,21 +5,25 @@ extern "C" NTSTATUS NTAPI ZwQuerySystemInformation(IN size_t SystemInformationCl IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL); -SYSTEM_HANDLE_INFORMATION* get_all_handles() { +SYSTEM_HANDLE_INFORMATION* get_all_handles() +{ size_t handles_allocation_size = 0; PVOID handles_pool = nullptr; - while (true) { + for (;;) + { handles_allocation_size += 0x10000; - handles_pool = ExAllocatePool(PagedPool, handles_allocation_size); + handles_pool = ExAllocatePool2(PagedPool, handles_allocation_size, '1cba'); + if (NULL == handles_pool) + handles_pool = ExAllocatePoolZero(PagedPool, handles_allocation_size, '1cba'); + if (NULL == handles_pool) + break; auto status = ZwQuerySystemInformation(SystemHandleInformation, handles_pool, (ULONG)handles_allocation_size, nullptr); - if (status == STATUS_INFO_LENGTH_MISMATCH) { + if (status == STATUS_INFO_LENGTH_MISMATCH) ExFreePool(handles_pool); - } - else { + else break; - } } return (SYSTEM_HANDLE_INFORMATION*)handles_pool; } diff --git a/FileDelete/FileDeleteCom/FileDeleteCom.vcxproj b/FileDelete/FileDeleteCom/FileDeleteCom.vcxproj deleted file mode 100644 index 1208b20..0000000 --- a/FileDelete/FileDeleteCom/FileDeleteCom.vcxproj +++ /dev/null @@ -1,149 +0,0 @@ - - - - - Debug - Win32 - - - Release - Win32 - - - Debug - x64 - - - Release - x64 - - - - 16.0 - Win32Proj - {b9fd992d-c853-434b-97f3-cda5da0d3e56} - FileDeleteCom - 10.0 - - - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - - - - - - - - - - - - - - - - - - - - - true - - - false - - - true - - - false - - - - Level3 - true - WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - - - - - Level3 - true - true - true - WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - - - - Level3 - true - _DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - MultiThreadedDebug - - - Console - true - - - - - Level3 - true - true - true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - MultiThreaded - - - Console - true - true - true - - - - - - - - - \ No newline at end of file