search

ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.72k stars 706 forks source link

wx64_unlock command is BSOD my Windows 10 NTLMShared version 10.0.19041.1 #229

Closed dummys closed 1 year ago

dummys commented 1 year ago

Hi, The kmdload is working and the command to get a shell too. I'm trying to unlock the windows logon.

KMD: Code inserted into the kernel - Waiting to receive execution.
KMD: Execution received - continuing ...
KMD: Successfully loaded at address: 0x7ffff000

pcileech.exe wx64_unlock -kmd 0x7ffff000 -0 1

EXEC: Failed sending execute command to KMD.

Then BSOD. If I check the version of NTLMShared it is the version 10.0.19041.1 which when I check inside the wx64_unlock.c is supported. How I can debug it ?

I also tried to run the patch with unlock:

pcileech.exe patch -sig unlock_win10x64 -all

 Current Action: Patching
 Access Mode:    Normal
 Progress:       9440 / 9440 (100%)
 Speed:          124 MB/s
 Address:        0x000000024E000000
 Pages read:     2049215 / 2416640 (84%)
 Pages failed:   367425 (15%)
Patch: Successful. Location: 0x11e6b6435

Not working too.

dummys commented 1 year ago

I checked inside the ntlmshared.dll and the signature you have in the wx64_unlock.c is matching. I will try to break on the function when I inject the shellcode to see

dummys commented 1 year ago

Oh and I can't find shellcode64.exe where this file come from ? EDIT: Nevermind, found it in your repo: https://github.com/ufrisk/shellcode64 you should put the url in the documentation

ufrisk commented 1 year ago

Apologies for the late answer. I believe this signature may not be fully up to date with the most recent security patches.

I'll look into it and hopefully update it in the weekend.

It shouldn't bluescreen though, so I don't know what's going on there.

dummys commented 1 year ago

@ufrisk are you on discord/irc something ? Then we can try debug together ? I have kernel debugging in place

ufrisk commented 1 year ago

I've updated the signatures now, I couldn't find the ntlmshared.dll version you had though so it may not work.

Please let me know how it goes. And my Discord is: UlfFrisk#5780 it may be easier than doing the twitter messages...

dummys commented 1 year ago

thanks a lot for your help and the issue was because of VT-D IO enabled in the bios.