View More Demos
7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d

分析是否存在BYOVD

是否存在BYOVD漏洞

Dr.Binary

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "FUN_140004708"}
Tool result
{"result":"\n/* WARNING: Removing unreachable block (ram,0x000140004880) */\n\nint FUN_140004708(longlong param_1)\n\n{\n  undefined8 uVar1;\n  int local_44;\n  undefined1 local_38 [16];\n  undefined1 local_28 [16];\n  undefined1 local_18 [24];\n  \n  DbgPrint("!!!AODDriver::DriverEntry(): Entering.\n");\n  RtlInitUnicodeString(local_38,u__Device_AMDRyzenMasterDriverV13_14000b1a0);\n  RtlInitUnicodeString(local_18,u__DosDevices_AMDRyzenMasterDriver_14000b1e0);\n  RtlInitUnicodeString(local_28);\n  local_44 = WdmlibIoCreateDeviceSecure(param_1,0,local_38,0x8111);\n  if (-1 < local_44) {\n    local_44 = IoCreateSymbolicLink(local_18,local_38);\n    if (local_44 < 0) {\n      DbgPrint("!!!AODDriver::DriverEntry(): IoCreateSymbolicLink() failed\n");\n    }\n    *(code **)(param_1 + 0xe0) = FUN_140001a24;\n    *(undefined8 *)(param_1 + 0x80) = *(undefined8 *)(param_1 + 0xe0);\n    *(undefined8 *)(param_1 + 0x70) = *(undefined8 *)(param_1 + 0x80);\n    *(code *)(param_1 + 0x68) = FUN_1400048d0;\n  }\n  FUN_140004d1c(1);\n  uVar1 = FUN_140005628();\n  if ((char)uVar1 == '\0') {\n    DbgPrint("!!!AODDriver::DriverEntry(): DriverInit() failed.\n");\n  }\n  else {\n    DbgPrint("!!!AODDriver::DriverEntry(): DriverInit() succeeded.\n");\n  }\n  return local_44;\n}\n\n"}

