search

hfiref0x / KDU

Kernel Driver Utility
MIT License
1.97k stars 422 forks source link

Critical Structure Corruption BSOD #26

Closed nekohan69 closed 2 years ago

nekohan69 commented 2 years ago

I have some question,

  1. Do I need to run '-dse 0' after using '-dse 6'?
  2. Does CRITICAL_STRUCTURE_CORRUPTION BSOD have todo with KDU?
  3. Do I have to do anything after using KDU, like revert back something?

I dont know how or why my pc just got BSOD sometime even after I restarted my pc, happens after i use '-dse 6' and '-map driver.sys' on kdu.

hfiref0x commented 2 years ago

https://github.com/hfiref0x/KDU#disclaimer

This tool assumes you know what you do. Your BSOD is caused by your actions, it has nothing to do with KDU. You decided to corrupt kernel data - here is it, you corrupted it. Changing code integrity options is not a Patchguard friendly. And I don't know what is this "driver.sys", what it does and why you load it.

You don't need to disable DSE to map drivers. This doesn't make any sense. Turning off and then mapping drivers is a compeletely unrelated to each other, -map command doesn't rely on Windows loader thus it doesn't trigger code integrity checks anyhow (except you somehow ruined everything by compiling driver with conflicting settings).

Additionally your command sequence

-dse 6 -map driver.sys

doesn't make any sense. First command actually turns ON code integrity checks, because it includes code integrity option enable flag and then you run map command which doesn't rely on Windows code integrity at all.

If you want to load your "driverless" driver (specially designed to be compatible with in memory mapping) then just use -map command.

If you want to load your "normal" driver (which doesn't have valid digital signature) then turn off DSE with -dse 0 command, load your driver normally through API or SCM, and then restore your dse state with -dse original_CI_state_value command. Where original_CI_state_value is what CI state was before you nullified it. It maybe 6 but can be everything else, depending on what your system configuration is.

When you use -dse command it prints you on a screen previous value (except when -dse command used with CheatEngine provider, it doesn't prints previous value) before writing new thus if you want to restore original value you need to use exactly this value.

[+] DSE flags (0xFFFFF80180E393B8) value: 6, new value to be written: 0, use 6 to restore [+] DSE flags (0xFFFFF80180E393B8) value: 1, new value to be written: 0, use 1 to restore, etc

nekohan69 commented 2 years ago

So I just need to run -dse 0 or -dse original_CI_state_value? but how do I check my "original_CI_state_value"?

hfiref0x commented 2 years ago

When you use -dse command it prints you on a screen previous value (except when -dse command used with CheatEngine provider, it doesn't prints previous value) before writing new thus if you want to restore original value you need to use exactly this value.

nekohan69 commented 2 years ago

just figured it out thanks!