search

ufrisk / MemProcFS

MemProcFS
GNU Affero General Public License v3.0
3.16k stars 383 forks source link

Missing WIN_VERSION_REVISION? #342

Closed Frostchi closed 3 days ago

Frostchi commented 3 days ago

https://github.com/ufrisk/MemProcFS/blob/fddcad73f76c10eeb660d3095edaf47a13b995bf/vmm/vmmdll.h#L219

Any reason the revision is missing? EX 19045 (win10 22h2) from 10.0.19045.x

MAJOR.MINOR.REVISION.BUILD

This is probably the most relevant windows version bit, but it's oddly missing.

ufrisk commented 3 days ago

It's not implemented.

On my Win10 system the cmd shows up as: "Version 10.0.19045.5131"

But ntoskrnl.exe still identify as: "10.0.19041.5129"

I get almost all values from the kernel very early on, are you saying you want to know if the kernel revision is 5129 or do you want something else?

And if you do, which value would you prefer that I rely on? Currently everything in MemProcFS is pretty much based off the kernel (which still identifies as 19041 at least on my system).

Frostchi commented 3 days ago

It's not implemented.

On my Win10 system the cmd shows up as: "Version 10.0.19045.5131"

But ntoskrnl.exe still identify as: "10.0.19041.5129"

I get almost all values from the kernel very early on, are you saying you want to know if the kernel revision is 5129 or do you want something else?

And if you do, which value would you prefer that I rely on? Currently everything in MemProcFS is pretty much based off the kernel (which still identifies as 19041 at least on my system).

Ah nevermind, I was getting my numbers backwards. It looks like BUILD is returning the proper windows version information.

Although, oddly it's returning 22621 when my Target PC is 22631.... So not sure what's up there.

Referring to the build versions in: https://en.wikipedia.org/wiki/Windows_11_version_history

ufrisk commented 3 days ago

Your ntoskrnl.exe is probably 22621 (if you right click details on it)

Frostchi commented 3 days ago

OK, thanks!