BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.
https://openark.blackint3.com
GNU Lesser General Public License v2.1
9.17k stars 888 forks source link

win11的22H2版本,进入内核模式没有显示热键列表 #113

Closed yzx4036 closed 10 months ago

yzx4036 commented 1 year ago

win11的22H2版本,进入内核模式没有显示热键列表,一片空白,软件版本1.30 64位 image

hexadecimal233 commented 1 year ago

已知bug

BlackINT3 commented 1 year ago

@yzx4036 打开左下角控制台窗口,把日志传上来看看

yzx4036 commented 1 year ago

@BlackINT3

OpenArk Console Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk [UNONE::FsReadFileDataW] [WARN] C:\Users\E_Ye\AppData\Roaming\OpenArk\console\history.txt is empty file [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{ "err": 0, "appver": "1.3.0", "appbd": "202302271420", "appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=", "appurl": "https://github.com/BlackINT3/OpenArk/releases" }

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\E_Ye\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\FFC175D7CE6AAA39785DC36F72AEC0011\fltMgr.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\E_Ye\AppData\Roaming\OpenArk\symbols\netio.pdb\7A2A836DD42A3F7A4CD44BD85D421CFA1\netio.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\E_Ye\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\FD4B3CA9639A08DC674D0C4BA384198D1\ntkrnlmp.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\E_Ye\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\D13B89DAA56D74556B3544C4E916807B1\win32kfull.pdb [Kernel::onClickKernelMode] [INFO] Enter KernelMode ok

ChaXxl commented 1 year ago

我的 win 11 没问题 22621.1413

BlackINT3 commented 1 year ago

@yzx4036 加Q群535752025 私聊我下。

复杂一点问题可以直接进群私聊我,主要是为了提高效率,Github处理这类问题太低效了

baidwwy commented 1 year ago

@yzx4036 加Q群535752025 私聊我下。

复杂一点问题可以直接进群私聊我,主要是为了提高效率,Github处理这类问题太低效了

昨天升级导致的 22621.1555

libai-m2 commented 1 year ago

我的win11能进入成功,但是显示不了快捷键 image

日志如下: OpenArk Console Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk [UNONE::FsReadFileDataW] [WARN] C:\Users\yajun.tan\AppData\Roaming\OpenArk\console\history.txt is empty file [OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{ "err": 0, "appver": "1.3.0", "appbd": "202302271420", "appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=", "appurl": "https://github.com/BlackINT3/OpenArk/releases" }

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.

hakiu commented 1 year ago

一样的问题,加了作者的群了,windows11, 22h2,能看到占用热键的进程线程,但是看不到热键

SweetAsprin commented 1 year ago

一样的问题,不显示热键

微信截图_20230625203952
SweetAsprin commented 1 year ago

[UNONE::FsReadFileDataW] [WARN] C:\Users\SweetAsprin\AppData\Roaming\OpenArk\console\history.txt is empty file [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{ "err": 0, "appver": "1.3.0", "appbd": "202302271420", "appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=", "appurl": "https://github.com/BlackINT3/OpenArk/releases" }

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\SweetAsprin\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\969A6F3F7B6B03139ED9D16D82046A491\fltMgr.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\SweetAsprin\AppData\Roaming\OpenArk\symbols\netio.pdb\8BE33B15E23425D5F5C1C868DD0D3AFB1\netio.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\SweetAsprin\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\DB9E9EC849EB856A93EB8F4736A05ABD1\ntkrnlmp.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\SweetAsprin\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\F40FFE1D09B72E512D38F598A08A365C1\win32kfull.pdb [Kernel::onClickKernelMode] [INFO] Enter KernelMode ok

lvzbOne commented 1 year ago

同样的问题,不显示热键 微信截图_20230625203952 解决了吗,我也是这个问题

BlackINT3 commented 10 months ago

v1.3.2 released.