search

ZeroMemoryEx / Chaos-Rootkit

Now You See Me, Now You Don't
742 stars 116 forks source link

Unable to connect to rootkit INVALID_HANDLE_VALUE #20

Closed ozohhub closed 4 days ago

ozohhub commented 1 week ago

I disabled DSE and even tried on test mode but can't load the driver. How can i fix this? @ZeroMemoryEx

ZeroMemoryEx commented 1 week ago

Hello @ozohhub ,the rootkit currently works only when DSE is disabled, You can disable DSE by opening cmd as an administrator and running the following command:

bcdedit /set testsigning on

Waiting for your feedback and happy hacking!

ozohhub commented 1 week ago

I tried testsigning on but still can’t load the driver. Is there a specific way to load the driver? (Like command: sc create asdf) I also tried installing the driver with the inf file from this repo but didn’t work. @ZeroMemoryEx

ZeroMemoryEx commented 1 week ago

@ozohhub Did you place the driver chaos-rootkit.sys in the same directory as rin3-gui.exe? Also, can you run DbgView, then run the rootkit and send a screenshot of the output in DbgView?

ZeroMemoryEx commented 1 week ago

also you should run the ring3-gui.exe as an administrator @ozohhub