Advertisement
SleepyMode

Untitled

Feb 10th, 2023 (edited)
2,066
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. VOID FxCmdHandleRead()
  2. {
  3.     FxEvtSignalPending();
  4.     if (!FxEvtWaitForDelivered())
  5.     {
  6.         DbgPrintEx(0, 0, "[Flaxen][WARN] Read request never received additional timeout.\n");
  7.         return;
  8.     }
  9.  
  10.     FxSmRead();
  11.     PFX_READ_COMMAND ReadCommand = (PFX_READ_COMMAND)FxSmGetSharedSection();
  12.  
  13.     PEPROCESS Process;
  14.     NTSTATUS Status = PsLookupProcessByProcessId((HANDLE)ReadCommand->SourceProcessId, &Process);
  15.     if (!NT_SUCCESS(Status))
  16.     {
  17.         DbgPrintEx(0, 0, "[FLAXEN][FAIL] PsLookupProcessByProcessId failed with code: %d\n", Status);
  18.         ObDereferenceObject(Process);
  19.         return;
  20.     }
  21.  
  22.     PVOID Buffer = ExAllocatePool2(POOL_FLAG_PAGED, ReadCommand->Size, 'enoN');
  23.     if (Buffer == NULL)
  24.     {
  25.         DbgPrintEx(0, 0, "[FLAXEN][FAIL] Failed to allocate buffer for read operation!\n");
  26.         return;
  27.     }
  28.  
  29.     KAPC_STATE ApcState;
  30.     KeStackAttachProcess(Process, &ApcState);
  31.  
  32.     SIZE_T ReturnedSize;
  33.     MmCopyVirtualMemory(Process, ReadCommand->SourceAddress, PsGetCurrentProcess(), Buffer, ReadCommand->Size, KernelMode, &ReturnedSize);
  34.  
  35.     KeUnstackDetachProcess(&ApcState);
  36.  
  37.     if (!NT_SUCCESS(Status) || !ReturnedSize)
  38.     {
  39.         DbgPrintEx(0, 0, "[FLAXEN][WARN] MmCopyVirtualMemory failed: (Status %d | Size %d)\n", Status, ReturnedSize);
  40.         return;
  41.     }
  42.  
  43.     ULONGLONG Size = ReadCommand->Size;
  44.  
  45.     FxSmRead();
  46.     if (!memcpy(FxSmGetSharedSection(), Buffer, Size))
  47.     {
  48.         DbgPrintEx(0, 0, "[FLAXEN][FAIL] Failed to copy read result to the shared buffer.\n");
  49.         return;
  50.     }
  51.  
  52.     FxEvtReset();
  53.     FxEvtSignalComplete();
  54. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement