KANKOSHEV / NoScreen

Hiding the window from screenshots using the function win32kfull::GreProtectSpriteContent
501 stars 175 forks source link

windows11 bsod ,how should i fix? #4

Open ice-seal opened 2 years ago

ice-seal commented 2 years ago

windows11 bsod ,how should i fix?

hexappp commented 2 years ago

Change signatures and structs or tell me your winver maybe I can look at it in my free time.

ice-seal commented 2 years ago

Change signatures and structs or tell me your winver maybe I can look at it in my free time.

Version Windows 11 Pro Version 21H2 Installation Date ‎2022/‎6/‎27 OS version 22000.778 Experience Windows Feature Experience Pack 1000.22000.778.0

Thanks, I think the win11 structure has changed, but I won't fix it

hexappp commented 2 years ago

I looked at the structs, it seems ok. Can you send me a copy of win32kfull.sys and win32kbase.sys they are in %SystemRoot%\System32

ice-seal commented 2 years ago

I looked at the structs, it seems ok. Can you send me a copy of win32kfull.sys and win32kbase.sys they are in %SystemRoot%\System32 I put them in the repository https://github.com/icebound97/System32

hexappp commented 2 years ago

I checked the signature, it's okay, can you upload the dump you got bsod, if the dump doesn't exist, run it again and get bsod

ice-seal commented 2 years ago

I checked the signature, it's okay, can you upload the dump you got bsod, if the dump doesn't exist, run it again and get bsod 070922-13875-01.zip

hexappp commented 2 years ago

Mate, I think the problem is probably in usermode or communication. Did you tried Proof of Concept?

ice-seal commented 2 years ago

Mate, I think the problem is probably in usermode or communication. Did you tried Proof of Concept?

struct tag_wnd { char pad_0[0x10]; tag_thread_info* thread_info; };

According to my analysis, the structure here has changed

hexappp commented 2 years ago

Are you mapping the driver or starting as a service? If you are running it as a service, you need to attach it to process. https://www.unknowncheats.me/forum/c-and-c-/344693-rtlfindexportedroutinebyname-causes-bsod.html

ice-seal commented 2 years ago

Are you mapping the driver or starting as a service? If you are running it as a service, you need to attach it to process. https://www.unknowncheats.me/forum/c-and-c-/344693-rtlfindexportedroutinebyname-causes-bsod.html

I don't quite understand what you mean, I am from the repository below, https://github.com/FiYHer/kernel_window_hide should have a session attached to it, I can use it on win10, but it will cause a blue screen on win11

hexappp commented 2 years ago

load driver with this mapper https://github.com/hfiref0x/KDU

ice-seal commented 2 years ago

load driver with this mapper https://github.com/hfiref0x/KDU

kdu -map C:\Users\Administrator\Desktop\kernel.sys

Same, on windows11 I got bsod 071022-13656-01.zip