search

JKornev / hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc
1.76k stars 481 forks source link

Unable to start service on Windows 10 x64 #22

Closed Pernat1y closed 4 years ago

Pernat1y commented 4 years ago

I have build solution with Visual Studio 2019 with WDK 10.0.18362.0 (Win32 Release) on Windows 10 x64 1909. Driver installed successfully, but I am unable to start service:

>bcdedit /set TESTSIGNING ON
The operation completed successfully.

>bcdedit /enum
[...]
testsigning             Yes
[...]

>sc start hidden
[SC] StartService FAILED 1275:

This driver has been blocked from loading

>sc query hidden

SERVICE_NAME: hidden
        TYPE               : 2  FILE_SYSTEM_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1275  (0x4fb)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
ABD-FH commented 4 years ago

yes i am like you what is the problem i apear with me just when 64bit win 8 , win 10 ,win 7

and when i run 32 bit it is work fine ,can you test on 32 bit

but the question is why do not work with 64 bit ?

Pernat1y commented 4 years ago

If it helps:

Driver C:\Hidden.sys installed!
ZwLoadDriver() returned C000036B 
Failed to load C:\Hidden.sys

Basically, the same error:

0xC000036B   STATUS_DRIVER_BLOCKED_CRITICAL | Driver %2 has been blocked from loading.

Sadly, I don't have 32 bit OS to test and building x64 Release fails: https://pastebin.com/raw/zxrsPJ1C

ABD-FH commented 4 years ago

exactly even programmatically is not working , anyone help us please

JKornev commented 4 years ago

Hi,

Just to clarify, after enabling TESTSIGNING did you reboot a system?

Regards, Nikita K.

Pernat1y commented 4 years ago

Yes, I have tried both with and without reboot.

JKornev commented 4 years ago

@Pernat1y please share the driver binary

Pernat1y commented 4 years ago

Hi. Attached. Hidden.zip

ABD-FH commented 4 years ago

yes and I also I tried to "Disable driver signature enforcement" from advance options but still problem not solve all of then occurred when running on 64bit system on 32 bit is running fine.

JKornev commented 4 years ago

Hi,

I tested a driver you sent me and the driver is 32-bit one. If try to load 32-bit driver on a 64-bit machine of course you will get an error 1275 or status C000036B. A driver bitness should be equal to system bitness.

Please try to compile 64-bit driver and recheck it on 64-bit machine.

If you still have an issue with loading please create a new issue and I'll help

Regards, JK