search

NSG650 / NtDOOM

Doom running in the NT kernel
161 stars 11 forks source link

Improve Win32k process/thread attaching #2

Closed Mattiwatti closed 1 year ago

Mattiwatti commented 1 year ago

This is a great game, but unfortunately I was seeing quite a few bugchecks when trying to play this, even on Windows 11 22621. Most of these were due to attempts to access a nonexistent/bogus Win32 thread in NtUserGetKeyState.

This PR attempts to fix some of the "early access experience" in two parts, by:

  1. Rewriting the problematic GetThreadByProcessName and SpoofWin32Thread functions using NT APIs instead.
  2. Moving the game loop from DriverEntry to an APC routine which is queued to the target thread.
NSG650 commented 1 year ago

Hello! Thank you so much for your contribution! I have tested your changes but keyboard inputs don't seem to work. It might be a me issue but please try it from your end as well. Thank you

Mattiwatti commented 1 year ago

This is interesting. Keyboard input is definitely working here, I tested this quite a few times before creating the PR.

I pushed a change that makes the thread found by OpenSessionProcessThread the same as the one GetThreadByProcessName would have found, but since I cannot reproduce this issue here I don't know if it will make a difference.

If the change did not help: are you using a VM or running on bare metal? And can you post a stacktrace (kb) of the explorer.exe thread Win32kThreadApcRoutine is running in? Then I can see if it's possible for me to find a similar thread to reproduce this.

Another thing you may try is changing the APC to a kernel APC (change UserMode to KernelMode in the parameters to KeInitializeApc) - but this is what I originally tried and this caused keyboard input to fail after initially working for some time.

NSG650 commented 1 year ago

Hi!

Your new changes now works on my end! I am now able to play the game!

Thank you so much for your contribution!