Comments (4)
I'm not goint to debug your own software to figure out what is happening. If you have minidumps and steps to reproduce this -> feel free to attach them here.
from kdu.
The same happened with KDU itself, we check it.
Ok, i'll ask for dumps for you and share here.
from kdu.
- In Windows 11, old-style device names doesn't work anymore.
- BSOD was initiated by service.exe then trying to remove node from namespace, which was loaded by you loader.
So it's not your fault, but good to know, i think.
from kdu.
In Windows 11, old-style device names doesn't work anymore.
BSOD was initiated by service.exe then trying to remove node from namespace, which was loaded by you loader.
This "issue" is entirely your own fault and have nothing to do with what you write. Services.exe is a user mode APP that is responsible for SCM. This loader does not use SCM to map drivers in the kernel space. SCM cannot "remove" anything from kernel because mapped drivers:
1, Does not have "UNLOAD" procedure set (unless you compiled them wrong)
2. Does not managed by SCM in any way
Windows 11 is a marketing relabeling of the same Windows 10, if there is a change like you describe - everything will not work on it.
Suprise, surprise, all the devices names are the same as on Windows 10, Windows 8, Windows 7 and even Windows 2k/NT4.0.
On future note:
there is nothing "incompatible" with kernel in general in KDU loader, because it's just a loader not rootkit or whatever you are trying to load. So it cannot BSOD by design, unlike some script-kiddie software that mess with internal Windows structures to "hide" loaded stuff (rofl).
What can cause BSOD here:
- Error in shellcode, but then it will also BSOD on previous versions of Windows, which eventually will be reported before;
- Some dramatic change in Windows kernel that causing incompatibility - obviously not this time;
- Vulnerable driver it uses to map memory, it is possible, but also clearly not my fault;
- The thing you are trying to load - your payload <- which is this issue and source of problem in 99.99% cases.
If there is the next time will be another issue with no actual minidumps attached and another portion of BS like in your last post - I will automatically lock this issue without further notice.
from kdu.
Related Issues (20)
- TYPO README.md
- BSOD HOT 3
- Insufficient system resources HOT 2
- error HOT 1
- Thanks HOT 1
- Cannot load drivers database, GetLastError 126: HOT 2
- what happened to HVCI support? HOT 1
- Will KDU wait for the DriverEntry of a mapped driver? HOT 2
- Could not accept victim target, GetLastError 2148204812 HOT 4
- KsDumper Driver unloadable? Maybe any mapped driver? HOT 4
- cant use PsGetCreateProcessNotifyRoutine() ??? HOT 4
- Why some people crash on mapping drivers ? HOT 1
- Contact HOT 1
- Providers table not found HOT 4
- how to handle not present page in PwEntryToPhyAddr HOT 1
- No output after mapping dummy driver HOT 2
- Shellcode executing warning HOT 4
- Shellcode version issue HOT 3
- Use in Python HOT 1
- Driver import table parsing issue HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kdu.