WMI-PoC/SetupAPIWrapper.hpp at main · mbinns/WMI-PoC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
#pragma once
#include <phnt_windows.h>
#include "ExportInterface.hpp"

// Interface for setupapi.dll functions
class SetupAPIWrapper {
public:

    BOOL IReady = FALSE;

    SetupAPIWrapper() :
        pSetupDiGetClassDevsExW(IExport::LoadAndFindSingleExport("s.eidtplualp", "SeeeGtDvtiCssuDlsEWpax")),
        pSetupDiEnumDeviceInfo(IExport::LoadAndFindSingleExport("s.eidtplualp", "SneeEucItiminuDDvfpeo")),
        pSetupDiGetDeviceRegistryPropertyW(IExport::LoadAndFindSingleExport("s.eidtplualp", "SeRPWeGteeyrytiDcgrotuDeiitprpvse")),
        pSetupDiDestroyDeviceInfoList(IExport::LoadAndFindSingleExport("s.eidtplualp", "SevLeDseioititDcfsuDryentpoI")),
        pSetupDiGetDeviceInstanceIdW(IExport::LoadAndFindSingleExport("s.eidtplualp", "SeIIeGtenedtiDcscWuDeitnpva"))
    {
        if (pSetupDiGetClassDevsExW == nullptr || pSetupDiEnumDeviceInfo == nullptr || pSetupDiGetDeviceRegistryPropertyW == nullptr ||
            pSetupDiDestroyDeviceInfoList == nullptr || pSetupDiGetDeviceInstanceIdW == nullptr)
        {
            ILog("Failed to find all required functions\n");
        }
        else
        {
            IReady = TRUE;
        }
    }

    const HDEVINFO WINAPI SetupDiGetClassDevsExW(
        _In_opt_ CONST GUID* ClassGuid,
        _In_opt_ PCWSTR Enumerator,
        _In_opt_ HWND hwndParent,
        _In_ DWORD Flags,
        _In_opt_ HDEVINFO DeviceInfoSet,
        _In_opt_ PCWSTR MachineName,
        _Reserved_ PVOID Reserved
    )
    {
        return _SafeSetupDiGetClassDevsExW(ClassGuid, Enumerator, hwndParent, Flags, DeviceInfoSet, MachineName, Reserved);
    }

    const BOOL WINAPI SetupDiEnumDeviceInfo(
        _In_ HDEVINFO DeviceInfoSet,
        _In_ DWORD MemberIndex,
        _Out_ PSP_DEVINFO_DATA DeviceInfoData
    )
    {

        return _SafeSetupDiEnumDeviceInfo(DeviceInfoSet, MemberIndex, DeviceInfoData);
    }

    const BOOL WINAPI SetupDiGetDeviceRegistryPropertyW(
        _In_ HDEVINFO DeviceInfoSet,
        _In_ PSP_DEVINFO_DATA DeviceInfoData,
        _In_ DWORD Property,
        _Out_opt_ PDWORD PropertyRegDataType,
        _Out_writes_bytes_to_opt_(PropertyBufferSize, *RequiredSize) PBYTE PropertyBuffer,
        _In_ DWORD PropertyBufferSize,
        _Out_opt_ PDWORD RequiredSize)
    {
        return _SafeSetupDiGetDeviceRegistryPropertyW(DeviceInfoSet, DeviceInfoData, Property, PropertyRegDataType, PropertyBuffer, PropertyBufferSize, RequiredSize);
    }

    const BOOL WINAPI SetupDiDestroyDeviceInfoList(
        _In_ HDEVINFO DeviceInfoSet
    )
    {
        return _SafeSetupDiDestroyDeviceInfoList(DeviceInfoSet);
    }

    const BOOL WINAPI SafeSetupDiGetDeviceInstanceIdW(
        _In_ HDEVINFO DeviceInfoSet,
        _In_ PSP_DEVINFO_DATA DeviceInfoData,
        _Out_writes_opt_(DeviceInstanceIdSize) PWSTR DeviceInstanceId,
        _In_ DWORD DeviceInstanceIdSize,
        _Out_opt_ PDWORD RequiredSize
    )
    {
        return _SafeSetupDiGetDeviceInstanceIdW(DeviceInfoSet, DeviceInfoData, DeviceInstanceId, DeviceInstanceIdSize, RequiredSize);
    }

private:

    LPVOID pSetupDiGetClassDevsExW = nullptr;
    LPVOID pSetupDiEnumDeviceInfo = nullptr;
    LPVOID pSetupDiGetDeviceRegistryPropertyW = nullptr;
    LPVOID pSetupDiDestroyDeviceInfoList = nullptr;
    LPVOID pSetupDiGetDeviceInstanceIdW = nullptr;