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "FUN_140001a24"}
Tool result
{"result":"Succeeded and the artifact is saved at /sandbox/ghidra/decompiled_0x140001a24.txt. Please find the table of contents below. \n[{'funcName': 'FUN_140004e64', 'lineNum': 149}, {'funcName': 'DbgPrint', 'lineNum': 155}, {'funcName': 'DbgPrint', 'lineNum': 158}, {'funcName': 'FUN_140001064', 'lineNum': 169}, {'funcName': 'FUN_140001064', 'lineNum': 173}, {'funcName': 'HAL.DLL@HalGetBusDataByOffset', 'lineNum': 207}, {'funcName': 'HAL.DLL@HalGetBusDataByOffset', 'lineNum': 208}, {'funcName': 'HAL.DLL@HalGetBusDataByOffset', 'lineNum': 210}, {'funcName': 'FUN_140004e94', 'lineNum': 229}, {'funcName': 'FUN_1400051c0', 'lineNum': 232}, {'funcName': 'FUN_140004e94', 'lineNum': 233}, {'funcName': 'FUN_140004e94', 'lineNum': 235}, {'funcName': 'FUN_1400051c0', 'lineNum': 240}, {'funcName': 'FUN_140004e94', 'lineNum': 249}, {'funcName': 'FUN_1400051c0', 'lineNum': 252}, {'funcName': 'FUN_140004e94', 'lineNum': 253}, {'funcName': 'FUN_140004e94', 'lineNum': 254}, {'funcName': 'FUN_1400051c0', 'lineNum': 259}, {'funcName': 'FUN_140008f40', 'lineNum': 260}, {'funcName': 'FUN_140006420', 'lineNum': 270}, {'funcName': 'FUN_140006420', 'lineNum': 271}, {'funcName': 'NTOSKRNL.EXE@MmMapIoSpace', 'lineNum': 284}, {'funcName': 'FUN_1400051c0', 'lineNum': 294}, {'funcName': 'FUN_140004e94', 'lineNum': 298}, {'funcName': 'FUN_140008f40', 'lineNum': 315}, {'funcName': 'NTOSKRNL.EXE@MmUnmapIoSpace', 'lineNum': 329}, {'funcName': 'FUN_140005960', 'lineNum': 336}, {'funcName': 'FUN_140005960', 'lineNum': 337}, {'funcName': 'FUN_140005d64', 'lineNum': 346}, {'funcName': 'FUN_140005d64', 'lineNum': 347}, {'funcName': 'FUN_140005d64', 'lineNum': 348}, {'funcName': 'FUN_140005d64', 'lineNum': 349}, {'funcName': 'NTOSKRNL.EXE@KeEnterCriticalRegion', 'lineNum': 358}, {'funcName': 'NTOSKRNL.EXE@KeDelayExecutionThread', 'lineNum': 362}, {'funcName': 'NTOSKRNL.EXE@KeLeaveCriticalRegion', 'lineNum': 374}, {'funcName': 'FUN_140006ad0', 'lineNum': 382}, {'funcName': 'FUN_140006ad0', 'lineNum': 384}, {'funcName': 'FUN_140006ad0', 'lineNum': 385}, {'funcName': 'FUN_140006ad0', 'lineNum': 391}, {'funcName': 'FUN_140006ad0', 'lineNum': 393}, {'funcName': 'FUN_140006ad0', 'lineNum': 394}, {'funcName': 'DbgPrint', 'lineNum': 423}, {'funcName': 'FUN_140005850', 'lineNum': 427}, {'funcName': 'FUN_140006ad0', 'lineNum': 429}, {'funcName': 'FUN_140006ad0', 'lineNum': 432}, {'funcName': 'FUN_140006ad0', 'lineNum': 433}, {'funcName': 'DbgPrint', 'lineNum': 462}, {'funcName': 'FUN_140005850', 'lineNum': 466}, {'funcName': 'FUN_140006ad0', 'lineNum': 468}, {'funcName': 'FUN_140006ad0', 'lineNum': 471}, {'funcName': 'FUN_140006ad0', 'lineNum': 472}, {'funcName': 'DbgPrint', 'lineNum': 501}, {'funcName': 'FUN_140005850', 'lineNum': 505}, {'funcName': 'FUN_140006ad0', 'lineNum': 507}, {'funcName': 'FUN_140006ad0', 'lineNum': 510}, {'funcName': 'FUN_140006ad0', 'lineNum': 511}, {'funcName': 'DbgPrint', 'lineNum': 540}, {'funcName': 'FUN_140005850', 'lineNum': 544}, {'funcName': 'FUN_140006ad0', 'lineNum': 546}, {'funcName': 'FUN_140006ad0', 'lineNum': 549}, {'funcName': 'FUN_140006ad0', 'lineNum': 550}, {'funcName': 'DbgPrint', 'lineNum': 577}, {'funcName': 'FUN_140005850', 'lineNum': 581}, {'funcName': 'FUN_140006ad0', 'lineNum': 583}, {'funcName': 'FUN_140006ad0', 'lineNum': 586}, {'funcName': 'FUN_140006ad0', 'lineNum': 587}, {'funcName': 'DbgPrint', 'lineNum': 611}, {'funcName': 'FUN_140005850', 'lineNum': 615}, {'funcName': 'FUN_140006ad0', 'lineNum': 617}, {'funcName': 'FUN_140006ad0', 'lineNum': 620}, {'funcName': 'FUN_140006ad0', 'lineNum': 621}, {'funcName': 'FUN_140006420', 'lineNum': 630}, {'funcName': 'FUN_140005850', 'lineNum': 645}, {'funcName': 'FUN_140006ad0', 'lineNum': 647}, {'funcName': 'FUN_140006ad0', 'lineNum': 650}, {'funcName': 'FUN_140006ad0', 'lineNum': 651}, {'funcName': 'FUN_1400018d4', 'lineNum': 662}, {'funcName': 'memset', 'lineNum': 672}, {'funcName': 'FUN_140006250', 'lineNum': 676}, {'funcName': 'FUN_140008f40', 'lineNum': 683}, {'funcName': 'FUN_140007250', 'lineNum': 688}, {'funcName': 'FUN_140006250', 'lineNum': 697}, {'funcName': 'FUN_140007250', 'lineNum': 703}, {'funcName': 'FUN_1400053f8', 'lineNum': 711}, {'funcName': 'FUN_1400053f8', 'lineNum': 712}, {'funcName': 'FUN_140005e74', 'lineNum': 719}, {'funcName': 'FUN_1400051ac', 'lineNum': 726}, {'funcName': 'FUN_140004e78', 'lineNum': 727}, {'funcName': 'FUN_140007080', 'lineNum': 734}, {'funcName': 'FUN_140007080', 'lineNum': 735}, {'funcName': 'FUN_140006c54', 'lineNum': 743}, {'funcName': 'FUN_140006c54', 'lineNum': 744}, {'funcName': 'FUN_140005f90', 'lineNum': 752}, {'funcName': 'FUN_140005f90', 'lineNum': 753}, {'funcName': 'FUN_14000491c', 'lineNum': 761}, {'funcName': 'FUN_14000491c', 'lineNum': 762}, {'funcName': 'FUN_1400050c4', 'lineNum': 770}, {'funcName': 'FUN_1400050c4', 'lineNum': 771}, {'funcName': 'FUN_140004ed0', 'lineNum': 779}, {'funcName': 'FUN_140004ed0', 'lineNum': 780}, {'funcName': 'FUN_1400051ec', 'lineNum': 788}, {'funcName': 'FUN_1400051ec', 'lineNum': 789}, {'funcName': 'FUN_140006420', 'lineNum': 796}, {'funcName': 'FUN_140008028', 'lineNum': 802}, {'funcName': 'FUN_1400080d4', 'lineNum': 806}, {'funcName': 'FUN_140005bf8', 'lineNum': 813}, {'funcName': 'FUN_140006950', 'lineNum': 820}, {'funcName': 'DbgPrint', 'lineNum': 829}, {'funcName': 'DbgPrint', 'lineNum': 841}, {'funcName': 'DbgPrint', 'lineNum': 855}, {'funcName': 'FUN_140005850', 'lineNum': 861}, {'funcName': 'FUN_140006be0', 'lineNum': 863}, {'funcName': 'FUN_140006be0', 'lineNum': 865}, {'funcName': 'FUN_140006be0', 'lineNum': 866}, {'funcName': 'FUN_1400067ec', 'lineNum': 872}, {'funcName': 'NTOSKRNL.EXE@IofCompleteRequest', 'lineNum': 882}, {'funcName': 'FUN_1400089f0', 'lineNum': 883}]"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 200}
Tool result
{"result":"      }\n      else {\n        if (local_290 < 0x81112f29) {\n          if (local_290 != 0x81112f28) {\n            if (local_290 == 0x81112ee0) {\n              local_150 = 0;\n              local_210 = pdVar2;\n              if (((uVar6 < 0xc) || (uVar1 < 0xc)) || (0xe < (int)*(uint )pdVar2))\n              goto LAB_1400046c4;\n              local_150 = rdmsr((undefined4 )(&DAT_14000b000 + (longlong)(int)(uint *)pdVar2 * 4)\n                               );\n              *(uint *)((longlong)pdVar2 + 4) = (uint)local_150;\n              *(uint *)(pdVar2 + 1) = (uint)((ulonglong)local_150 >> 0x20);\n              *(ulonglong )(param_2 + 0x38) = (ulonglong)uVar1;\n            }\n            else if (local_290 == 0x81112ee4) {\n              local_120 = 0;\n              local_208 = pdVar2;\n              if ((uVar6 < 0xc) || (0xe < (int)(uint *)pdVar2)) goto LAB_1400046c4;\n              local_120 = *(undefined8 )((longlong)pdVar2 + 4);\n              local_c8 = (longlong)(int)(uint )pdVar2;\n              wrmsr((undefined4 )(&DAT_14000b000 + local_c8 * 4),local_120);\n            }\n            else if (local_290 == 0x81112ef8) {\n              if ((uVar6 < 0x14) || ((ulonglong)uVar1 < (ulonglong)(uint )(pdVar2 + 2) + 0x14))\n              goto LAB_1400046c4;\n              uVar6 = HalGetBusDataByOffset\n                                (4,(uint *)pdVar2,\n                                 *(uint )((longlong)pdVar2 + 4) & 0x1f |\n                                 ((uint *)(pdVar2 + 1) & 7) << 5,(uint *)((longlong)pdVar2 + 0x14))\n              ;\n              *(uint *)(pdVar2 + 2) = uVar6;\n              *(ulonglong *)(param_2 + 0x38) = (ulonglong)uVar1;\n            }\n            else if (local_290 == 0x81112f00) {\n              local_1f8 = (uint )((longlong)pdVar2 + 0x14);\n              local_28c = 0;\n              if (((((uVar6 < 0x14) || ((ulonglong)uVar1 < (ulonglong)(uint *)(pdVar2 + 2) + 0x14))\n                   || (0xff < *(uint *)pdVar2)) ||\n                  ((0x1f < *(uint *)((longlong)pdVar2 + 4) || (7 < *(uint *)(pdVar2 + 1))))) ||"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 270}
Tool result
{"result":"                do {\n                  FUN_1400051c0(0xcf8,uVar6);\n                  local_28c = FUN_140004e94(0xcfc);\n                  uVar8 = FUN_140004e94(0xcf8);\n                  local_358 = local_358 + 1;\n                  if (uVar6 == uVar8) break;\n                } while (local_358 < 100);\n                if (99 < local_358) goto LAB_1400046c4;\n                FUN_1400051c0(0xcf8,uVar7);\n                FUN_140008f40((undefined8 *)local_1f8,(undefined8 )&local_28c,\n                              (ulonglong)(uint *)(pdVar2 + 2) % 4);\n              }\n              *(ulonglong )(param_2 + 0x38) = (ulonglong)uVar1;\n            }\n            else {\n              if (local_290 == 0x81112f08) {\n                local_200 = pdVar2;\n                if ((uVar6 < 0xc) || ((ulonglong)uVar1 < (ulonglong)(uint *)(pdVar2 + 1) + 0xc))\n                goto LAB_1400046c4;\n                cVar3 = FUN_140006420(pdVar2,(uint *)(pdVar2 + 1),\n                                      (longlong)((longlong)pdVar2 + 0xc),param_4);\n                goto joined_r0x000140003246;\n              }\n              if (local_290 == 0x81112f18) {\n                local_258 = 0;\n                local_cc = 0;\n                local_318 = 0;\n                local_d8 = 0;\n                local_2c0 = 0;\n                if ((uVar6 < 0x1c) || (uVar1 < 0x1c)) goto LAB_1400046c4;\n                if (*pdVar2 != 0.0) {\n                  local_c0 = *pdVar2;\n                  local_2c0 = *(uint )((longlong)pdVar2 + 0x14) * 0x100000;\n                  local_258 = MmMapIoSpace(local_c0,local_2c0,0);\n                  if (local_258 == 0) goto LAB_1400046c4;\n                }\n                while ((uint *)(pdVar2 + 1) < *(uint )((longlong)pdVar2 + 0x14)) {\n                  while ((uint )((longlong)pdVar2 + 0xc) < 0x20) {\n                    while ((uint *)(pdVar2 + 2) < 8) {\n                      if (*pdVar2 == 0.0) {"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 700}
Tool result
{"result":"              (*(char )(local_68 + (local_344 + 2)) == 'M')) &&\n             ((char *)(local_68 + (local_344 + 3)) == '')) {\n            FUN_140008f40(local_58,(undefined8 )(local_68 + local_344),0x1f);\n            bVar4 = true;\n            break;\n          }\n        }\n        if ((!bVar4) || (uVar11 = FUN_140007250((longlong)&local_78), (int)uVar11 != 0))\n        goto LAB_1400046c4;\n        if ((uint *)pdVar2 == 0) {\n          *(uint )pdVar2 = (uint)local_42;\n        }\n        else {\n          if ((ulonglong)uVar1 < (ulonglong)(uint *)pdVar2 + 4) goto LAB_1400046c4;\n          local_78 = (ulonglong)local_40;\n          local_6c = *(uint *)pdVar2;\n          iVar9 = FUN_140006250(&local_78);\n          if ((iVar9 != 0) || (local_68 == 0)) goto LAB_1400046c4;\n          for (local_320 = 0; local_320 < *(uint *)pdVar2; local_320 = local_320 + 1) {\n            *(char *)((longlong)pdVar2 + (ulonglong)local_320 + 4) =\n                 *(char *)(local_68 + (ulonglong)local_320);\n          }\n          FUN_140007250((longlong)&local_78);\n        }\n        *(ulonglong )(param_2 + 0x38) = (ulonglong)uVar1;\n      }\n      else if (local_290 == 0x81112f68) {\n        local_1d8 = pdVar2;\n        if (((uVar6 < 6) || (uVar1 < 6)) || (5 < (int)(uint )pdVar2)) goto LAB_1400046c4;\n        local_88 = &DAT_14000b094;\n        uVar10 = FUN_1400053f8((&DAT_14000b094)[(int)(uint *)pdVar2],\n                               *(char *)((longlong)pdVar2 + 4),(char *)((longlong)pdVar2 + 5));\n        if ((char)uVar10 == '\0') goto LAB_1400046c4;\n        *(ulonglong )(param_2 + 0x38) = (ulonglong)uVar1;\n      }\n      else if (local_290 == 0x81112f6c) {\n        local_100 = pdVar2;\n        if ((uVar6 < 4) || (uVar1 < 4)) goto LAB_1400046c4;\n        uVar5 = FUN_140005e74((ushort *)pdVar2);\n        *(ushort *)((longlong)local_100 + 2) = uVar5;"}

