//
// Splicing routines
//

NTSTATUS SetKernelSplicingHook(PVOID pfnDst, PVOID pfnHook, BYTE buffer[5])
{
	__try
	{
		// Backup
		RtlCopyMemory(buffer, pfnDst, 5);

		// Write JMP
		DWORD offset = (DWORD) pfnHook - (DWORD) pfnDst - 5;
		*(BYTE*)pfnDst = 0xE9; // JMP FAR
		*(DWORD*)((DWORD)pfnDst+1) = offset;

		return STATUS_SUCCESS;
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		return GetExceptionCode();
	}
}

NTSTATUS UnsetKernelSplicingHook(PVOID pfnDst, BYTE buffer[5])
{
	__try
	{
		// Restore
		RtlCopyMemory(pfnDst, buffer, 5);
		return STATUS_SUCCESS;
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		return GetExceptionCode();
	}
}

KeBugCheck(code)
{
KeBugCheckEx(code,0,0,0,0);
}

KeBugCheckEx(code,par1,par2,par3,par4)
{
// основная работа по показу BSoD'а
}

KeBugCheck(code)
{
KeBugCheck2(code,0,0,0,0,0);
}

KeBugCheckEx(code,par1,par2,par3,par4)
{
KeBugCheck2(code,par1,par2,par3,par4,0);
}

KeBugCheck2(code,par1,par2,par3,par4,unknown)
{
// основная работа по показу BSoD'а
}

PVOID GetKeBugCheck2Address()
{
	// Acquire KeBugCheck2 address
	DWORD addr = (DWORD) &KeBugCheckEx;
	addr += 0x17;                       // offset of CALL _KeBugCheck2@20
	return (PVOID) (addr + 4 + *(DWORD*)addr);    // jump to KeBugCheck2
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status;
	DPRINT("[~] Driver loading");

	RtlInitUnicodeString(&DeviceName, L"\\Device\\bugcheckeventdevice");
    RtlInitUnicodeString(&SymbolicLinkName, L"\\DosDevices\\bugcheckeventdevice");

	status = IoCreateDevice(DriverObject,
				0, 
				&DeviceName, 
				FILE_DEVICE_UNKNOWN, 
				0, 
				TRUE, 
				&deviceObject);
	
	if (!NT_SUCCESS(status))
	{
		DPRINT("[-] Failed to create first device. IoCreateDevice returned %x", status);
		return STATUS_UNSUCCESSFUL;
	}
	
	deviceObject->Flags |= DO_BUFFERED_IO;
	status = IoCreateSymbolicLink(&SymbolicLinkName, &DeviceName);
	if (!NT_SUCCESS(status))
	{
		DPRINT("[-] Failed to create first symbolic link. IoCreateSymbolicLink returned %x", status);
		IoDeleteDevice(deviceObject);
		return STATUS_UNSUCCESSFUL;
	}

	RtlInitUnicodeString(&EventName, L"\\BaseNamedObjects\\BugCheckEvent");
	OBJECT_ATTRIBUTES oa;
	InitializeObjectAttributes(&oa, &EventName, 0, 0, 0);
	status = ZwCreateEvent(&hEvent, EVENT_ALL_ACCESS, &oa, SynchronizationEvent, FALSE);
	if (!NT_SUCCESS(status))
	{
		DPRINT("[-] Failed to create event. ZwCreateEvent returned %x", status);
		IoDeleteDevice(deviceObject);
		IoDeleteSymbolicLink(&SymbolicLinkName);
		return STATUS_UNSUCCESSFUL;
	}
	DPRINT("[+] Event created, handle is %08x", hEvent);

	DriverObject->DriverUnload = DriverUnload;
	DriverObject->MajorFunction [IRP_MJ_CREATE] =
    DriverObject->MajorFunction [IRP_MJ_CLOSE ] = DriverCreateClose;
    DriverObject->MajorFunction [IRP_MJ_DEVICE_CONTROL ] = DriverIoControl;

	__try
	{
		status = SetKernelSplicingHook(GetKeBugCheck2Address(), KeBugCheck2, SplicingBuffer);
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		status = GetExceptionCode();
	}
	if(!NT_SUCCESS(status))
	{
		DPRINT("[-] Cannot set splicing hook [%08x]", status);
		IoDeleteDevice(deviceObject);
		IoDeleteSymbolicLink(&SymbolicLinkName);
		ZwClose(hEvent);
		return STATUS_UNSUCCESSFUL;
	}

