hfiref0x/KDU

Windows 24H2 CI.DLL!g_CiOptions search pattern is broken

Whothatmofo opened this issue · 10 comments

Whothatmofo commented

can't seem to get it to work properly with windows 24h2 and cant load drivers.

hfiref0x commented

Very informative. Show kdu -diag.

hfiref0x commented

It cannot find internal CI.DLL variable. Attach your CI.DLL somewhere and post a link to it.

Whothatmofo commented

ci.dll from system32, correct

hfiref0x commented

Your link gives "Access denied".

Whothatmofo commented

try it now, sorry hfire

hfiref0x commented

Open dsefix.cpp and replace KDUpCheckInstructionBlock with

ULONG KDUpCheckInstructionBlock(
    _In_ PBYTE Code,
    _In_ ULONG Offset
)
{
    ULONG offset = Offset;
    hde64s hs;

    RtlSecureZeroMemory(&hs, sizeof(hs));

    hde64_disasm(&Code[offset], &hs);
    if ((hs.flags & F_ERROR) || (hs.len != 3)) {
        return 0;
    }

    //
    // mov     r9, rbx
    //
    if (Code[offset] != 0x4C ||
        Code[offset + 1] != 0x8B)
    {
        return 0;
    }

    offset += hs.len;

    hde64_disasm(&Code[offset], &hs);
    if ((hs.flags & F_ERROR) || (hs.len != 3)) {
        return 0;
    }

    //
    // mov     r8, rdi 
    // 
    // or 
    //
    // mov     r8d, edi
    //
    if (Code[offset] != 0x4C && 
        Code[offset] != 0x44 &&
        Code[offset + 1] != 0x8B)
    {
        return 0;
    }

    offset += hs.len;

    hde64_disasm(&Code[offset], &hs);
    if (hs.flags & F_ERROR)
        return 0;

    if (hs.len == 3) {

        //
        // mov     rdx, rsi
        //
        if (Code[offset] != 0x48 ||
            Code[offset + 1] != 0x8B)
        {
            return 0;
        }
    }
    else if (hs.len == 5)
    {
        //
        // mov[rsp + 38h + 28h], rax
        //
        if (Code[offset] != 0x48 ||
            Code[offset + 1] != 0x89)
        {
            return 0;
        }

        offset += hs.len;
        hde64_disasm(&Code[offset], &hs);
        if (hs.flags & F_ERROR || hs.len != 3) {
            return 0;
        }
        //
        // mov     rdx, rsi
        //
        if (Code[offset] != 0x48 ||
            Code[offset + 1] != 0x8B)
        {
            return 0;
        }
    }
    else {
        return 0;
    }

    offset += hs.len;

    hde64_disasm(&Code[offset], &hs);
    if ((hs.flags & F_ERROR) || (hs.len != 2)) {
        return 0;
    }

    //
    // mov     ecx, ebp
    //
    if (Code[offset] != 0x8B ||
        Code[offset + 1] != 0xCD)
    {
        return 0;
    }

    return offset + hs.len;
}

Tell me if it works.
edit: fixed code tags

Whothatmofo commented

will update you soon as i can

Whothatmofo commented

working perfect hfire. ty!