Skip to content

Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Notifications You must be signed in to change notification settings

armvirus/CosMapper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

16 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

CosMapper

Loads a signed kernel driver (signed with leaked cert) which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Procedure

  1. The usermode program loads the signed driver (signed with leaked cert)
  2. The signed driver then does a [.data] hook on a ntoskrnl function to transfer the mapped driver buffer to kernel
  3. Usermode process sends mapped driver bytes to driver to map and returns status to usermode.
  4. MmUnloadedList PiddbCache and BigPoolAllocation are cleaned and the driver header is not mapped and no empty bytes for the header allocated.
  5. The usermode program unloads the signed driver (signed with leaked cert) and deletes the service to remove final traces.

Requirements

Your driver needs an entry like the example driver:

struct EntryInitialize
{
	std::uintptr_t mappedImageBase{};
	std::size_t mappedImageSize{};
};

NTSTATUS DriverEntry(EntryInitialize* entryParam)
{
	DebugPrint("Example Driver Mapped [%p] w/ Size [0x%x]", entryParam->mappedImageBase, entryParam->mappedImageSize);

	ExFreePool(reinterpret_cast<void*>(entryParam));

	return STATUS_SUCCESS;
}

The current example passes a structure with the image base and size of the mapped driver but it can be modified to your own liking.

DbgView Example

Note: this project was coded in 2 days so it might have some bugs (open ticket)
The project has been tested on Windows 10 20H2

Usage

cosusermode.exe driver.sys

About

Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages