CVE-2026-38194

This repository is a standalone Windows x64 C++ exploit/PoC for CVE-2026-38194 affecting Teledyne Digital Imaging Sapera Memory Manager's CORMEM.SYS driver. It is not a framework module. The project contains 8 files total, with the main code in main.cpp, cordrv.cpp, cordrv.hpp, and tlb_cache.hpp, plus build metadata in CMakeLists.txt and documentation in README.md. Structure and purpose: - main.cpp is the CLI entry point. It accepts either a process name for auto-resolution or a PID plus virtual address for manual mode, initializes the vulnerable driver interface, finds the system DTB, locates the target process DTB from EPROCESS traversal, translates the requested virtual address to a physical address, reads memory, and hex-dumps the result. - cordrv.hpp defines the vulnerable device path, all exposed IOCTL codes, Windows kernel structure offsets, request/response structs, and the CorDrv class interface. - cordrv.cpp implements the exploit logic around DeviceIoControl calls to \\.\CORMEM. Based on the visible code and README, it maps pool blocks, maps/unmaps physical memory, performs physical memory reads/writes, translates virtual addresses, discovers DTBs, reads/writes target process memory, and includes a HideDriver/RestoreDriver capability that manipulates PsLoadedModuleList via direct kernel memory writes. - tlb_cache.hpp provides a short-lived cache for virtual-to-physical translations to reduce repeated IOCTL/page-walk overhead. - README.md documents the vulnerability, build steps, driver loading, and example usage against Discord. Main exploit capabilities: 1. Opens the vulnerable kernel device \\.\CORMEM and abuses unrestricted IOCTLs. 2. Builds arbitrary physical memory access primitives by mapping physical pages into user space. 3. Finds the system DTB and target process DTB, then performs manual page-table walks to translate virtual addresses. 4. Reads arbitrary target process memory without using standard Win32 APIs like ReadProcessMemory, which helps evade userland API monitoring. 5. Exposes write primitives as well, making arbitrary process memory modification possible even though the bundled CLI demonstrates reading/dumping. 6. Includes additional low-level capabilities such as I/O port access, buffer allocation/mapping, and physical memory allocation/freeing. 7. Contains DKOM-style driver hiding logic by unlinking the driver's LDR entry from PsLoadedModuleList, though the main program explicitly avoids using it because of PatchGuard/KPP BSOD risk. Operationally, this is more than a simple detector: it is a working local privilege-abuse tool that leverages a vulnerable signed driver already present on the system. The included executable is primarily a memory-dump PoC, but the underlying wrapper class provides broader arbitrary read/write functionality suitable for post-exploitation or cheat-style memory access scenarios.