search

Idov31 / Nidhogg

Nidhogg is an all-in-one simple to use windows kernel rootkit.
https://idov31.github.io/posts/lord-of-the-ring0-p1
GNU General Public License v3.0
1.8k stars 267 forks source link

PatchGuard causes BSOD #5

Closed scareing closed 2 years ago

scareing commented 2 years ago

我想我已修复它，如果您仍然遇到 BSOD，请重新打开此问题 :)。

WIN10 Microsoft Windows [version 10.0.18363.418]

When I use PChunter to detect its stealth effect，The system immediately blue screen

image

Originally posted by @scareing in https://github.com/Idov31/Nidhogg/issues/3#issuecomment-1148919201

Idov31 commented 2 years ago

Hi, Thank you for opening the issue, I'll look into it.

C4n3xp commented 2 years ago

RemoveProcessLinks can not bypass PatchGuard

Idov31 commented 2 years ago

As @C4n3xp said, Nidhogg is not (at least not yet) designed to bypass PatchGuard. Since Nidhogg is an unsigned driver, PatchGuard won't allow it to register the process and file routines and can cause KERNEL_SECURITY_CHECK_FAILURE on call. To test and load the driver without getting BSOD from PatchGuard you need to either follow the instructions I mentioned to setup & test the driver or use a known PatchGuard bypass.

scareing commented 2 years ago

No, no, no, I used the leaked NVIDIA signature The case of BSOD still exists

Idov31 commented 2 years ago

I've rechecked and verified that having a signature has nothing to do with the BSOD.

As @C4n3xp said before, PatchGuard does not allow kernel structures modification, when using the HideProcess functionality it modifies the linked list and PatchGuard identify it and causing BSOD.

You can use projects to bypass / disable PatchGuard (for example: EfiGuard or Shark ).