search

BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.
https://openark.blackint3.com
GNU Lesser General Public License v2.1
8.29k stars 835 forks source link

win11使用1.3.0无法进入内核模式 #150

Closed zw8519807 closed 8 months ago

zw8519807 commented 9 months ago

OpenArk Console Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{ "err": 0, "appver": "1.3.0", "appbd": "202302271420", "appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=", "appurl": "https://github.com/BlackINT3/OpenArk/releases" }

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\zw851\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\969A6F3F7B6B03139ED9D16D82046A491\fltMgr.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\zw851\AppData\Roaming\OpenArk\symbols\netio.pdb\9EE7BD721D3DEF087E3DBC8DD61C95411\netio.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\zw851\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\738ED8FF966E8502EFE17095B9F1F5481\ntkrnlmp.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\zw851\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\CDEBD0C8A2E913068E2C0DA1ADC5529A1\win32kfull.pdb [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\zw851\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err

BlackINT3 commented 8 months ago

duplicated #151