search

Air14 / HyperHide

Hypervisor based anti anti debug plugin for x64dbg
MIT License
1.23k stars 279 forks source link

win10 21h2 bsod #25

Open samcbc opened 1 year ago

samcbc commented 1 year ago

cpu Intel(R) Xeon(R) CPU E3-1230 v3 @ 3.30GHz 3.30 GHz system win10 19044.2006 21H2

https://pastebin.com/dBU3JABH

zaidzentan commented 1 year ago

Check if VT-x and EPT is Enabled. I hope it solves your problem.

samcbc commented 1 year ago

VT-d is Enabled.

Air14 commented 1 year ago

Could you send me a crash dump?

samcbc commented 1 year ago

how to give you file?

samcbc commented 1 year ago

FAILURE_BUCKET_ID: 0x124_0_GenuineIntel_PROCESSOR__UNKNOWN_IMAGE_GenuineIntel.sys

Could it be that my CPU model is too old?

Air14 commented 1 year ago

You can upload it via https://anonfiles.com/

Sqlava commented 1 year ago

I am also getting a BSOD on 21H2. It only occurs when trying to sc start the hyperhide driver. Windows reports the error 'ATTEMPTED_WRITE_TO_READONLY_MEMORY' and specifies that the hyperhide driver failed.

I got the same crash message three times and I tried using both the scripts to execute the service commands as well as typing them out myself in an admin command prompt.

Here are the dumps I copied from the Windows\Minidump directory: https://anonfiles.com/XeUfa4V8yb/013023-68765-01_dmp https://anonfiles.com/WaUba1Vdy0/013023-61718-01_dmp https://anonfiles.com/U8j7b5V3y4/013023-65125-01_dmp

Edit: I compiled the project myself with visual studio community 2019. I just built each project with x64 and release specified. Didn't change anything. Visual studio didn't report any errors.

Edit 2: I think I've discovered the root of my issue. I have an AMD processor and airhv only supports intel. It doesn't even compile for me. I assume that means that HyperHide will also only work with intel processors. It is weird that airhv is the driver that runs considering this. Is it safe to assume this is why I get a BSOD?

Air14 commented 1 year ago

Since airhv does not support amd processors, and HyperHide is based on it, this must be the reason why BSOD appears