Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Win11_23H2 and Win11_24H2 #526

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

puRe1337
Copy link

Patterns are from 10th October 2024.
Tested on both versions 23H2 (22631.4249) and 24H2 (26000.2033).

Kind regards
Dominik

@wh0se-max
Copy link

Doesn't seems to be working on TLS/VEH .dlls, it does map but the entry is not init.
You can reproduce that by using VMProtect

@puRe1337
Copy link
Author

Doesn't seems to be working on TLS/VEH .dlls, it does map but the entry is not init. You can reproduce that by using VMProtect

Works fine for me using a VMProtected dll. Maybe you can compile Blackbone without BLACKBONE_NO_TRACE and attach a debugger to your process to watch the Debug Messages.

image

@wh0se-max
Copy link

Doesn't seems to be working on TLS/VEH .dlls, it does map but the entry is not init. You can reproduce that by using VMProtect

Works fine for me using a VMProtected dll. Maybe you can compile Blackbone without BLACKBONE_NO_TRACE and attach a debugger to your process to watch the Debug Messages.

image

According to your screenshot you are mapping with 0x5044, that would result in NoExceptions, NoTLS, WipeHeader, RebaseProcess, does that work with VMProtect memory & import protection? From what I am aware, these along with the VM would use TLS and VEH

@puRe1337
Copy link
Author

puRe1337 commented Oct 24, 2024

image
image
Still works fine using blackbone::eLoadFlags::NoFlags for me.

What exactly are you doing? x86 or x64? Runnings the Samples works fine for me using x86. When I have time, I'll look up the problem with x64. There might be a problem.
I think _RTL_INVERTED_FUNCTION_TABLE might have changed.
Patterns should be correct. It would be nice if someone could confirm this.

@Heitzz
Copy link

Heitzz commented Oct 31, 2024

I confirm the issue with x64.
Windows 11 24H2, build 26100.1

PatternData: LdrpInvertedFunctionTable64 not found
Both patterns for this function are not found on Win 23H2 and 24H2

@puRe1337
Copy link
Author

I confirm the issue with x64. Windows 11 24H2, build 26100.1

PatternData: LdrpInvertedFunctionTable64 not found Both patterns for this function are not found on Win 23H2 and 24H2

Pushed a new signature. It does not print the message anymore, but can you confirm again it works for you?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants