search

btbd / umap

UEFI bootkit for driver manual mapping
523 stars 98 forks source link

sig update for Windows 11 #17

Open anotherfinemess84 opened 1 year ago

anotherfinemess84 commented 1 year ago

hi seems that on windows 11 some sig must be wrong as it does not reach success and just bails into windows. thankyou.

0x00Alchemist commented 1 year ago

hi seems that on windows 11 some sig must be wrong as it does not reach success and just bails into windows. thankyou.

Hello! It looks like Microsoft changed something in RdpLoadImage (I'm not patch-diffing winload at the moment). At the moment, only the pattern search for BlImgAllocateImageBuffer has changed. The other things don't seem to have changed (ImgArchStartBootApplication, OslExecuteTransition and OslFwpSetupKernelPhase1) In Windows 11, the pattern is as follows: E8 ?? ?? ?? ?? 4C 8B 7D 50

изображение

hexappp commented 1 year ago

E8 ? ? ? ? 4C 8B 65 C7 in Win 10 22H2 works. Can anybody upload Win 11 winload.efi sample.

0x00Alchemist commented 1 year ago

E8 ? ? ? ? 4C 8B 65 C7 in Win 10 22H2 works. Can anybody upload Win 11 winload.efi sample.

https://anonfiles.com/7eg3H5rdz0/winload_zip

hexappp commented 1 year ago

Win 10 22H2 and Win 11 tested. E8 ? ? ? ? 8B D8 85 C0 0F 88 8E ? ? ? 21 7C 24 28