NTSTATUS

TriggerArbitraryWrite(

    _In_ PWRITE_WHAT_WHERE UserWriteWhatWhere

)

{

    PULONG_PTR What = NULL;

    PULONG_PTR Where = NULL;

    NTSTATUS Status = STATUS_SUCCESS;

    PAGED_CODE();

    __try

    {

        //

        // Verify if the buffer resides in user mode

        //

        ProbeForRead((PVOID)UserWriteWhatWhere, sizeof(WRITE_WHAT_WHERE), (ULONG)__alignof(UCHAR));

        What = UserWriteWhatWhere->What;

        Where = UserWriteWhatWhere->Where;

        DbgPrint("[+] UserWriteWhatWhere: 0x%p\n", UserWriteWhatWhere);

        DbgPrint("[+] WRITE_WHAT_WHERE Size: 0x%X\n", sizeof(WRITE_WHAT_WHERE));

        DbgPrint("[+] UserWriteWhatWhere->What: 0x%p\n", What);

        DbgPrint("[+] UserWriteWhatWhere->Where: 0x%p\n", Where);

#ifdef SECURE

        //

        // Secure Note: This is secure because the developer is properly validating if address

        // pointed by 'Where' and 'What' value resides in User mode by calling ProbeForRead()/

        // ProbeForWrite() routine before performing the write operation

        //

        ProbeForRead((PVOID)What, sizeof(PULONG_PTR), (ULONG)__alignof(UCHAR));

        ProbeForWrite((PVOID)Where, sizeof(PULONG_PTR), (ULONG)__alignof(UCHAR));

        *(Where) = *(What);

#else

        DbgPrint("[+] Triggering Arbitrary Write\n");

        //

        // Vulnerability Note: This is a vanilla Arbitrary Memory Overwrite vulnerability

        // because the developer is writing the value pointed by 'What' to memory location

        // pointed by 'Where' without properly validating if the values pointed by 'Where'

        // and 'What' resides in User mode

        //

        *(Where) = *(What);

#endif

    }

    __except (EXCEPTION_EXECUTE_HANDLER)

    {

        Status = GetExceptionCode();

        DbgPrint("[-] Exception Code: 0x%X\n", Status);

    }

    //

    // There is one more hidden vulnerability. Find it out.

    return Status;