MTA FairplayKD Driver Reversed and Exploited for RPM

So, I wanted to know how they make the HWIDs and I eneded up reversing most of their kernel driver
…and what I was searching for wasn’t there

Anyway, I’ll upload the IDA database so you can look at the pseudocode to see how basic kernel protection looks like
Also, it’s worth it to look at how they whitelist certain processes based on filename only

The driver is controlled using IOCTL and any usermode process can use it

It can be exploited for kernel mode memory reading but not writing
However only x86 processes can use it safely since it only accepts a 32bit pointer for the read buffer

I’ll also include an example project that demonstrates how to use it for RPM (compile in x86)
(You might need to traverse the module list from PEB)

Here is a part from their own RPM implementation

This is my example code in action

Now that I think about it, I didn’t see a command for closing the handle xP