Call ghidra_list_strings

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "filter": "IOCTL"}
Tool result
{"result":["140009680: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION0:DEVICE_ID not found\n"","1400096d0: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION1:DEVICE_ID not found\n"","140009720: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION2:DEVICE_ID not found\n"","140009770: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION3:DEVICE_ID not found\n"","1400097c0: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION4:DEVICE_ID not found\n"","140009810: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION5:DEVICE_ID not found\n"","140009860: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_D0F0:DEVICE_ID not found\n""]}

Call sandbox_execute

Arguments
{"command": "strings /sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d | grep -i \"AMDRyzenMaster\\|IOCTL\\|DEVICE\\|DRIVER\""}
Tool result
{"exitCode":0,"stdout":"!!!AODDriver::SimplDrvDispatch(): EnableWatchDog_SB700\n!!!AODDriver::SimplDrvDispatch(): EnableWatchDog_SB800\n!!!AODDriver::SimplDrvDispatch(): TriggerWatchDog_SB800\n!!!AODDriver::SimplDrvDispatch(): TriggerWatchDog_SB700\n!!!AODDriver::SimplDrvDispatch(): AssertLDTStop_SB700\n!!!AODDriver::SimplDrvDispatch(): AssertLDTStop_SB800\n!!!AODDriver::SimplDrvDispatch(): ulPMIO2BaseAddress : %x\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700 %d\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700--->2\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700--->3\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700 Failed\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister return 0\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB800\n!!!AODDriver::SimplDrvDispatch(): IRP_MJ_CREATE\n!!!AODDriver::SimplDrvDispatch(): IRP_MJ_CLOSE\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION0:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION1:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION2:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION3:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION4:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION5:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_D0F0:DEVICE_ID not found\n!!AODDriver::SimplDrvDispatch(): unknown IRP_MJ_DEVICE_CONTROL %X\n!!!AODDriver::DriverUnload(): Unloading\n!!!AODDriver::DriverEntry(): Entering.\n!!!AODDriver::DriverEntry(): IoCreateSymbolicLink() failed\n!!!AODDriver::DriverEntry(): DriverInit() succeeded.\n!!!AODDriver::DriverEntry(): DriverInit() failed.\nCommon::DriverInit(): InitACPITable() succeeded.\nCommon::DriverInit(): GetIMCBaseAddress() succeeded: %X\nC:\Dhaval\Colfax\CPU-Overdrive-2015\Windows\x64\Release\AMDRyzenMasterDriver.pdb\nIoDeleteDevice\nIoDeviceObjectType\nIoCreateDevice\nAdvanced Micro Devices Inc.1$0"\nAdvanced Micro Devices Inc.0\n","stderr":""}

存在BYOVD漏洞

该驱动（AMDRyzenMasterDriver V13）存在典型的BYOVD（Bring Your Own Vulnerable Driver）漏洞特征：

漏洞证据：

  1. 任意MSR读写（0x81112ee0/0x81112ee4）：允许读写任意Model-Specific Registers
  2. 任意物理内存映射（0x81112f18）：通过MmMapIoSpace直接映射物理内存
  3. PCI配置空间访问（0x81112ef8/0x81112f00）：通过HalGetBusDataByOffset读写PCI配置
  4. 端口I/O操作（0x81112f08）：允许任意端口读写

