//
// Enable InbvDisplayString calls to make it through to bootvid driver.
//

if (InbvIsBootDriverInstalled()) {

    InbvAcquireDisplayOwnership();

    InbvResetDisplay();
    InbvSolidColorFill(0,0,639,479,4); // make the screen blue
    InbvSetTextColor(15);
    InbvInstallDisplayStringFilter((INBV_DISPLAY_STRING_FILTER)NULL);
    InbvEnableDisplayString(TRUE);     // enable display string
    InbvSetScrollRegion(0,0,639,479);  // set to use entire screen
}

.text:0045C303 _KeBugCheckEx@20 proc near
.text:0045C303 BugCheckCode    = dword ptr  8
.text:0045C303 BugCheckParameter1= dword ptr  0Ch
.text:0045C303 BugCheckParameter2= dword ptr  10h
.text:0045C303 BugCheckParameter3= dword ptr  14h
.text:0045C303 BugCheckParameter4= dword ptr  18h
.text:0045C303
.text:0045C303                 mov     edi, edi
.text:0045C305                 push    ebp
.text:0045C306                 mov     ebp, esp
.text:0045C308                 push    0               ; int
.text:0045C30A                 push    [ebp+BugCheckParameter4] ; int
.text:0045C30D                 push    [ebp+BugCheckParameter3] ; int
.text:0045C310                 push    [ebp+BugCheckParameter2] ; int
.text:0045C313                 push    [ebp+BugCheckParameter1] ; int
.text:0045C316                 push    [ebp+BugCheckCode] ; int
.text:0045C319                 call    _KeBugCheck2@24 ; KeBugCheck2(x,x,x,x,x,x)

.text:0045BDA3                 push    4
.text:0045BDA5                 push    1DFh
.text:0045BDAA                 mov     ebx, 27Fh
.text:0045BDAF                 push    ebx
.text:0045BDB0                 push    esi
.text:0045BDB1                 push    esi
.text:0045BDB2                 call    _InbvSolidColorFill@20 ; InbvSolidColorFill(x,x,x,x,x)

PUCHAR GetBugcheckColorAddress()
{
	DWORD addr = (DWORD) &KeBugCheckEx;
	addr += 0x17;
	addr = addr + 4 + *(DWORD*)addr;
	addr += 0x5EA;
	return (PUCHAR) addr;
}

#define IOCTL_FAULTDRIVER_GET_BUGCHECK_COLOR 0x0014
#define IOCTL_FAULTDRIVER_SET_BUGCHECK_COLOR 0x0024

NTSTATUS DriverIoControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    PIO_STACK_LOCATION pisl     = IoGetCurrentIrpStackLocation(Irp);
	NTSTATUS           status   = STATUS_UNSUCCESSFUL;
	ULONG              BuffSize = pisl->Parameters.DeviceIoControl.InputBufferLength;
	PUCHAR             pBuff    = (PUCHAR)Irp->AssociatedIrp.SystemBuffer;

	Irp->IoStatus.Information = 0;

	switch(pisl->Parameters.DeviceIoControl.IoControlCode)
	{
		case IOCTL_FAULTDRIVER_GET_BUGCHECK_COLOR: 
			if (pBuff && pisl->Parameters.DeviceIoControl.OutputBufferLength >= 1)
			{
				DPRINT("[~] DeviceIoControl : IOCTL_FAULTDRIVER_GET_BUGCHECK_COLOR");

				__try
				{
					if(*NtBuildNumber != 2600)
					{
						DPRINT("[!] This driver supports only Windows XP build 2600, current build is %d", *NtBuildNumber);
						status = STATUS_ILLEGAL_FUNCTION;
						break;
					}
					
					PUCHAR lpBugcheckColor = GetBugcheckColorAddress();
					*pBuff = *lpBugcheckColor;

					DPRINT("[+] Search completed. Address is 0x%08x, bugcheck color is %02x", lpBugcheckColor, *pBuff);

					Irp->IoStatus.Information = 1;
					status = STATUS_SUCCESS;
				}
				__except(EXCEPTION_EXECUTE_HANDLER)
				{
					Irp->IoStatus.Status = status = GetExceptionCode();
					Irp->IoStatus.Information = 0;

					DPRINT("[!] Unhandled exception %.x", status);
					break;
				}
			}
			break;

		case IOCTL_FAULTDRIVER_SET_BUGCHECK_COLOR: 
			DPRINT("Buffer size = %d", BuffSize);

			if (pBuff && BuffSize >= 1 && pisl->Parameters.DeviceIoControl.OutputBufferLength >= 1)
			{
				DPRINT("[~] DeviceIoControl : IOCTL_FAULTDRIVER_SET_BUGCHECK_COLOR");

