search

BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.
https://openark.blackint3.com
GNU Lesser General Public License v2.1
8.29k stars 835 forks source link

64 位操作系统, 基于 ARM 的处理器进入内核报错 #178

Open dylan-ing opened 2 months ago

dylan-ing commented 2 months ago

64 位操作系统, 基于 ARM 的处理器

报错信息，请大神看一看

[UNONE::FsReadFileDataW] [WARN] C:\Users\HUAWEI\AppData\Roaming\OpenArk\console\history.txt is empty file [UNONE::PsGetProcessInfo64W] [ERR] VirtualOpenProcess pid:4 err:5 [Kernel::InitKernelEntryView::::operator ()] [INFO] 操作系统 : Windows 11 [Kernel::InitKernelEntryView::::operator ()] [INFO] 主版本号 : 10 [Kernel::InitKernelEntryView::::operator ()] [INFO] 副版本号 : 0 [Kernel::InitKernelEntryView::::operator ()] [INFO] 发行编号 : 22H2 [Kernel::InitKernelEntryView::::operator ()] [INFO] 编译号 : 22621 [Kernel::InitKernelEntryView::::operator ()] [INFO] 主服务包 : 0 [Kernel::InitKernelEntryView::::operator ()] [INFO] 副服务包 : 0 [Kernel::InitKernelEntryView::::operator ()] [INFO] R3地址空间 : 0x10000 - 0x7FFFFFFEFFFF [Kernel::InitKernelEntryView::::operator ()] [INFO] R0地址空间 : 0xFFFF080000000000 - 0xFFFFFFFFFFFFFFFF [Kernel::InitKernelEntryView::::operator ()] [INFO] 页面大小 : 4 KB [Kernel::InitKernelEntryView::::operator ()] [INFO] 物理内存 : 15 GB [Kernel::InitKernelEntryView::::operator ()] [INFO] CPU核数 : 8 [Kernel::InitKernelEntryView::::operator ()] [INFO] 系统根目录 : C:\WINDOWS [Kernel::InitKernelEntryView::::operator ()] [INFO] 启动时间 : 2024-04-13 10:26:06 (0Day/1Hour/51Min) [Kernel::InitKernelEntryView::::operator ()] [INFO] BootInfo : UEFI & SecureBoot & VBS [Kernel::InitKernelEntryView::::operator ()] [INFO] HVM : SVM Disabled [OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.4, build:202312202152 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{ "err": 0, "appver": "1.3.4", "appbd": "202312202152", "appcl": "LSDov5vnqIvlop7lvLrvvJrlop7liqDlhoXlrZjkvb/nlKjjgIFQRULjgIFURULjgIHnur/nqIvmoIjjgIHnu5PmnZ/nur/nqIvnrYnlkITnp43lip/og70NCi0g5YaF5qC45aKe5by677ya5aKe5Yqg5YWo5YaF5a2Y5pCc57Si44CB5Y246L296amx5Yqo5YiX6KGo44CB6ZWc5YOP5Yqr5oyB44CB5Yqg6L2956ym5Y+3562J5ZCE56eN5Yqf6IO9DQotIOaJq+aPj+aPkOWNh++8muS8mOWMllBF5omr5o+P44CB5pSv5oyB6Kej5p6Q5YaF5a2Y5YyWUEXnrYnlip/og70NCi0g6Kej5Yaz6YOo5YiG5LiN6IO96L+b5YWl5YaF5qC45qih5byP55qE6Zeu6aKYDQotIEJVR+S/ruWkje+8jOi/mOacieWFtuWug+W+iOWkmuacquaPkOWPiueahOWKn+iDvQ0KLSDnibnliKvor7TmmI7vvJrlop7liqDoh7TosKLlkI3ljZXvvIzmhJ/osKLlr7lPcGVuQXJr55qE5pSv5oyB77yBDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCi0gSW1wb3ZlZCBwcm9jZXNzIG1hbmFnZXI6IEFkZGVkIG1lbW9yeSB1c2FnZSwgUEVCLCBURUIsIENhbGxTdGFjaywgVGVybWluYXRlIFRocmVhZCBldGMuDQotIEltcG92ZWQga2VybmVsIG1hbmFnZXI6IEFkZGVkIG1lbW9yeSBzZWFyY2gsIFVubG9hZGVkIGRyaXZlcnMsIElGRU8sIExvYWQgc3ltYm9scyBldGMuDQotIEltcHJvdmVkIHNjYW5uZXI6IEltcHJvdmVkIHBlIHNjYW5uZXIsIEFkZGVkIHNjYW5uZXIgZm9yIE1lbW9yeSBQRS4NCi0gRml4ZWQgc29tZSBmYWlsdXJlIGNhc2Ugd2hlbiBlbnRlciBrZXJuZWwgbW9kZS4NCi0gQnVnZml4ZWQgYW5kIG1hbnkgb3RoZXIgdW5tZW50aW9uZWQgZmVhdHVyZXMuDQotIFNwZWNpYWwgTm90ZXM6IEFkZGVkIGFja25vd2xlZGdlbWVudHMsIHRoYW5rcyBmb3IgeW91ciBzdXBwb3J0IQ==", "appurl": "https://github.com/BlackINT3/OpenArk/releases" }

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\MicrosoftDoSvc err:c000036b [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c000036b [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\ci.pdb\033732D9C39AF46519110F2B77C3BBD11\ci.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\8A9F0CDF53D0D5FCAB0B82FBBAC5E8C71\fltMgr.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\netio.pdb\149A3770E7FF9C7AF218BB81195ECF411\netio.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\08528225F22C525A3FB5A1D6ED93124E1\ntkrnlmp.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\win32k.pdb\24D011674A9D6A812F17F71D2DCD22BA1\win32k.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\win32kbase.pdb\37EA45820E775FEA56DF549A6F7B68811\win32kbase.pdb [Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\HUAWEI\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\EB4E45D4ADCA609254FFA632B8566D421\win32kfull.pdb [Kernel::onEnterKernelMode] [INFO] InstallDriver 1. [Kernel::onEnterKernelMode] [INFO] InstallDriver 2. [Kernel::onEnterKernelMode] [ERR] InstallDriver C:\Users\HUAWEI\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err

BlackINT3 commented 1 month ago

Kernel driver not compatible with ARM arch as far.