Skip to content

Some mistakes #2

Description

@vbty

Hello,
I think there is a mistake in the script.
The script find WdfVersionBind function firstly.
Then it use WdfVersionBind function's argument to get WDF_BIND_INFO address.
And get the global WDFFUNCTIONS pointer from the WDF_BIND_INFO offset 0x20.

But i noticed the type of the field 0x20 in WDF_BIND_INFO should be WDFFUNCTIONS ** not WDFFUNCTIONS*.

.text:0000000140001628                 mov     eax, 8
.text:000000014000162D                 imul    rax, 74h ; 't'
.text:0000000140001631                 mov     rcx, cs:g_WdfF_Functions
.text:0000000140001638                 mov     rax, [rcx+rax]
.text:000000014000163C                 mov     [rsp+58h+var_18], rax
...
.text:000000014000166E                 mov     rax, [rsp+58h+var_18]
.text:0000000140001673                 call    cs:__guard_dispatch_icall_fptr

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions