BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.
https://openark.blackint3.com
GNU Lesser General Public License v2.1
8.29k stars 835 forks source link

WIN11 进入内核模式 无反应 #182

Open henry14arsenal opened 1 month ago

henry14arsenal commented 1 month ago

OpenArk Console Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk [UNONE::FsReadFileDataW] [WARN] C:\Users\Jimmy\AppData\Roaming\OpenArk\console\history.txt is empty file [UNONE::PsGetProcessInfo64W] [ERR] VirtualOpenProcess pid:4 err:0 [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:5 [ArkDrvApi::Process::OpenProcessRoot] [ERR] OpenProcess by Kernel pid:4 err:0 [Kernel::InitKernelEntryView::::operator ()] [INFO] 操作系统 : Windows 11 [Kernel::InitKernelEntryView::::operator ()] [INFO] 主版本号 : 10 [Kernel::InitKernelEntryView::::operator ()] [INFO] 副版本号 : 0 [Kernel::InitKernelEntryView::::operator ()] [INFO] 发行编号 : 23H2 [Kernel::InitKernelEntryView::::operator ()] [INFO] 编译号 : 22631 [Kernel::InitKernelEntryView::::operator ()] [INFO] 主服务包 : 0 [Kernel::InitKernelEntryView::::operator ()] [INFO] 副服务包 : 0 [Kernel::InitKernelEntryView::::operator ()] [INFO] R3地址空间 : 0x10000 - 0x7FFFFFFEFFFF [Kernel::InitKernelEntryView::::operator ()] [INFO] R0地址空间 : 0xFFFF080000000000 - 0xFFFFFFFFFFFFFFFF [Kernel::InitKernelEntryView::::operator ()] [INFO] 页面大小 : 4 KB [Kernel::InitKernelEntryView::::operator ()] [INFO] 物理内存 : 32 GB [Kernel::InitKernelEntryView::::operator ()] [INFO] CPU核数 : 22 [Kernel::InitKernelEntryView::::operator ()] [INFO] 系统根目录 : C:\Windows [Kernel::InitKernelEntryView::::operator ()] [INFO] 启动时间 : 2024-05-28 09:09:30 (0Day/8Hour/10Min) [Kernel::InitKernelEntryView::::operator ()] [INFO] BootInfo : UEFI & SecureBoot & VBS [Kernel::InitKernelEntryView::::operator ()] [INFO] HVM : VT Disabled [OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.6, build:202405222254 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{ "err": 0, "appver": "1.3.6", "appbd": "202405222254", "appcl": "LSDov5vlhoXmoLjmqKHlvI/mlK/mjIHnprvnur/njq/looMo5peg572R57uc5oOF5Ya1KQotIOWGheaguOWinuW8uu+8muaUr+aMgU5QRlMvTWFpbFNsb3QvTVVQ6L+H5ruk6amx5Yqo5p6a5Li+562JCi0g55WM6Z2i5LyY5YyW77ya5paw5aKe57mB5L2T5Lit5paH6K+t6KiA44CB5ZCv5Yqo6aG55pSv5oyB5aSa6YCJ5Yig6Zmk562JCi0gQlVH5L+u5aSN77yM5paw5aKe5LiA5Lqb5bel5YW3Ci0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQotIEVudGVyIGtlcm5lbCBtb2RlIHdvcmtzIGluIGFuIG9mZmxpbmUgZW52aXJvbm1lbnQobmV0d29yayB1bmF2YWlsYWJsZSkuCi0gSW1wb3ZlZCBrZXJuZWwgbWFuYWdlcjogQWRkZWQgTlBGUy9NYWlsU2xvdC9NVVAgbGlzdCBldGMuCi0gSW1wcm92ZWQgVUk6IEFkZGVkIHpoLXR3IGxhbmd1YWdlLCBhbmQgY2FuIGJlIGRlbGV0ZWQgaW4gYmF0Y2hlcy4KLSBCdWdmaXhlZCBhbmQgYWRkZWQgc29tZSB0b29scy4=", "appurl": "https://github.com/BlackINT3/OpenArk/releases" }

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [UNONE::ObUnloadDriverW] [ERR] NtUnloadDriver service:\Registry\Machine\System\CurrentControlSet\Services\RTCore64 err:c0000034 [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000428 [Kernel::onEnterKernelMode] [INFO] InstallDriver 1. [Kernel::onEnterKernelMode] [INFO] InstallDriver 2. [Kernel::onEnterKernelMode] [ERR] InstallDriver C:\Users\Jimmy\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err