How is the acceptance (Anti Cheat/Anti Virus) of the self build lib?

[Falcosc]

We use the prebuild lib from https://openlibsys.org/manual/HowToUse.html because it is excluded from anti cheat and anti virus software.

How does your build of this lib behave?

We think about a build with _PHYSICAL_MEMORY_SUPPORT because we need to access a small part of the physical memory to access the Power Metric table of AMD CPUs (it gets copy to a physical memory address)

Currently, we use https://www.highrez.co.uk/downloads/inpout32/default.htm for physical memory access as workaround. People who have problems with anti cheat software can just use winring0 from https://openlibsys.org without physical memory access for basic functionality.

[GermanAizek]

@Falcosc, Hi, thx for feedback. You will not receive a certificate from openlibsys. You can self-certify your software for money in GlobalSign (more info about EV cert: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing) or sign with your self-described software, but Windows can prohibite installation and actions with winring0

[Falcosc]

Ok, that would make the situation worse. Because I remember, you need to boot into the unsigned driver mode to install these things. Thank you for the information.

Do you know already signed drivers which expose an interface for physical memory access? inpout32 isn't so great because it exposes the whole memory (not only the first reserved part for hardware related stuff). Because of the full exposure of all memory, inpout32 is blocked by many security applications.

[GermanAizek]

@Falcosc, I don't recommend anything, now driver certification is mandatory due to the large number of viruses using kernel mode.

[Falcosc]

@GermanAizek why did you spend all the effort of preparing a working build based on the WinRing0 sources if the already certified drivers from openlibsys.org are ready to use?

[GermanAizek]

@Falcosc, The project has only a code refactor that fixes vulnerabilities and errors for use in personal projects. My version of WinRing0 can be used in Monero Xmrig to increase the hashrate with AMD Ryzen and EPYC processors, provided that you can configure certificates and run the driver without problems. I only work on refining and optimizing the code.

[GermanAizek]

@Falcosc, So far, the difference is very minimal, but I do not do much about this project.

[Falcosc]

That make senses. I am working on ryzenAdj, power metric table got recently integrated which lead into a lot of unexpected research into the direction of Windows drivers.

I am happy with my selection of the inpout32 driver, it works great. Unfortunately, some people have trouble with it because this thing is used by some cheat software because of the unrestricted memory access :(

I noticed the availability of the physical memory build flag in the winring0 project during the search of a usable driver. After reading about the certification process, it made sense why this support was built as an optional build feature and not part of the certified driver.

Someone had trouble with the OLS_DLL_DRIVER_NOT_LOADED error state. I did look if I could find more details about how the driver load does work and if there are any hidden ways to check which preconditions need to meet. During this search, I found your repo.

[GermanAizek]

@Falcosc, You found that in the code, right? https://github.com/GermanAizek/WinRing0/blob/1021cfc3de83712183b3475a95ad3c63a004930f/WinRing0Dll/OlsDll.cpp#L175 and https://github.com/GermanAizek/WinRing0/blob/1021cfc3de83712183b3475a95ad3c63a004930f/WinRing0Dll/OlsDll.cpp#L182

[Falcosc]

Yes, but we don't know what exactly did prevent the driver from loading.

[GermanAizek]

@Falcosc, Past developers did not think about building a debugging dll and sys, and if you build sources certificate loses relevance, but you can build with a self-signed certificate and debugging output, solve the problem and run old build with the certificate from opensyslib.