Air14 / HyperHide

Hypervisor based anti anti debug plugin for x64dbg
MIT License
1.23k stars 279 forks source link

StartService FAILED 31 2H22 There may still be problems #30

Open shadow0x000 opened 1 year ago

shadow0x000 commented 1 year ago

[02:35:43.284] [INFORMATION] [perform_allocation:109] Allocation successful [02:35:43.284] [INFORMATION] [perform_allocation:109] Allocation successful [02:35:43.284] [INFORMATION] [perform_allocation:109] Allocation successful [02:35:43.284] [INFORMATION] [perform_allocation:109] Allocation successful [02:35:43.300] [INFORMATION] [init_vcpu:272] vcpu entry allocated successfully at FFFFA00491BE3230 [02:35:43.300] [INFORMATION] [init_vcpu:272] vcpu entry allocated successfully at FFFFA00491BE3310 [02:35:43.300] [INFORMATION] [init_logical_processor:368] vcpu 0 is now in VMX operation.

[02:35:43.300] [INFORMATION] [init_logical_processor:368] vcpu 1 is now in VMX operation.

[02:35:43.347] [INFORMATION] [DriverEntry:89] HyperVisor On [02:35:43.347] [INFORMATION] [DriverEntry:94] Got offsets [02:35:43.347] [INFORMATION] [DriverEntry:99] Got code caves [02:35:43.363] [INFORMATION] [DriverEntry:104] Got Ssdt [02:35:43.394] [INFORMATION] [GetPfnDatabase:28] MmPfnDataBase address 0xffff980000000000 [02:35:43.394] [INFORMATION] [DriverEntry:109] Hider Initialized [02:35:43.394] [INFORMATION] [DriverEntry:117] PsSetCreateThreadNotifyRoutine succeded [02:35:43.394] [INFORMATION] [DriverEntry:126] PsSetCreateProcessNotifyRoutine succeded [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtContinueEx is equal: 0xA1 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtSetInformationThread is equal: 0xD [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQueryInformationProcess is equal: 0x19 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQueryObject is equal: 0x10 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtSystemDebugControl is equal: 0x1BD [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtSetContextThread is equal: 0x18B [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQuerySystemInformation is equal: 0x36 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtGetContextThread is equal: 0xF2 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtClose is equal: 0xF [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQueryInformationThread is equal: 0x25 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtCreateThreadEx is equal: 0xC1 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtCreateFile is equal: 0x55 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtCreateProcessEx is equal: 0x4D [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtYieldExecution is equal: 0x46 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQuerySystemTime is equal: 0x5A [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQueryPerformanceCounter is equal: 0x31 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtQueryInformationJobObject is equal: 0x14A [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtCreateUserProcess is equal: 0xC8 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtGetNextProcess is equal: 0xF7 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtOpenProcess is equal: 0x26 [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtOpenThread is equal: 0x12E [02:35:43.394] [DEBUG] [GetNtSyscallNumbers:109] Syscall NtSetInformationProcess is equal: 0x1C [02:35:43.394] [INFORMATION] [hook_function:653] Page already hooked [02:35:43.394] [INFORMATION] [hook_function:653] Page already hooked [02:35:43.394] [INFORMATION] [hook_function:653] Page already hooked [02:35:43.394] [INFORMATION] [hook_function:653] Page already hooked [02:35:43.394] [ERROR] [hook_function:638] Requested virtual memory doesn't exist in physical one [02:35:43.394] [ERROR] [HookNtSyscalls:1821] NtSetContextThread hook failed