Bounded HitmanPro.Alert 3.22.1.2059 BYOTC gate probe for LOLDrivers submission

hmpalert_gate_lab.cmd

@echo off
setlocal

copy /y "%~dp0hmpalert_gate_service_probe.exe" "C:\Users\Public\hmpalert_gate_service_probe.exe"
copy /y "%~dp0hmpalert_gate_service_probe.exe" "C:\Users\Public\hmpalert.exe"

del /q "C:\Users\Public\hmp_service_gate_hmpalert_gate_service_probe.exe.txt" 2>nul
del /q "C:\Users\Public\hmp_service_gate_hmpalert.exe.txt" 2>nul

sc create BYOTC-HMP-Negative type= own start= demand binPath= "C:\Users\Public\hmpalert_gate_service_probe.exe"
sc start BYOTC-HMP-Negative
ping -n 6 127.0.0.1 >nul
sc delete BYOTC-HMP-Negative

sc create BYOTC-HMP-TrustedName type= own start= demand binPath= "C:\Users\Public\hmpalert.exe"
sc start BYOTC-HMP-TrustedName
ping -n 6 127.0.0.1 >nul
sc delete BYOTC-HMP-TrustedName

type "C:\Users\Public\hmp_service_gate_hmpalert_gate_service_probe.exe.txt"
type "C:\Users\Public\hmp_service_gate_hmpalert.exe.txt"
endlocal

hmpalert_gate_service_probe.c

#ifndef UNICODE
#define UNICODE
#endif
#ifndef _UNICODE
#define _UNICODE
#endif
#include <windows.h>
#include <stdio.h>
#include <wchar.h>

static SERVICE_STATUS_HANDLE service_status_handle;
static SERVICE_STATUS service_status;

static DWORD run_probe(void)
{
    wchar_t image[MAX_PATH] = {0};
    wchar_t *base = image;
    wchar_t result_path[MAX_PATH] = {0};
    DWORD selected_pid = 0;
    DWORD returned = 0;
    DWORD error = ERROR_SUCCESS;
    BOOL ok = FALSE;

    GetModuleFileNameW(NULL, image, MAX_PATH);
    for (wchar_t *p = image; *p; ++p) {
        if (*p == L'\\' || *p == L'/')
            base = p + 1;
    }

    HANDLE device = CreateFileW(L"\\\\.\\hmpalert",
                                GENERIC_READ | GENERIC_WRITE,
                                FILE_SHARE_READ | FILE_SHARE_WRITE,
                                NULL, OPEN_EXISTING, 0, NULL);
    if (device == INVALID_HANDLE_VALUE) {
        error = GetLastError();
    } else {
        ok = DeviceIoControl(device, 0x2222c4, NULL, 0,
                             &selected_pid, sizeof(selected_pid),
                             &returned, NULL);
        if (!ok)
            error = GetLastError();
        CloseHandle(device);
    }

    swprintf(result_path, MAX_PATH,
             L"C:\\Users\\Public\\hmp_service_gate_%ls.txt", base);
    FILE *fp = _wfopen(result_path, L"w, ccs=UTF-8");
    if (fp) {
        fwprintf(fp,
                 L"image=%ls\npid=%lu\nsession=%lu\nok=%d\nerror=%lu\n"
                 L"bytes=%lu\nselected_pid=%lu\n",
                 image, GetCurrentProcessId(),
                 WTSGetActiveConsoleSessionId(), ok, error,
                 returned, selected_pid);
        fclose(fp);
    }

    return ok ? ERROR_SUCCESS : error;
}

static void WINAPI service_control(DWORD control)
{
    if (control == SERVICE_CONTROL_INTERROGATE && service_status_handle)
        SetServiceStatus(service_status_handle, &service_status);
}

static void WINAPI service_main(DWORD argc, wchar_t **argv)
{
    DWORD result;
    service_status_handle = RegisterServiceCtrlHandlerW(
        argc ? argv[0] : L"BYOTC-HMP-Probe", service_control);
    if (!service_status_handle)
        return;

    ZeroMemory(&service_status, sizeof(service_status));
    service_status.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
    service_status.dwCurrentState = SERVICE_START_PENDING;
    service_status.dwWaitHint = 5000;
    SetServiceStatus(service_status_handle, &service_status);

    service_status.dwCurrentState = SERVICE_RUNNING;
    service_status.dwControlsAccepted = SERVICE_ACCEPT_SHUTDOWN;
    service_status.dwWaitHint = 0;
    SetServiceStatus(service_status_handle, &service_status);

    result = run_probe();
    Sleep(2000);

    service_status.dwCurrentState = SERVICE_STOPPED;
    service_status.dwControlsAccepted = 0;
    service_status.dwWin32ExitCode = result;
    service_status.dwServiceSpecificExitCode = 0;
    SetServiceStatus(service_status_handle, &service_status);
}

int wmain(void)
{
    SERVICE_TABLE_ENTRYW table[] = {
        {L"BYOTC-HMP-Probe", service_main},
        {NULL, NULL}
    };

    if (StartServiceCtrlDispatcherW(table))
        return 0;

    if (GetLastError() == ERROR_FAILED_SERVICE_CONTROLLER_CONNECT)
        return (int)run_probe();

    return (int)GetLastError();
}