search

BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.
https://openark.blackint3.com
GNU Lesser General Public License v2.1
9.17k stars 888 forks source link

無法進入內核模式 #25

Closed lordforce closed 2 years ago

lordforce commented 4 years ago

點擊[進入內核模式]，無效。 image

BlackINT3 commented 4 years ago

@lordcommander001 點擊左下角的按鈕，进入控制臺，把錯誤日誌貼上來。

alexjinchina commented 3 years ago

@lordcommander001 點擊左下角的按鈕，进入控制臺，把錯誤日誌貼上來。

我这里的情况是没有相应

manning120008 commented 3 years ago

[UNONE::FsReadFileDataW] [WARN] C:\Users\Leee\AppData\Roaming\OpenArk\console\history.txt is empty file [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://222.210.144.84:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0} [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000428 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\Leee\AppData\Local\Temp\OpenArkDrv64.sys err [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000428 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\Leee\AppData\Local\Temp\OpenArkDrv64.sys err

hexadecimal233 commented 3 years ago

看了一下错误代码，是签名验证不过，64位系统有限制，你驱动是自己编译的吧，你要签名一下或者开testsigning模式

CrazyLeoJay commented 3 years ago

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：


[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
BlackINT3 commented 3 years ago

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

用最新的版本试试。 若还报错，检查HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OpenArkDrv64注册表键值是否被禁止。

LipsonX commented 3 years ago

我的也有错误，具体日志是：

[UNONE::FsReadFileDataW] [WARN] C:\Users\Lipson\AppData\Roaming\OpenArk\console\history.txt is empty file [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 [OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt [OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://125.71.120.71:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0} [OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.

1099255210 commented 3 years ago

同样的问题： [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c000009a [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\10992\AppData\Local\Temp\OpenArkDrv64.sys err

Nero-Li commented 3 years ago

同样的系统版本,2019LTSC,amd的cpu就报这个错,iu就没问题,是不支持AMD吗

lz347396004 commented 3 years ago

试了所有能想到的办法 bios也更新到最新版了 还是无法进入

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.0.8, build:202009041346 [OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\ZZZX\AppData\Local\Temp\OpenArkDrv64.sys err

fish862003 commented 3 years ago

跟上面同样的错误，有什么办法解决么

lawrenceching commented 3 years ago

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

用最新的版本试试。 若还报错，检查HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OpenArkDrv64注册表键值是否被禁止。

同样的问题，检查过注册表发现并没有这个键值。可否再提供些建议。谢谢。

OpenArk Console
Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk
[UNONE::FsReadFileDataW] [WARN] C:\Users\***\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://221.237.29.124:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0} 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741772 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err

image

系统：Windows10 专业版 20H2 19042.1165

GavinKing1995 commented 3 years ago

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

用最新的版本试试。 若还报错，检查HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OpenArkDrv64注册表键值是否被禁止。

同样的问题，检查过注册表发现并没有这个键值。可否再提供些建议。谢谢。

OpenArk Console
Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk
[UNONE::FsReadFileDataW] [WARN] C:\Users\***\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://221.237.29.124:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0} 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741772 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err

image

系统：Windows10 专业版 20H2 19042.1165

遇到了同样的问题[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 Win10企业版 21H1 19043.1165

mikasaol commented 3 years ago

签名的证书被吊销了

autLory commented 3 years ago

[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\lx\AppData\Local\Temp\OpenArkDrv64.sys err [UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\lx\AppData\Local\Temp\OpenArkDrv64.sys err 我也遇到这个问题，进不去内核模式

Rascalpirate commented 3 years ago

[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603 [Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\WTT\AppData\Local\Temp\OpenArkDrv64.sys err 同是注册表内没有OpenArkDrv64，系统：Windows 10 版本号 20H2 操作系统内部版本 19042.1165

andronoob commented 3 years ago

58

BlackINT3 commented 2 years ago

v1.2.0 fixed.

owen118z commented 1 year ago

1.2.2 也是这个问题