				__try
				{
					if(*NtBuildNumber != 2600)
					{
						DPRINT("[!] This driver supports only Windows XP build 2600, current build is %d", *NtBuildNumber);
						status = STATUS_ILLEGAL_FUNCTION;
						break;
					}
					
					PUCHAR lpBugcheckColor = GetBugcheckColorAddress();
					BYTE oldcolor = *lpBugcheckColor;

					DPRINT("[+] Search completed. Address is 0x%08x, bugcheck color is %02x", lpBugcheckColor, oldcolor);
					DPRINT("[~] Requested color is %02x", *pBuff);

					*lpBugcheckColor = *pBuff;
					*pBuff = oldcolor;

					DPRINT("[+] New color set: %02x, color returned: %02x", *lpBugcheckColor, *pBuff);

					Irp->IoStatus.Information = 1;
					status = STATUS_SUCCESS;
				}
				__except(EXCEPTION_EXECUTE_HANDLER)
				{
					Irp->IoStatus.Status = status = GetExceptionCode();
					Irp->IoStatus.Information = 0;

					DPRINT("[!] Unhandled exception %.x", status);
					break;
				}
			}		
			break;
	}   

    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

#define _X86_
#include <ntddk.h>

#define DPRINT DbgPrint

UNICODE_STRING DeviceName;
UNICODE_STRING SymbolicLinkName;
PDEVICE_OBJECT deviceObject;

void DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
	IoDeleteSymbolicLink (&SymbolicLinkName);
	if(deviceObject)
		IoDeleteDevice (deviceObject);

	DPRINT ("[+] Driver unloaded");
}

extern "C" PUSHORT NtBuildNumber;

NTSTATUS DriverIoControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);

NTSTATUS DriverCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    Irp->IoStatus.Information = 0;
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status;

	DPRINT("[~] Driver loading");

	RtlInitUnicodeString(&DeviceName, L"\\Device\\faultdriver");
    RtlInitUnicodeString(&SymbolicLinkName, L"\\DosDevices\\faultdriver");

	status = IoCreateDevice(DriverObject, 
		                    0, 
							&DeviceName, 
							FILE_DEVICE_UNKNOWN, 
							0, 
							TRUE, 
							&deviceObject);
	
	if (!NT_SUCCESS(status))
	{
		DPRINT("[-] Failed to create device. IoCreateDevice returned %x", status);
		return STATUS_UNSUCCESSFUL;
	}
	
	deviceObject->Flags |= DO_BUFFERED_IO;
	status = IoCreateSymbolicLink(&SymbolicLinkName, &DeviceName);
	if (!NT_SUCCESS(status))
	{
		DPRINT("[-] Failed to create symbolic link. IoCreateSymbolicLink returned %x", status);
		IoDeleteDevice(deviceObject);
		return STATUS_UNSUCCESSFUL;
	}

	// Set dispath routines
		
	DriverObject->DriverUnload = DriverUnload;

	DriverObject->MajorFunction [IRP_MJ_CREATE] =
    DriverObject->MajorFunction [IRP_MJ_CLOSE ] = DriverCreateClose;
    DriverObject->MajorFunction [IRP_MJ_DEVICE_CONTROL ] = DriverIoControl;

	DPRINT("[+] Driver initialization successful");

	return STATUS_SUCCESS;
}

// User mode API

#define IOCTL_FAULTDRIVER_GET_BUGCHECK_COLOR 0x0014
#define IOCTL_FAULTDRIVER_SET_BUGCHECK_COLOR 0x0024

UCHAR GetCurrentBugcheckColor()
{
	HANDLE hDevice = CreateFile("\\\\.\\faultdriver", GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
	if(hDevice == INVALID_HANDLE_VALUE)
		return -1;

	DWORD ret;
	char buffer;
	if(!DeviceIoControl(
		hDevice,
		IOCTL_FAULTDRIVER_GET_BUGCHECK_COLOR,
		&buffer, sizeof(buffer),
		&buffer, sizeof(buffer),
		&ret,
		0
		))
	{
		CloseHandle(hDevice);
		return -1;
	}
	else
	{
		CloseHandle(hDevice);
		return buffer;
	}
}

UCHAR SetCurrentBugcheckColor(UCHAR cNew)
{
	HANDLE hDevice = CreateFile("\\\\.\\faultdriver", GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
	if(hDevice == INVALID_HANDLE_VALUE)
		return -1;

	DWORD ret;
	char buffer = cNew;
	if(!DeviceIoControl(
		hDevice,
		IOCTL_FAULTDRIVER_SET_BUGCHECK_COLOR,
		&buffer, sizeof(buffer),
		&buffer, sizeof(buffer),
		&ret,
		0
		))
	{
		CloseHandle(hDevice);
		return -1;
	}
	else
	{
		CloseHandle(hDevice);
		return buffer;
	}
}