	DPRINT("[+] Driver initialization successful");
	return STATUS_SUCCESS;
}

NTSTATUS DriverCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
	// Dummy. Simply indicate success.
    Irp->IoStatus.Information = 0;
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

// IOCTL
#define FILE_DEVICE_BUGCHECKDRIVER 0x00003656
#define IOCTL_BUGCHECKDRIVER_GET_BUGCHECK_INFO CTL_CODE( FILE_DEVICE_BUGCHECKDRIVER, 0x00, METHOD_BUFFERED, FILE_ANY_ACCESS)

NTSTATUS DriverIoControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    PIO_STACK_LOCATION pisl     = IoGetCurrentIrpStackLocation(Irp);
	NTSTATUS           status   = STATUS_UNSUCCESSFUL;
	ULONG              BuffSize = pisl->Parameters.DeviceIoControl.InputBufferLength;
	PUCHAR             pBuff    = (PUCHAR)Irp->AssociatedIrp.SystemBuffer;

	Irp->IoStatus.Information = 0;

	switch(pisl->Parameters.DeviceIoControl.IoControlCode)
	{
		case IOCTL_BUGCHECKDRIVER_GET_BUGCHECK_INFO:
			__try
			{
				// If bug check info present & buffer's length is greater or equal necessary length, write info to system buffer
				if( bBugCheckInfoPresent && pBuff && pisl->Parameters.DeviceIoControl.OutputBufferLength >= (sizeof(DWORD)*5) )
				{
					((DWORD*)pBuff)[0] = BugCheckCode;
					for(int i=0;i<4;i++) // Copy bug check parameters
						((DWORD*)pBuff)[i+1] = BugCheckParameters[i];

					Irp->IoStatus.Information = sizeof(DWORD)*5; // Copy 5 DWORDs to user buffer
					status = STATUS_SUCCESS;
				}
			}
			__except(EXCEPTION_EXECUTE_HANDLER)
			{
				status = GetExceptionCode();
				DPRINT("[!] IOCTL_BUGCHECKDRIVER_GET_BUGCHECK_INFO: Exception occurred: %08x", status);
			}
		break;
	}   

    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

void DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
	// Delete device
	IoDeleteSymbolicLink (&SymbolicLinkName);
	if(deviceObject)
		IoDeleteDevice (deviceObject);

	// Delete event
	ZwClose(hEvent);

	// Remove hook from KeBugCheck2
	NTSTATUS status;
	__try
	{
		status = UnsetKernelSplicingHook(GetKeBugCheck2Address(), SplicingBuffer);
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		status = GetExceptionCode();
	}
	if(!NT_SUCCESS(status))
		DPRINT("[-] Cannot unset splicing hook [%08x]", status);

	DPRINT ("[+] Driver unloaded");
}

// Pulse event
NTSTATUS PulseEvent()
{
	__try
	{
		// Initialize
		NTSTATUS status;
		HANDLE NewHandle;
		OBJECT_ATTRIBUTES oa;
		InitializeObjectAttributes(&oa, &EventName, 0, 0, 0);
		
		// Open
		status = ZwOpenEvent(&NewHandle, EVENT_MODIFY_STATE, &oa);
		if(!NT_SUCCESS(status))
			return status;
		
		// Pulse
		DPRINT("[~] Trying to pulse event %08x", NewHandle);
		status = ZwPulseEvent(NewHandle, 0);
		if(!NT_SUCCESS(status))
			return status;

		// Close
		ZwClose(NewHandle);
		return STATUS_SUCCESS;
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		// Exception occurred
		return GetExceptionCode();
	}
}

BOOLEAN bBugCheckInfoPresent = 0;
DWORD   BugCheckCode, BugCheckParameters[4];
BYTE SplicingBuffer[5];

void NTAPI KeBugCheck2(
					 IN DWORD iBugCheckCode,
					 IN DWORD iBugCheckParameter1,
					 IN DWORD iBugCheckParameter2,
					 IN DWORD iBugCheckParameter3,
					 IN DWORD iBugCheckParameter4,
					 IN DWORD iUnknown)
{
	// 
	// Lower IRQL to PASSIVE_LEVEL
	//

	KIRQL Irql = KeGetCurrentIrql();
	if(Irql > PASSIVE_LEVEL)
		KeLowerIrql(PASSIVE_LEVEL);

