search

BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.
https://openark.blackint3.com
GNU Lesser General Public License v2.1
9.17k stars 888 forks source link

v1.3.0进入内核模式失败 #152

Closed godtang closed 11 months ago

godtang commented 1 year ago

[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\tmj\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\BDB830D5AD37A0994727A90DE1D97BA41\fltMgr.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\tmj\AppData\Roaming\OpenArk\symbols\netio.pdb\AB48DD1F891D44F37D4883A131CE8E5F1\netio.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\tmj\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\79BE8C368BEC7DD9677EA9B355ACE7841\ntkrnlmp.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\tmj\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\E4F8E6FD1C189A77A7282D02D158A7971\win32kfull.pdb [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\tmj\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err image

ZXYxc commented 11 months ago

i meet the same question

gaofeng03 commented 11 months ago

i meet the same question

1235789gzy1 commented 11 months ago

设置-更新和安全-恢复-高级启动 选择 禁用驱动程序签名强制执行 看看能不能进入内核模式

DyingWallet commented 11 months ago

image 遇到了类似的问题，系统：Win11 22H2 22621.2428

BlackINT3 commented 11 months ago

进QQ群 706663529， 获取最新Beta版 注：后面Beta版都在QQ群发布，也可以在github等待发布稳定版。

Join QQ group 706663529 to get the latest Beta version. Note: Beta versions will be released in the QQ group, and you can also wait for the stable version to be released on GitHub.

thunder-sword commented 11 months ago

进QQ群 706663529， 获取最新Beta版 注：后面Beta版都在QQ群发布，也可以在github等待发布稳定版。

Join QQ group 706663529 to get the latest Beta version. Note: Beta versions will be released in the QQ group, and you can also wait for the stable version to be released on GitHub.

这个群搜不到啊，老哥你试试看

DyingWallet commented 11 months ago

进QQ群 706663529， 获取最新Beta版 注：后面Beta版都在QQ群发布，也可以在github等待发布稳定版。

Join QQ group 706663529 to get the latest Beta version. Note: Beta versions will be released in the QQ group, and you can also wait for the stable version to be released on GitHub.

QQ上搜不到这个群

godtang commented 11 months ago

@DyingWallet @thunder-sword 用电脑搜，我用手机也搜不到 image

godtang commented 11 months ago

加群后已经能进入内核模式，各位可以等待或加群获取最新版本。

Bluky-BlueSky commented 2 months ago

设置-更新和安全-恢复-高级启动 选择 禁用驱动程序签名强制执行 看看能不能进入内核模式

使用这个方法成功进入内核模式，感谢