    LPVOID slpSetupDiGetClassDevsEx = (LPVOID)((uintptr_t)pSetupDiGetClassDevsExW + 0x0);
    LPVOID slpSetupDiEnumDeviceInfo = (LPVOID)((uintptr_t)pSetupDiEnumDeviceInfo + 0x0);
    LPVOID slpSetupDiGetDeviceRegistryPropertyW = (LPVOID)((uintptr_t)pSetupDiGetDeviceRegistryPropertyW + 0x0);
    LPVOID slpSetupDiDestroyDeviceInfoList = (LPVOID)((uintptr_t)pSetupDiDestroyDeviceInfoList + 0x0);
    LPVOID slpSetupDiGetDeviceInstanceIdW = (LPVOID)((uintptr_t)pSetupDiGetDeviceInstanceIdW + 0x0);

    // Redefine the functions
    HDEVINFO(WINAPI* _SafeSetupDiGetClassDevsExW)(
        _In_opt_ CONST GUID* ClassGuid,
        _In_opt_ PCWSTR Enumerator,
        _In_opt_ HWND hwndParent,
        _In_ DWORD Flags,
        _In_opt_ HDEVINFO DeviceInfoSet,
        _In_opt_ PCWSTR MachineName,
        _Reserved_ PVOID Reserved
        ) = (HDEVINFO(WINAPI*)(
            _In_opt_ CONST GUID * ClassGuid,
            _In_opt_ PCWSTR Enumerator,
            _In_opt_ HWND hwndParent,
            _In_ DWORD Flags,
            _In_opt_ HDEVINFO DeviceInfoSet,
            _In_opt_ PCWSTR MachineName,
            _Reserved_ PVOID Reserved
            ))slpSetupDiGetClassDevsEx;

    BOOL(WINAPI* _SafeSetupDiEnumDeviceInfo)(_In_ HDEVINFO DeviceInfoSet, _In_ DWORD MemberIndex, _Out_ PSP_DEVINFO_DATA DeviceInfoData) =
        (BOOL(WINAPI*)(_In_ HDEVINFO DeviceInfoSet, _In_ DWORD MemberIndex, _Out_ PSP_DEVINFO_DATA DeviceInfoData))pSetupDiEnumDeviceInfo;

    BOOL(WINAPI* _SafeSetupDiGetDeviceRegistryPropertyW)(
        _In_ HDEVINFO DeviceInfoSet,
        _In_ PSP_DEVINFO_DATA DeviceInfoData,
        _In_ DWORD Property,
        _Out_opt_ PDWORD PropertyRegDataType,
        _Out_writes_bytes_to_opt_(PropertyBufferSize, *RequiredSize) PBYTE PropertyBuffer,
        _In_ DWORD PropertyBufferSize,
        _Out_opt_ PDWORD RequiredSize
        ) = (BOOL(WINAPI*)(_In_ HDEVINFO DeviceInfoSet,
            _In_ PSP_DEVINFO_DATA DeviceInfoData,
            _In_ DWORD Property,
            _Out_opt_ PDWORD PropertyRegDataType,
            _Out_writes_bytes_to_opt_(PropertyBufferSize, *RequiredSize) PBYTE PropertyBuffer,
            _In_ DWORD PropertyBufferSize,
            _Out_opt_ PDWORD RequiredSize))pSetupDiGetDeviceRegistryPropertyW;

    BOOL(WINAPI* _SafeSetupDiDestroyDeviceInfoList)(
        _In_ HDEVINFO DeviceInfoSet) = (BOOL(WINAPI*)(
            _In_ HDEVINFO DeviceInfoSet))pSetupDiDestroyDeviceInfoList;

    BOOL(WINAPI* _SafeSetupDiGetDeviceInstanceIdW)(
        _In_ HDEVINFO DeviceInfoSet,
        _In_ PSP_DEVINFO_DATA DeviceInfoData,
        _Out_writes_opt_(DeviceInstanceIdSize) PWSTR DeviceInstanceId,
        _In_ DWORD DeviceInstanceIdSize,
        _Out_opt_ PDWORD RequiredSize
        ) =
        (BOOL(WINAPI*)(_In_ HDEVINFO DeviceInfoSet,
            _In_ PSP_DEVINFO_DATA DeviceInfoData,
            _Out_writes_opt_(DeviceInstanceIdSize) PWSTR DeviceInstanceId,
            _In_ DWORD DeviceInstanceIdSize,
            _Out_opt_ PDWORD RequiredSize
            ))pSetupDiGetDeviceInstanceIdW;
};