Write-What-Where in MSI Z/B Series Motherboard SMI Handler

This repository is a Proof-of-Concept (PoC) exploit for CVE-2024-36877, targeting a vulnerability in the MSI ApService SMI handler on Windows systems. The exploit is implemented as a Windows kernel driver, with the main logic in 'exploit.cpp' and 'main.cpp'. The exploit works by: 1. Gaining access to physical memory via the '\Device\PhysicalMemory' device. 2. Locating the System Management Mode (SMM) core structures in physical memory by parsing the Windows registry at '\REGISTRY\MACHINE\HARDWARE\RESOURCEMAP\System Resources\Loader Reserved'. 3. Using EFI variables ('WMIAcpiMemAddr' and 'ApServiceAuthority') to communicate with the SMI handler and inject payloads. 4. Patching SMM code and copying custom shellcode (defined in 'shellcode.hpp') into SMM memory. 5. Triggering SMI interrupts to execute the injected shellcode, which can perform arbitrary actions in SMM, such as memory copying, module mapping, or command execution. The repository is structured as a Visual Studio kernel driver project, with source files for the exploit logic, physical memory access, SMM structure scanning, and shellcode payloads. The exploit is operational and demonstrates advanced techniques for firmware exploitation and SMM code execution. No network endpoints are present; all actions are performed locally with kernel and firmware-level access.