利用价值：

  • 可提权至内核级别
  • 可绕过内核保护机制
  • 可禁用安全软件
  • 已被多个恶意软件组织利用

**建议：**立即卸载或更新AMD Ryzen Master到已修复版本。

Dr.Binary

Call ghidra_open_server

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "reopen": true}
Tool result
{"result":"compilerID: windows\nimports[3]:\n  - functions[48]: IoDeviceObjectType,SeExports,strncmp,DbgPrint,_snwprintf,_wcsnicmp,wcschr,ExAllocatePoolWithTag,ExFreePoolWithTag,MmMapIoSpace,MmUnmapIoSpace,KeEnterCriticalRegion,KeDelayExecutionThread,KeLeaveCriticalRegion,IofCompleteRequest,RtlInitUnicodeString,IoCreateSymbolicLink,IoDeleteDevice,IoDeleteSymbolicLink,RtlGetVersion,IoAllocateMdl,MmBuildMdlForNonPagedPool,MmUnmapLockedPages,IoFreeMdl,MmMapLockedPagesSpecifyCache,RtlCopyUnicodeString,MmGetSystemRoutineAddress,IoCreateDevice,ObOpenObjectByPointer,ZwSetSecurityObject,ZwClose,RtlGetOwnerSecurityDescriptor,RtlGetGroupSecurityDescriptor,RtlGetSaclSecurityDescriptor,RtlGetDaclSecurityDescriptor,SeCaptureSecurityDescriptor,RtlLengthSecurityDescriptor,RtlLengthSid,RtlAddAccessAllowedAce,IoIsWdmVersionAvailable,RtlCreateSecurityDescriptor,RtlSetDaclSecurityDescriptor,RtlAbsoluteToSelfRelativeSD,ZwCreateKey,ZwOpenKey,ZwQueryValueKey,ZwSetValueKey,RtlFreeUnicodeString\n    name: NTOSKRNL.EXE\n  - functions[2]: HalGetBusDataByOffset,HalSetBusDataByOffset\n    name: HAL.DLL\n  - functions[4]: WdfVersionBind,WdfVersionBindClass,WdfVersionUnbindClass,WdfVersionUnbind\n    name: WDFLDR.SYS\nexports[1]{address,name}:\n  140008a48,entry\nformat: Portable Executable (PE)\nlanguageID: "x86:LE:64:default"\nprocessor: x86\nendianess: Little Endian\nsegments[11]{name,start,end}:\n  Headers,"140000000",1400003ff\n  .text,"140001000",140009bff\n  .rdata,14000a000,14000afff\n  .data,14000b000,14002bcb7\n  .pdata,14002c000,14002c5ff\n  .gfids,14002d000,14002d1ff\n  PAGE,"14002e000",14002f9ff\n  INIT,"140030000",1400307ff\n  .rsrc,"140031000",1400313ff\n  .reloc,"140032000",1400321ff\n  tdb,ff00000000,ff0000184f\naddressSize: 64 bit\nimageBase: "140000000"\nnamedFunctions[12]{address,name}:\n  "140008988",WdmlibRtlInitUnicodeStringEx\n  140008a18,FxStubDriverUnloadCommon\n  140008a48,entry\n  140008ba4,FxStubDriverUnload\n  140008bcc,FxStubInitTypes\n  140008c38,FxStubBindClasses\n  140008cd0,FxStubUnbindClasses\n  140008d60,_guard_check_icall\n  140008d80,_guard_dispatch_icall\n  "140008e40",memset\n  14002e06c,WdmlibIoCreateDeviceSecure\n  14002f024,SepSddlLookupAccessMaskInTable\nstrings[101]{address,value}:\n  "140030638",RtlFreeUnicodeString\n  "140009490","!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700 %d\\n"\n  14000a794,.data\n  "140030446",IoCreateDevice\n  "140030458",ObOpenObjectByPointer\n  140009b70,"Common::DriverInit(): _GetIMCBaseAddress() succeeded: %X\\n"\n  "140030618",ZwQueryValueKey\n  "140030688",RtlCopyUnicodeString\n  "140009450","!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700\\n"\n  "140009550","!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700 Failed\\n"\n  "140030546",RtlCreateSecurityDescriptor\n  "140009350","!!!AODDriver::SimplDrvDispatch(): TriggerWatchDog_SB700\\n"\n  "140030668",HalSetBusDataByOffset\n  14000a400,"{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"\n  140009a90,"Common::DriverInit(): InitACPITable() succeeded.\\n"\n  "1400302e6",KeLeaveCriticalRegion\n  "140030410",ZwClose\n  14000a260,IoValidateDeviceIoControlAccess\n  1400303da,IoFreeMdl\n  140009a10,"!!!AODDriver::DriverEntry(): DriverInit() succeeded.\\n"\n  "140030490",RtlGetGroupSecurityDescriptor\n  14003050e,_snwprintf\n  14000a838,.pdata\n  140009a50,"!!!AODDriver::DriverEntry(): DriverInit() failed.\\n"\n  14000a7c0,.kmdfclassbind$c\n  14003041a,ZwSetSecurityObject\n  "140030360",IoDeleteSymbolicLink\n  140009af0,"bRetCode == FALSE!\\n"\n  1400304d0,RtlGetSaclSecurityDescriptor\n  1400306a0,WdfVersionBind\n  "140009810","!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION5:DEVICE_ID not found\\n"\n  140009b40,"Common::_IsIMCEnabled(): AcpiMMioAddr = %X\\n"\n  14000a330,DeviceCharacteristics\n  14003053a,SeExports\n  "140009280","RSD PTR "\n  "140030564",_wcsnicmp\n  "140030470",RtlGetDaclSecurityDescriptor\n  1400303f4,MmGetSystemRoutineAddress\n  "140009290","!!!AODDriver::SimplDrvDispatch(): EnableWatchDog_SB700\\n"\n  "140030608",ZwSetValueKey\n  1400303ca,IoAllocateMdl\n  1400097c0,"!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION4:DEVICE_ID not found\\n"\n  "140009410","!!!AODDriver::SimplDrvDispatch(): ulPMIO2BaseAddress : %x\\n"\n  "140030298",DbgPrint\n  1400306dc,WdfVersionUnbindClass\n  "140009860","!!!AODDriver::DriverDispatch():IOCTL_WRITE_D0F0:DEVICE_ID not found\\n"\n  "140009900","!!!AODDriver::DriverUnload(): Unloading\\n"\n  "140030320",IofCompleteRequest\n  "140009720","!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION2:DEVICE_ID not found\\n"\n  1400303b4,MmUnmapLockedPages\n  "140030378",MmBuildMdlForNonPagedPool\n  14000a360,Exclusive\n  1400093d0,"!!!AODDriver::SimplDrvDispatch(): AssertLDTStop_SB800\\n"\n  14000a2e8,NoUseClass\n  140009b10,"PCI MMIO base address read from MSR is: %X\\n"\n  "140030430",IoDeviceObjectType\n  "140030570",wcschr\n  "140009680","!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION0:DEVICE_ID not found\\n"\n  14000a75c,.rdata\n  14000a7f8,.kmdftypeinit$a\n  "140009310","!!!AODDriver::SimplDrvDispatch(): TriggerWatchDog_SB800\\n"\n  "140030254",ExAllocatePoolWithTag\n  "140030394",MmMapLockedPagesSpecifyCache\n  14000a380,"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class"\n  "140009590","!!!AODDriver::SimplDrvDispatch(): ReadSBRegister return 0\\n"\n  1400306f2,WDFLDR.SYS\n  1400302ce,KeEnterCriticalRegion\n  14000a4b0,SeConvertStringSecurityDescriptorToSecurityDescriptor\n  "140009960","D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;AU)(A;;GA;;;AC)"\n  "140030336",IoCreateSymbolicLink\n  14000a300,Security\n  14003030e,MmUnmapIoSpace\n  "140030598",RtlAddAccessAllowedAce\n  1400302a4,RtlGetVersion\n  14003024a,strncmp\n  14000a2a0,Properties\n  "140030650",HalGetBusDataByOffset\n  14000a2c8,NoDisplayClass\n  14003026c,ExFreePoolWithTag\n  1400302fe,MmMapIoSpace\n  14003051c,RtlLengthSecurityDescriptor\n  14000a520,KmdfLibrary\n  1400305b2,RtlLengthSid\n  14000a7dc,.kmdfclassbind$d\n  1400099d0,"!!!AODDriver::DriverEntry(): IoCreateSymbolicLink() failed\\n"\n  1400095d0,"!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB800\\n"\n  14000a810,.kmdftypeinit$c\n  14003057a,RtlAbsoluteToSelfRelativeSD\n  "140009610","!!!AODDriver::SimplDrvDispatch(): IRP_MJ_CREATE\\n"\n  14003034e,IoDeleteDevice\n  14000b1e0,"\\DosDevices\\AMDRyzenMasterDriverV13"\n  1400306b2,WdfVersionUnbind\n  "140009650","!!!AODDriver::SimplDrvDispatch(): IRP_MJ_CLOSE\\n"\n  1400096d0,"!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION1:DEVICE_ID not found\\n"\n  14000b1a0,"\\Device\\AMDRyzenMasterDriverV13"\n  "140030280",RtlInitUnicodeString\n  1400305dc,RtlSetDaclSecurityDescriptor\n  "140009770","!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION3:DEVICE_ID not found\\n"\n  "140009930","!!!AODDriver::DriverEntry(): Entering.\\n"\n  1400092d0,"!!!AODDriver::SimplDrvDispatch(): EnableWatchDog_SB800\\n"\n  truncated... (more than 100 strings found),truncated\nfileSize: 71152 bytes\nentryPoint: 140008a48"}

Call ghidra_list_strings

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "filter": "IOCTL", "limit": 2000}
Tool result
{"result":["140009680: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION0:DEVICE_ID not found\n"","1400096d0: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION1:DEVICE_ID not found\n"","140009720: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION2:DEVICE_ID not found\n"","140009770: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION3:DEVICE_ID not found\n"","1400097c0: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION4:DEVICE_ID not found\n"","140009810: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION5:DEVICE_ID not found\n"","140009860: "!!!AODDriver::DriverDispatch():IOCTL_WRITE_D0F0:DEVICE_ID not found\n""]}

Call ghidra_search_functions_by_name

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "query": "Dispatch"}
Tool result
{"result":["guard_dispatch_icall @ 140008d80"]}

Call ghidra_search_functions_by_name

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "query": "Driver"}
Tool result
{"result":["FxStubDriverUnload @ 140008ba4","FxStubDriverUnloadCommon @ 140008a18"]}

