Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Last update: Jan 2, 2023

Related tags

Miscellaneous CosMapper

Overview

CosMapper

Loads a signed kernel driver (signed with leaked cert) which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Procedure

The usermode program loads the signed driver (signed with leaked cert)
The signed driver then does a [.data] hook on a ntoskrnl function to transfer the mapped driver buffer to kernel
Usermode process sends mapped driver bytes to driver to map and returns status to usermode.
MmUnloadedList PiddbCache and BigPoolAllocation are cleaned and the driver header is not mapped and no empty bytes for the header allocated.
The usermode program unloads the signed driver (signed with leaked cert) and deletes the service to remove final traces.

Requirements

Your driver needs an entry like the example driver:

struct EntryInitialize
{
	std::uintptr_t mappedImageBase{};
	std::size_t mappedImageSize{};
};

NTSTATUS DriverEntry(EntryInitialize* entryParam)
{
	DebugPrint("Example Driver Mapped [%p] w/ Size [0x%x]", entryParam->mappedImageBase, entryParam->mappedImageSize);

	ExFreePool(reinterpret_cast<void*>(entryParam));

	return STATUS_SUCCESS;
}

The current example passes a structure with the image base and size of the mapped driver but it can be modified to your own liking.

Note: this project was coded in 2 days so it might have some bugs (open ticket)
The project has been tested on Windows 10 20H2

Usage

cosusermode.exe driver.sys

Static reflection for enums (to string, from string, iteration) for modern C++, work with any enum type without any macro or boilerplate code

__ __ _ ______ _____ | \/ | (_) | ____| / ____|_ _ | \ / |

3.3k Jan 5, 2023

Automatically load dlls into any executables without replacing any files!

Automatically loaded dll using xinput9_1_0 proxy. Please put the modified xinput9_1_0.dll in the executable's directory.

14 Dec 24, 2022

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections and LSASS protections

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Kernel callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

Wavestone - Cybersecurity & Digital Trust

846 Jan 2, 2023

Cross-platform C++11 header-only library for memory mapped file IO

mio An easy to use header-only cross-platform C++11 memory mapping library with an MIT license. mio has been created with the goal to be easily includ

1.4k Jan 9, 2023

Code Injection via Memory Mapped Files

MMFCodeInjection This technique leverages File Mapping and APC(s) to execute shellcode into another process. By leveraging file mapping we would not h

52 Dec 28, 2022

If the button pressed esp will reset and App mode will on. App mode will on then led will on, network is connected led will off.

DHT22-to-Google-sheet-Reset-Using-ESP8266-LED-Switch If button pressed esp will reset and App mode will on. App mode will on then led will on, network

3 Aug 17, 2022

Had a tough time playing Microsoft Wordament ? Well WORDament_Solver has your back. It suggests you meaningful words you can use while playing the game and help you top the leaderboard.

WORDament_Solver Had a tough time playing Microsoft Wordament ? Well WORDament_Solver has your back. It suggests you meaningful words you can use whil

3 Aug 19, 2021

Some hypervisor research notes. There is also a useful exploit template that you can use to verify / falsify any assumptions you may make while auditing code, and for exploit development.

Introduction Over the past few weeks, I've been doing some hypervisor research here and there, with most of my focus being on PCI device emulation cod

130 Nov 18, 2022

Windows kernel-mode driver emulating well-known USB game controllers.

1.8k Jan 4, 2023

Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Related tags

Overview

CosMapper

Procedure

Requirements

Usage

You might also like...

Static reflection for enums (to string, from string, iteration) for modern C++, work with any enum type without any macro or boilerplate code

Automatically load dlls into any executables without replacing any files!

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections and LSASS protections

Cross-platform C++11 header-only library for memory mapped file IO

Code Injection via Memory Mapped Files

If the button pressed esp will reset and App mode will on. App mode will on then led will on, network is connected led will off.

Had a tough time playing Microsoft Wordament ? Well WORDament_Solver has your back. It suggests you meaningful words you can use while playing the game and help you top the leaderboard.

Some hypervisor research notes. There is also a useful exploit template that you can use to verify / falsify any assumptions you may make while auditing code, and for exploit development.

Windows kernel-mode driver emulating well-known USB game controllers.

Releases(example)

example(Aug 8, 2021)

Owner

Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.

Signed - a 3D modeling and construction language based on Lua and SDFs. Signed will be available for macOS and iOS and is heavily optimized for Metal.

Program that allows you to get the source code of a website's home page without doing it manually. Use it at your own risk.

External warzone cheat with manual mapped driver (function hook), overlay (nvidia hijack), simple esp, no recoil

An Arduino library which allows you to communicate seamlessly with the full range of u-blox GNSS modules

King Hamlet is a simple tool, which allows you to perform a Process Ghosting Attack

A fantasy map generator based on Martin O'Leary's "Generating fantasy map" notes

A lightweight C++14 parsing library for tmx map files created with the Tiled map editor

A light-weight Flutter Engine Embedder based on HADK ,which for Android devices that runs without any java code

Allows you to easily control via MQTT any Micronova equiped pellet stove. (MCZ, Extraflame, Laminox, and many others brands!)