	// Log error
	DPRINT("[*] KeBugCheck2 call - FATAL SYSTEM ERROR. BugCheck code %08x", iBugCheckCode);

	//
	// Write bug check info
	//

	__try
	{
		BugCheckCode = iBugCheckCode;
		BugCheckParameters[0] = iBugCheckParameter1;
		BugCheckParameters[1] = iBugCheckParameter2;
		BugCheckParameters[2] = iBugCheckParameter3;
		BugCheckParameters[3] = iBugCheckParameter4;
		bBugCheckInfoPresent = TRUE;
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		DPRINT("[!] KeBugCheck2: Exception occurred while saving bug check parameters: %08x", GetExceptionCode());
	}

	//
	// Pulse event, user mode process will wake up and show dialog box
	//

	PulseEvent();

	//
	// Hang current thread
	//

	while(1)
		ZwYieldExecution();
}

bool WaitForEvent(char* name)
{
	HANDLE hEvent;
	DWORD error;

	do
	{
		hEvent = OpenEvent(SYNCHRONIZE, FALSE, name);
		error = GetLastError();
		Sleep(1);
	}
	while(!hEvent && error == ERROR_FILE_NOT_FOUND);

	if(!hEvent)
	{
		return false;
	}
	
	WaitForSingleObject(hEvent, INFINITE);
	CloseHandle(hEvent);
	return true;
}

int APIENTRY WinMain(HINSTANCE,HINSTANCE,LPSTR,int)
{
	while(1)
	{
		if(!WaitForEvent("BugCheckEvent"))
			return printf("[!] Failed\n");
		EventSet();
	}
	return 0;
}

// IOCTL
#define FILE_DEVICE_BUGCHECKDRIVER 0x00003656
#define IOCTL_BUGCHECKDRIVER_GET_BUGCHECK_INFO CTL_CODE( FILE_DEVICE_BUGCHECKDRIVER, 0x00, METHOD_BUFFERED, FILE_ANY_ACCESS)

void EventSet()
{
	struct
	{
		DWORD BugCheckCode;
		DWORD BugCheckParameters[4];
	} BugCheckInfo = {0};

	BOOL res = 0;

	HANDLE hFile = CreateFile("\\\\.\\bugcheckeventdevice", GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
	DWORD ret;
	if(hFile != INVALID_HANDLE_VALUE)
	{
		res = DeviceIoControl(hFile, IOCTL_BUGCHECKDRIVER_GET_BUGCHECK_INFO, 0, 0, &BugCheckInfo, sizeof(BugCheckInfo), &ret, 0);
		CloseHandle(hFile);
	}

	char buffer[1024];
	if(res)
		sprintf(buffer,
			"Warning!! The fatal kernel mode error occurred at address 0x%08x\n"
			"\n"
			"BugCheck code: %08x\n"
			"Parameters:\n"
			"  BugCheckParameter1: 0x%08x\n"
			"  BugCheckParameter2: 0x%08x\n"
			"  BugCheckParameter3: 0x%08x\n"
			"  BugCheckParameter4: 0x%08x\n"
			"\n"
			"It is HIGHLY RECOMMENDED to reboot as soon as possible, because if you\n"
			" continue working, it may cause unrecoverable errors or simply system hang.\n",
			0,
			BugCheckInfo.BugCheckCode, BugCheckInfo.BugCheckParameters[0], BugCheckInfo.BugCheckParameters[1],
			BugCheckInfo.BugCheckParameters[2], BugCheckInfo.BugCheckParameters[3]
			);
	else
		sprintf(buffer,
			"Warning!! The fatal kernel mode error occurred at address 0x%08x\n"
			"\n"
			"Unfortunately, it was unable to get bugcheck information.\n"
			"Additional information is not available.\n"
			"\n"
			"It is HIGHLY RECOMMENDED to reboot as soon as possible, because if you\n"
			" continue working, it may cause unrecoverable errors or simply system hang.\n",
			0,
			BugCheckInfo.BugCheckCode, BugCheckInfo.BugCheckParameters[0], BugCheckInfo.BugCheckParameters[1],
			BugCheckInfo.BugCheckParameters[2], BugCheckInfo.BugCheckParameters[3]
			);
	MessageBox(0, buffer, "Fatal system error", MB_ICONERROR|MB_OK);
}