Call ghidra_list_methods

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "limit": 200}
Tool result
{"result":["FUN_140001000 @ 140001000","FUN_140001064 @ 140001064","FUN_1400010ec @ 1400010ec","FUN_1400012a0 @ 1400012a0","FUN_140001744 @ 140001744","FUN_1400017b0 @ 1400017b0","FUN_140001850 @ 140001850","FUN_1400018d4 @ 1400018d4","FUN_14000192c @ 14000192c","FUN_140001a1c @ 140001a1c","FUN_140001a24 @ 140001a24","FUN_140004708 @ 140004708","FUN_1400048d0 @ 1400048d0","FUN_14000491c @ 14000491c","FUN_14000497c @ 14000497c","FUN_140004b4c @ 140004b4c","FUN_140004d1c @ 140004d1c","FUN_140004de4 @ 140004de4","FUN_140004e64 @ 140004e64","FUN_140004e78 @ 140004e78","FUN_140004e94 @ 140004e94","FUN_140004eb0 @ 140004eb0","FUN_140004ed0 @ 140004ed0","FUN_140004f4c @ 140004f4c","FUN_14000505c @ 14000505c","FUN_1400050c4 @ 1400050c4","FUN_140005134 @ 140005134","FUN_1400051ac @ 1400051ac","FUN_1400051c0 @ 1400051c0","FUN_1400051d4 @ 1400051d4","FUN_1400051ec @ 1400051ec","FUN_140005264 @ 140005264","FUN_140005330 @ 140005330","FUN_1400053f8 @ 1400053f8","FUN_140005628 @ 140005628","FUN_1400057d4 @ 1400057d4","FUN_140005850 @ 140005850","FUN_140005960 @ 140005960","FUN_140005bf8 @ 140005bf8","FUN_140005d64 @ 140005d64","FUN_140005e74 @ 140005e74","FUN_140005f90 @ 140005f90","FUN_140006250 @ 140006250","FUN_1400063d0 @ 1400063d0","FUN_140006420 @ 140006420","FUN_1400064d4 @ 1400064d4","FUN_1400067ec @ 1400067ec","FUN_140006950 @ 140006950","FUN_140006ad0 @ 140006ad0","FUN_140006be0 @ 140006be0","FUN_140006c54 @ 140006c54","FUN_140007080 @ 140007080","FUN_140007250 @ 140007250","FUN_1400072c8 @ 1400072c8","FUN_14000737c @ 14000737c","FUN_140007940 @ 140007940","FUN_140007abc @ 140007abc","FUN_140007cb4 @ 140007cb4","FUN_140007d84 @ 140007d84","FUN_140007f50 @ 140007f50","FUN_140008028 @ 140008028","FUN_1400080d4 @ 1400080d4","FUN_14000812c @ 14000812c","FUN_1400081b8 @ 1400081b8","FUN_1400084ec @ 1400084ec","FUN_1400085ac @ 1400085ac","strncmp @ 1400088f0","FUN_1400088f8 @ 1400088f8","FUN_140008918 @ 140008918","DbgPrint @ 140008980","WdmlibRtlInitUnicodeStringEx @ 140008988","_snwprintf @ 1400089ca","_wcsnicmp @ 1400089d0","wcschr @ 1400089d6","FUN_1400089f0 @ 1400089f0","FxStubDriverUnloadCommon @ 140008a18","entry @ 140008a48","FUN_140008a74 @ 140008a74","FxStubDriverUnload @ 140008ba4","FxStubInitTypes @ 140008bcc","FxStubBindClasses @ 140008c38","FxStubUnbindClasses @ 140008cd0","WdfVersionBind @ 140008d48","WdfVersionUnbind @ 140008d4e","WdfVersionBindClass @ 140008d54","WdfVersionUnbindClass @ 140008d5a","_guard_check_icall @ 140008d60","_guard_dispatch_icall @ 140008d80","FUN_140008da0 @ 140008da0","FUN_140008dd0 @ 140008dd0","thunk_FUN_140008e30 @ 140008e20","FUN_140008e30 @ 140008e30","memset @ 140008e40","FUN_140008f40 @ 140008f40","FUN_14002e000 @ 14002e000","WdmlibIoCreateDeviceSecure @ 14002e06c","FUN_14002e0c0 @ 14002e0c0","FUN_14002e228 @ 14002e228","FUN_14002e2cc @ 14002e2cc","FUN_14002e2f4 @ 14002e2f4","FUN_14002e3b8 @ 14002e3b8","FUN_14002e538 @ 14002e538","FUN_14002e6e4 @ 14002e6e4","FUN_14002e700 @ 14002e700","FUN_14002e710 @ 14002e710","FUN_14002e71c @ 14002e71c","FUN_14002e848 @ 14002e848","FUN_14002e96c @ 14002e96c","FUN_14002ea30 @ 14002ea30","FUN_14002eb10 @ 14002eb10","FUN_14002ebd0 @ 14002ebd0","FUN_14002ef60 @ 14002ef60","SepSddlLookupAccessMaskInTable @ 14002f024","FUN_14002f0b0 @ 14002f0b0","FUN_14002f198 @ 14002f198","FUN_14002f2dc @ 14002f2dc","FUN_14002f374 @ 14002f374","FUN_14002f3e4 @ 14002f3e4","FUN_14002f43c @ 14002f43c","FUN_14002f488 @ 14002f488","FUN_14002f4fc @ 14002f4fc","FUN_14002f63c @ 14002f63c","FUN_14002f734 @ 14002f734","FUN_14002f780 @ 14002f780","FUN_14002f7d4 @ 14002f7d4","FUN_14002f82c @ 14002f82c","FUN_14002f868 @ 14002f868","FUN_14002f8b8 @ 14002f8b8","FUN_140030000 @ 140030000"]}

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "entry"}
Tool result
{"result":"\nvoid entry(longlong param_1)\n\n{\n  FUN_140030000();\n  FUN_140008a74(param_1);\n  return;\n}\n\n"}

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "FUN_140001000"}
Tool result
{"result":"\nchar FUN_140001000(longlong param_1,uint param_2)\n\n{\n  char local_18;\n  uint local_14;\n  \n  local_18 = '\0';\n  if (param_1 != 0) {\n    for (local_14 = 0; local_14 < param_2; local_14 = local_14 + 1) {\n      local_18 = local_18 + *(char *)(param_1 + (ulonglong)local_14);\n    }\n  }\n  return local_18;\n}\n\n"}

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "FUN_140008a74"}
Tool result
{"result":"\n/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */\n\nint FUN_140008a74(longlong param_1)\n\n{\n  int iVar1;\n  \n  if (param_1 == 0) {\n    iVar1 = FUN_140004708(0);\n  }\n  else {\n    _DAT_14002b530 = &DAT_14002b560;\n    _DAT_14002b528 = 0x2080000;\n    _DAT_14002b550 = param_1;\n    RtlCopyUnicodeString(&DAT_14002b528);\n    iVar1 = WdfVersionBind(param_1,&DAT_14002b528,&DAT_14000b440,&DAT_14002b540);\n    if (-1 < iVar1) {\n      _DAT_14002b558 = *(undefined1 **)(DAT_14002b548 + 0x648);\n      iVar1 = FxStubBindClasses((WDF_BIND_INFO )&DAT_14000b440);\n      if (((-1 < iVar1) && (iVar1 = FxStubInitTypes(), -1 < iVar1)) &&\n         (iVar1 = FUN_140004708(param_1), -1 < iVar1)) {\n        if ((char )(DAT_14002b540 + 0x30) == '\0') {\n          if (((uint )(DAT_14002b540 + 8) & 2) != 0) {\n            _DAT_14002b558 = &LAB_140008b9c;\n          }\n        }\n        else {\n          if ((longlong *)(param_1 + 0x68) != 0) {\n            DAT_14002b538 = *(longlong *)(param_1 + 0x68);\n          }\n          *(code **)(param_1 + 0x68) = FxStubDriverUnload;\n        }\n        return 0;\n      }\n      FxStubDriverUnloadCommon();\n    }\n  }\n  return iVar1;\n}\n\n"}

