kdmapper-1803-20H2/kdmapper/service.cpp

#include "service.hpp"


bool ExistOtherService(SC_HANDLE service_manager) {
	DWORD spaceNeeded = 0;
	DWORD numServices = 0;
	if (!EnumServicesStatus(service_manager, SERVICE_DRIVER, SERVICE_STATE_ALL, NULL, 0, &spaceNeeded, &numServices, 0) && GetLastError() != ERROR_MORE_DATA) {
		printf("[-] Can't enum service list error code: %d!!\n",GetLastError());
		return true;
	}
	spaceNeeded += sizeof(ENUM_SERVICE_STATUSA);
	LPENUM_SERVICE_STATUSA buffer = (LPENUM_SERVICE_STATUSA)new BYTE[spaceNeeded];

	if (EnumServicesStatus(service_manager, SERVICE_DRIVER, SERVICE_STATE_ALL, buffer, spaceNeeded, &spaceNeeded, &numServices, 0)) {
		for (DWORD i = 0; i < numServices; i++) {
			ENUM_SERVICE_STATUSA service = buffer[i];
			SC_HANDLE service_handle = OpenService(service_manager, service.lpServiceName, SERVICE_QUERY_CONFIG);
			if (service_handle) {
				LPQUERY_SERVICE_CONFIGA config = (LPQUERY_SERVICE_CONFIGA)new BYTE[8096]; //8096 = max size of QUERY_SERVICE_CONFIGA
				DWORD needed = 0;
				if (QueryServiceConfig(service_handle, config, 8096, &needed)) {
					if (strstr(config->lpBinaryPathName, intel_driver::driver_name)) {
						delete[] buffer;
						printf("[-] WARNING: Service called '%s' have same file name!!\n", config->lpDisplayName);
						CloseServiceHandle(service_handle);
						return false;
					}
				}
				else {
					printf("[-] Note: Error query service %s error code: %d\n", service.lpServiceName, GetLastError());
				}
				CloseServiceHandle(service_handle);
			}
			
		}
		delete[] buffer;
		return false; //no equal services we can continue
	}
	delete[] buffer;
	printf("[-] Can't enum service list!!\n");
	return true;

}

bool ExistsValorantService(SC_HANDLE service_manager) {
	DWORD spaceNeeded = 0;
	DWORD numServices = 0;
	if (!EnumServicesStatus(service_manager, SERVICE_DRIVER, SERVICE_STATE_ALL, NULL, 0, &spaceNeeded, &numServices, 0) && GetLastError() != ERROR_MORE_DATA) {
		printf("[-] Can't enum service list error code: %d!!\n", GetLastError());
		return true;
	}
	spaceNeeded += sizeof(ENUM_SERVICE_STATUSA);
	LPENUM_SERVICE_STATUSA buffer = (LPENUM_SERVICE_STATUSA)new BYTE[spaceNeeded];

	if (EnumServicesStatus(service_manager, SERVICE_DRIVER, SERVICE_STATE_ALL, buffer, spaceNeeded, &spaceNeeded, &numServices, 0)) {
		for (DWORD i = 0; i < numServices; i++) {
			ENUM_SERVICE_STATUSA service = buffer[i];
			if (strstr(service.lpServiceName,"vgk")) {
				if ((service.ServiceStatus.dwCurrentState == SERVICE_RUNNING || service.ServiceStatus.dwCurrentState == SERVICE_START_PENDING)) {
					printf("[-] Valorant service running, kdmapper stopped to prevent BSOD!!\n");
					return true;
				}

			}
		}
		delete[] buffer;
		return false; //no valorant service found
	}
	delete[] buffer;
	printf("[-] Can't enum service list!!\n");
	return true;
}

bool service::RegisterAndStart(const std::string& driver_path)
{
	const std::string driver_name = std::filesystem::path(driver_path).filename().string();
	const SC_HANDLE sc_manager_handle = OpenSCManager(nullptr, nullptr, SC_MANAGER_ALL_ACCESS);

	if (!sc_manager_handle) {
		printf("[-] Can't open service manager\n");
		return false;
	}
	if (ExistOtherService(sc_manager_handle)) {
		return false;
	}

	if (ExistsValorantService(sc_manager_handle)) {
		return false;
	}

	SC_HANDLE service_handle = CreateService(sc_manager_handle, driver_name.c_str(), driver_name.c_str(), SERVICE_START | SERVICE_STOP | DELETE, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_IGNORE, driver_path.c_str(), nullptr, nullptr, nullptr, nullptr, nullptr);

	if (!service_handle)
	{
		service_handle = OpenService(sc_manager_handle, driver_name.c_str(), SERVICE_START);

		if (!service_handle)
		{
			printf("[-] Can't create the vulnerable service, check your AV!!\n");
			CloseServiceHandle(sc_manager_handle);
			return false;
		}
	}

	const bool result = StartService(service_handle, 0, nullptr);

	CloseServiceHandle(service_handle);
	CloseServiceHandle(sc_manager_handle);
	if (!result) {
		printf("[-] Can't start the vulnerable service, check your AV!!\n");
	}
	return result;
}

bool service::StopAndRemove(const std::string& driver_name)
{
	const SC_HANDLE sc_manager_handle = OpenSCManager(nullptr, nullptr, SC_MANAGER_CREATE_SERVICE);

	if (!sc_manager_handle)
		return false;

	const SC_HANDLE service_handle = OpenService(sc_manager_handle, driver_name.c_str(), SERVICE_STOP | DELETE);

	if (!service_handle)
	{
		CloseServiceHandle(sc_manager_handle);
		return false;
	}

	SERVICE_STATUS status = { 0 };
	const bool result = ControlService(service_handle, SERVICE_CONTROL_STOP, &status) && DeleteService(service_handle);

	CloseServiceHandle(service_handle);
	CloseServiceHandle(sc_manager_handle);

	return result;
}