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "FUN_140004708"}
Tool result
{"result":"\n/* WARNING: Removing unreachable block (ram,0x000140004880) */\n\nint FUN_140004708(longlong param_1)\n\n{\n  undefined8 uVar1;\n  int local_44;\n  undefined1 local_38 [16];\n  undefined1 local_28 [16];\n  undefined1 local_18 [24];\n  \n  DbgPrint("!!!AODDriver::DriverEntry(): Entering.\n");\n  RtlInitUnicodeString(local_38,u__Device_AMDRyzenMasterDriverV13_14000b1a0);\n  RtlInitUnicodeString(local_18,u__DosDevices_AMDRyzenMasterDriver_14000b1e0);\n  RtlInitUnicodeString(local_28);\n  local_44 = WdmlibIoCreateDeviceSecure(param_1,0,local_38,0x8111);\n  if (-1 < local_44) {\n    local_44 = IoCreateSymbolicLink(local_18,local_38);\n    if (local_44 < 0) {\n      DbgPrint("!!!AODDriver::DriverEntry(): IoCreateSymbolicLink() failed\n");\n    }\n    *(code **)(param_1 + 0xe0) = FUN_140001a24;\n    *(undefined8 *)(param_1 + 0x80) = *(undefined8 *)(param_1 + 0xe0);\n    *(undefined8 *)(param_1 + 0x70) = *(undefined8 *)(param_1 + 0x80);\n    *(code *)(param_1 + 0x68) = FUN_1400048d0;\n  }\n  FUN_140004d1c(1);\n  uVar1 = FUN_140005628();\n  if ((char)uVar1 == '\0') {\n    DbgPrint("!!!AODDriver::DriverEntry(): DriverInit() failed.\n");\n  }\n  else {\n    DbgPrint("!!!AODDriver::DriverEntry(): DriverInit() succeeded.\n");\n  }\n  return local_44;\n}\n\n"}

Call ghidra_decompile_function

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "name_or_address": "FUN_140001a24"}
Tool result
{"result":"Succeeded and the artifact is saved at /sandbox/ghidra/decompiled_0x140001a24.txt. Please find the table of contents below. \n[{'funcName': 'FUN_140004e64', 'lineNum': 149}, {'funcName': 'DbgPrint', 'lineNum': 155}, {'funcName': 'DbgPrint', 'lineNum': 158}, {'funcName': 'FUN_140001064', 'lineNum': 169}, {'funcName': 'FUN_140001064', 'lineNum': 173}, {'funcName': 'HAL.DLL@HalGetBusDataByOffset', 'lineNum': 207}, {'funcName': 'HAL.DLL@HalGetBusDataByOffset', 'lineNum': 208}, {'funcName': 'HAL.DLL@HalGetBusDataByOffset', 'lineNum': 210}, {'funcName': 'FUN_140004e94', 'lineNum': 229}, {'funcName': 'FUN_1400051c0', 'lineNum': 232}, {'funcName': 'FUN_140004e94', 'lineNum': 233}, {'funcName': 'FUN_140004e94', 'lineNum': 235}, {'funcName': 'FUN_1400051c0', 'lineNum': 240}, {'funcName': 'FUN_140004e94', 'lineNum': 249}, {'funcName': 'FUN_1400051c0', 'lineNum': 252}, {'funcName': 'FUN_140004e94', 'lineNum': 253}, {'funcName': 'FUN_140004e94', 'lineNum': 254}, {'funcName': 'FUN_1400051c0', 'lineNum': 259}, {'funcName': 'FUN_140008f40', 'lineNum': 260}, {'funcName': 'FUN_140006420', 'lineNum': 270}, {'funcName': 'FUN_140006420', 'lineNum': 271}, {'funcName': 'NTOSKRNL.EXE@MmMapIoSpace', 'lineNum': 284}, {'funcName': 'FUN_1400051c0', 'lineNum': 294}, {'funcName': 'FUN_140004e94', 'lineNum': 298}, {'funcName': 'FUN_140008f40', 'lineNum': 315}, {'funcName': 'NTOSKRNL.EXE@MmUnmapIoSpace', 'lineNum': 329}, {'funcName': 'FUN_140005960', 'lineNum': 336}, {'funcName': 'FUN_140005960', 'lineNum': 337}, {'funcName': 'FUN_140005d64', 'lineNum': 346}, {'funcName': 'FUN_140005d64', 'lineNum': 347}, {'funcName': 'FUN_140005d64', 'lineNum': 348}, {'funcName': 'FUN_140005d64', 'lineNum': 349}, {'funcName': 'NTOSKRNL.EXE@KeEnterCriticalRegion', 'lineNum': 358}, {'funcName': 'NTOSKRNL.EXE@KeDelayExecutionThread', 'lineNum': 362}, {'funcName': 'NTOSKRNL.EXE@KeLeaveCriticalRegion', 'lineNum': 374}, {'funcName': 'FUN_140006ad0', 'lineNum': 382}, {'funcName': 'FUN_140006ad0', 'lineNum': 384}, {'funcName': 'FUN_140006ad0', 'lineNum': 385}, {'funcName': 'FUN_140006ad0', 'lineNum': 391}, {'funcName': 'FUN_140006ad0', 'lineNum': 393}, {'funcName': 'FUN_140006ad0', 'lineNum': 394}, {'funcName': 'DbgPrint', 'lineNum': 423}, {'funcName': 'FUN_140005850', 'lineNum': 427}, {'funcName': 'FUN_140006ad0', 'lineNum': 429}, {'funcName': 'FUN_140006ad0', 'lineNum': 432}, {'funcName': 'FUN_140006ad0', 'lineNum': 433}, {'funcName': 'DbgPrint', 'lineNum': 462}, {'funcName': 'FUN_140005850', 'lineNum': 466}, {'funcName': 'FUN_140006ad0', 'lineNum': 468}, {'funcName': 'FUN_140006ad0', 'lineNum': 471}, {'funcName': 'FUN_140006ad0', 'lineNum': 472}, {'funcName': 'DbgPrint', 'lineNum': 501}, {'funcName': 'FUN_140005850', 'lineNum': 505}, {'funcName': 'FUN_140006ad0', 'lineNum': 507}, {'funcName': 'FUN_140006ad0', 'lineNum': 510}, {'funcName': 'FUN_140006ad0', 'lineNum': 511}, {'funcName': 'DbgPrint', 'lineNum': 540}, {'funcName': 'FUN_140005850', 'lineNum': 544}, {'funcName': 'FUN_140006ad0', 'lineNum': 546}, {'funcName': 'FUN_140006ad0', 'lineNum': 549}, {'funcName': 'FUN_140006ad0', 'lineNum': 550}, {'funcName': 'DbgPrint', 'lineNum': 577}, {'funcName': 'FUN_140005850', 'lineNum': 581}, {'funcName': 'FUN_140006ad0', 'lineNum': 583}, {'funcName': 'FUN_140006ad0', 'lineNum': 586}, {'funcName': 'FUN_140006ad0', 'lineNum': 587}, {'funcName': 'DbgPrint', 'lineNum': 611}, {'funcName': 'FUN_140005850', 'lineNum': 615}, {'funcName': 'FUN_140006ad0', 'lineNum': 617}, {'funcName': 'FUN_140006ad0', 'lineNum': 620}, {'funcName': 'FUN_140006ad0', 'lineNum': 621}, {'funcName': 'FUN_140006420', 'lineNum': 630}, {'funcName': 'FUN_140005850', 'lineNum': 645}, {'funcName': 'FUN_140006ad0', 'lineNum': 647}, {'funcName': 'FUN_140006ad0', 'lineNum': 650}, {'funcName': 'FUN_140006ad0', 'lineNum': 651}, {'funcName': 'FUN_1400018d4', 'lineNum': 662}, {'funcName': 'memset', 'lineNum': 672}, {'funcName': 'FUN_140006250', 'lineNum': 676}, {'funcName': 'FUN_140008f40', 'lineNum': 683}, {'funcName': 'FUN_140007250', 'lineNum': 688}, {'funcName': 'FUN_140006250', 'lineNum': 697}, {'funcName': 'FUN_140007250', 'lineNum': 703}, {'funcName': 'FUN_1400053f8', 'lineNum': 711}, {'funcName': 'FUN_1400053f8', 'lineNum': 712}, {'funcName': 'FUN_140005e74', 'lineNum': 719}, {'funcName': 'FUN_1400051ac', 'lineNum': 726}, {'funcName': 'FUN_140004e78', 'lineNum': 727}, {'funcName': 'FUN_140007080', 'lineNum': 734}, {'funcName': 'FUN_140007080', 'lineNum': 735}, {'funcName': 'FUN_140006c54', 'lineNum': 743}, {'funcName': 'FUN_140006c54', 'lineNum': 744}, {'funcName': 'FUN_140005f90', 'lineNum': 752}, {'funcName': 'FUN_140005f90', 'lineNum': 753}, {'funcName': 'FUN_14000491c', 'lineNum': 761}, {'funcName': 'FUN_14000491c', 'lineNum': 762}, {'funcName': 'FUN_1400050c4', 'lineNum': 770}, {'funcName': 'FUN_1400050c4', 'lineNum': 771}, {'funcName': 'FUN_140004ed0', 'lineNum': 779}, {'funcName': 'FUN_140004ed0', 'lineNum': 780}, {'funcName': 'FUN_1400051ec', 'lineNum': 788}, {'funcName': 'FUN_1400051ec', 'lineNum': 789}, {'funcName': 'FUN_140006420', 'lineNum': 796}, {'funcName': 'FUN_140008028', 'lineNum': 802}, {'funcName': 'FUN_1400080d4', 'lineNum': 806}, {'funcName': 'FUN_140005bf8', 'lineNum': 813}, {'funcName': 'FUN_140006950', 'lineNum': 820}, {'funcName': 'DbgPrint', 'lineNum': 829}, {'funcName': 'DbgPrint', 'lineNum': 841}, {'funcName': 'DbgPrint', 'lineNum': 855}, {'funcName': 'FUN_140005850', 'lineNum': 861}, {'funcName': 'FUN_140006be0', 'lineNum': 863}, {'funcName': 'FUN_140006be0', 'lineNum': 865}, {'funcName': 'FUN_140006be0', 'lineNum': 866}, {'funcName': 'FUN_1400067ec', 'lineNum': 872}, {'funcName': 'NTOSKRNL.EXE@IofCompleteRequest', 'lineNum': 882}, {'funcName': 'FUN_1400089f0', 'lineNum': 883}]"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 200}
Tool result
{"result":"      }\n      else {\n        if (local_290 < 0x81112f29) {\n          if (local_290 != 0x81112f28) {\n            if (local_290 == 0x81112ee0) {\n              local_150 = 0;\n              local_210 = pdVar2;\n              if (((uVar6 < 0xc) || (uVar1 < 0xc)) || (0xe < (int)*(uint )pdVar2))\n              goto LAB_1400046c4;\n              local_150 = rdmsr((undefined4 )(&DAT_14000b000 + (longlong)(int)(uint *)pdVar2 * 4)\n                               );\n              *(uint *)((longlong)pdVar2 + 4) = (uint)local_150;\n              *(uint *)(pdVar2 + 1) = (uint)((ulonglong)local_150 >> 0x20);\n              *(ulonglong )(param_2 + 0x38) = (ulonglong)uVar1;\n            }\n            else if (local_290 == 0x81112ee4) {\n              local_120 = 0;\n              local_208 = pdVar2;\n              if ((uVar6 < 0xc) || (0xe < (int)(uint *)pdVar2)) goto LAB_1400046c4;\n              local_120 = *(undefined8 )((longlong)pdVar2 + 4);\n              local_c8 = (longlong)(int)(uint )pdVar2;\n              wrmsr((undefined4 )(&DAT_14000b000 + local_c8 * 4),local_120);\n            }\n            else if (local_290 == 0x81112ef8) {\n              if ((uVar6 < 0x14) || ((ulonglong)uVar1 < (ulonglong)(uint )(pdVar2 + 2) + 0x14))\n              goto LAB_1400046c4;\n              uVar6 = HalGetBusDataByOffset\n                                (4,(uint *)pdVar2,\n                                 *(uint )((longlong)pdVar2 + 4) & 0x1f |\n                                 ((uint *)(pdVar2 + 1) & 7) << 5,(uint *)((longlong)pdVar2 + 0x14))\n              ;\n              *(uint *)(pdVar2 + 2) = uVar6;\n              *(ulonglong *)(param_2 + 0x38) = (ulonglong)uVar1;\n            }\n            else if (local_290 == 0x81112f00) {\n              local_1f8 = (uint )((longlong)pdVar2 + 0x14);\n              local_28c = 0;\n              if (((((uVar6 < 0x14) || ((ulonglong)uVar1 < (ulonglong)(uint *)(pdVar2 + 2) + 0x14))\n                   || (0xff < *(uint *)pdVar2)) ||\n                  ((0x1f < *(uint *)((longlong)pdVar2 + 4) || (7 < *(uint *)(pdVar2 + 1))))) ||"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 100}
Tool result
{"result":"  uint local_1b0;\n  uint local_1ac;\n  uint local_1a8;\n  uint local_1a4;\n  uint local_1a0;\n  uint local_19c;\n  uint local_198;\n  uint local_194;\n  uint local_190;\n  uint local_18c;\n  uint local_188;\n  uint local_184;\n  uint local_180;\n  uint local_17c;\n  uint local_178;\n  uint local_174;\n  uint local_170;\n  int local_16c;\n  int local_168;\n  uint local_164;\n  uint local_160;\n  uint local_15c;\n  uint local_158;\n  uint local_154;\n  undefined8 local_150;\n  double *local_148;\n  double *local_140;\n  double *local_138;\n  double *local_130;\n  double *local_128;\n  undefined8 local_120;\n  double *local_118;\n  longlong local_110;\n  double *local_108;\n  double *local_100;\n  double *local_f8;\n  double *local_f0;\n  double *local_e8;\n  double *local_e0;\n  undefined4 local_d8;"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 250}
Tool result
{"result":"                do {\n                  FUN_1400051c0(0xcf8,uVar6);\n                  uVar8 = FUN_140004e94(0xcfc);\n                  local_1f8 = uVar8;\n                  uVar8 = FUN_140004e94(0xcf8);\n                  local_358 = local_358 + 1;\n                  if (uVar6 == uVar8) break;\n                } while (local_358 < 100);\n                if (99 < local_358) goto LAB_1400046c4;\n                FUN_1400051c0(0xcf8,uVar7);\n                local_1f8 = local_1f8 + 1;\n              }\n              if ((uint *)(pdVar2 + 2) % 4 != 0) {\n                uVar6 = *(uint *)pdVar2 * 0x10000 + *(uint *)((longlong)pdVar2 + 4) * 0x800 +\n                        *(uint )(pdVar2 + 1) * 0x100 +\n                        ((uint )((longlong)pdVar2 + 0xc) + local_348 * 4 & 0xff) +\n                        ((uint *)((longlong)pdVar2 + 0xc) + local_348 * 4 & 0xf00) * 0x10000 &\n                        0xfffffffc | 0x80000000;\n                uVar7 = FUN_140004e94(0xcf8);\n                local_358 = 0;\n                do {\n                  FUN_1400051c0(0xcf8,uVar6);\n                  local_28c = FUN_140004e94(0xcfc);\n                  uVar8 = FUN_140004e94(0xcf8);\n                  local_358 = local_358 + 1;\n                  if (uVar6 == uVar8) break;\n                } while (local_358 < 100);\n                if (99 < local_358) goto LAB_1400046c4;\n                FUN_1400051c0(0xcf8,uVar7);\n                FUN_140008f40((undefined8 *)local_1f8,(undefined8 )&local_28c,\n                              (ulonglong)(uint *)(pdVar2 + 2) % 4);\n              }\n              *(ulonglong )(param_2 + 0x38) = (ulonglong)uVar1;\n            }\n            else {\n              if (local_290 == 0x81112f08) {\n                local_200 = pdVar2;\n                if ((uVar6 < 0xc) || ((ulonglong)uVar1 < (ulonglong)(uint *)(pdVar2 + 1) + 0xc))\n                goto LAB_1400046c4;\n                cVar3 = FUN_140006420(pdVar2,(uint *)(pdVar2 + 1),"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 400}
Tool result
{"result":"          if ((uVar6 < 0x10) || (0xc < (int)*(uint *)(pdVar2 + 1))) goto LAB_1400046c4;\n          uVar10 = FUN_140006ad0(0,0,0,(ulonglong)\n                                       *(uint )(&DAT_14000b160 +\n                                                (longlong)(int)(uint *)(pdVar2 + 1) * 4),\n                                 (undefined8 )((longlong)pdVar2 + 0xc),4);\n          cVar3 = (char)uVar10;\n        }\n        else if (local_290 == 0x81112f2c) {\n          local_138 = pdVar2;\n          if ((uVar6 < 8) || (0 < (int)(uint *)pdVar2)) goto LAB_1400046c4;\n          uVar10 = FUN_140006ad0(0,0x14,0,(ulonglong)\n                                          *(uint )(&DAT_14000b04c +\n                                                   (longlong)(int)(uint *)pdVar2 * 4),\n                                 (undefined8 *)((longlong)pdVar2 + 4),4);\n          cVar3 = (char)uVar10;\n        }\n        else if (local_290 == 0x81112f30) {\n          local_340 = 0;\n          local_250 = pdVar2;\n          if ((uVar6 < 10) || (0x10 < *(int *)((longlong)pdVar2 + 2))) goto LAB_1400046c4;\n          cVar3 = *(char *)pdVar2;\n          if (cVar3 == '\x0f') {\n            local_340 = 0x1100;\n          }\n          else if (cVar3 == '\x10') {\n            local_340 = 0x1200;\n          }\n          else if (cVar3 == '\x12') {\n            local_340 = 0x1700;\n          }\n          else if (cVar3 == '\x15') {\n            cVar3 = *(char *)((longlong)pdVar2 + 1);\n            if (cVar3 == '\0') {\n              local_340 = 0x1600;\n            }\n            else if (cVar3 == '\x01') {\n              local_340 = 0x1400;\n            }\n            else if (cVar3 == '\x03') {\n              local_340 = 0x141a;"}

Call ghidra_read_artifact_snippet

Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x140001a24.txt", "line_number": 300}
Tool result
{"result":"                if (*pdVar2 != 0.0) {\n                  local_c0 = *pdVar2;\n                  local_2c0 = *(uint )((longlong)pdVar2 + 0x14) * 0x100000;\n                  local_258 = MmMapIoSpace(local_c0,local_2c0,0);\n                  if (local_258 == 0) goto LAB_1400046c4;\n                }\n                while ((uint *)(pdVar2 + 1) < *(uint )((longlong)pdVar2 + 0x14)) {\n                  while ((uint )((longlong)pdVar2 + 0xc) < 0x20) {\n                    while ((uint *)(pdVar2 + 2) < 8) {\n                      if (pdVar2 == 0.0) {\n                        local_288 = 0;\n                        local_260 = local_38;\n                        for (local_330 = 0; local_330 < 10; local_330 = local_330 + 1) {\n                          FUN_1400051c0(0xcf8,(uint *)(pdVar2 + 1) * 0x10000 +\n                                              *(uint *)((longlong)pdVar2 + 0xc) * 0x800 +\n                                              *(uint *)(pdVar2 + 2) * 0x100 + (local_330 & 0x3f) * 4\n                                              | 0x80000000);\n                          local_288 = FUN_140004e94(0xcfc);\n                          *(undefined4 )(local_260 + (longlong)(int)local_330 * 2) = local_288;\n                        }\n                      }\n                      else {\n                        local_b8 = (ulonglong)\n                                   ((uint *)(pdVar2 + 1) << 0x14 |\n                                    *(uint *)((longlong)pdVar2 + 0xc) << 0xf |\n                                   *(uint *)(pdVar2 + 2) << 0xc);\n                        local_260 = (short *)(local_258 + local_b8);\n                      }\n                      if (local_260 != -1) {\n                        if ((uint *)(pdVar2 + 3) <= local_318) goto LAB_140002819;\n                        local_1f0 = (uint *)((longlong)pdVar2 + (ulonglong)local_318 * 0x34 + 0x1c);\n                        *local_1f0 = *(uint *)(pdVar2 + 1);\n                        local_1f0[1] = *(uint *)((longlong)pdVar2 + 0xc);\n                        local_1f0[2] = *(uint *)(pdVar2 + 2);\n                        FUN_140008f40((undefined8 *)(local_1f0 + 3),(undefined8 *)local_260,0x28);\n                        local_318 = local_318 + 1;\n                      }\n                      *(uint *)(pdVar2 + 2) = *(uint *)(pdVar2 + 2) + 1;\n                    }\n                    *(uint )(pdVar2 + 2) = 0;"}

Call ghidra_search_functions_by_name

Arguments
{"filepath": "/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d", "query": "IO"}
Tool result
{"result":["WdfVersionBind @ 140008d48","WdfVersionBindClass @ 140008d54","WdfVersionUnbind @ 140008d4e","WdfVersionUnbindClass @ 140008d5a","WdmlibIoCreateDeviceSecure @ 14002e06c"]}

Call sandbox_execute

Arguments
{"command": "strings /sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d | grep -i \"io\\|msr\\|pci\\|port\\|read\\|write\" | head -30"}
Tool result
{"exitCode":0,"stdout":"!!!AODDriver::SimplDrvDispatch(): ulPMIO2BaseAddress : %x\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700 %d\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700--->2\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700--->3\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB700 Failed\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister return 0\n!!!AODDriver::SimplDrvDispatch(): ReadSBRegister_SB800\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION0:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION1:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION2:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION3:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION4:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_FUNCTION5:DEVICE_ID not found\n!!!AODDriver::DriverDispatch():IOCTL_WRITE_D0F0:DEVICE_ID not found\n!!!AODDriver::DriverEntry(): IoCreateSymbolicLink() failed\nFound PCI MMIO base address %X\nPCI MMIO base address read from MSR is: %X\nCommon::IsIMCEnabled(): AcpiMMioAddr = %X\nRtlGetVersion\nKeDelayExecutionThread\nKeEnterCriticalRegion\nKeLeaveCriticalRegion\nMmMapIoSpace\nMmUnmapIoSpace\nIofCompleteRequest\nIoCreateSymbolicLink\nIoDeleteDevice\nIoDeleteSymbolicLink\nIoAllocateMdl\n","stderr":""}

Call sandbox_execute

Arguments
{"command": "file /sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"}
Tool result
{"exitCode":0,"stdout":"/sandbox/7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d: PE32+ executable for MS Windows 10.00 (native), x86-64, 9 sections\n","stderr":""}

存在BYOVD漏洞

该驱动文件（AMDRyzenMasterDriverV13）具有典型的BYOVD（Bring Your Own Vulnerable Driver）特征：

核心漏洞证据：

  1. 直接MSR读写 - 允许通过IOCTL 0x81112ee0/0x81112ee4读写任意MSR寄存器（rdmsr/wrmsr）
  2. 物理内存映射 - 通过MmMapIoSpace可映射任意物理内存地址进行读写
  3. PCI配置空间访问 - 通过0xcf8/0xcfc端口可读写任意PCI配置空间
  4. I/O端口直接访问 - 支持任意I/O端口读写操作

关键IOCTL接口：

  • 0x81112ee0: 读MSR
  • 0x81112ee4: 写MSR
  • 0x81112ef8/0x81112f00: PCI配置空间读写
  • 0x81112f08: 物理内存读写
  • 其他多个危险IOCTL用于硬件寄存器操作

攻击面： 攻击者可利用该合法签名驱动绕过内核保护，实现内核级别的任意代码执行、禁用安全软件、提升权限等恶意操作。