Giters

BlackINT3 / OpenArk

The Next Generation of Anti-Rookit(ARK) tool for Windows.

Home Page:https://openark.blackint3.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

can not Enter KernelMode

TideHunterGo opened this issue · comments

commented

OpenArk Console
Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk
[UNONE::FsReadFileDataW] [WARN] C:\Users\YDuOfficeD\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{
"err": 0,
"appver": "1.3.0",
"appbd": "202302271420",
"appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=",
"appurl": "https://github.com/BlackINT3/OpenArk/releases"
}

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\YDuOfficeD\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\C94B4FEEB68C247F8AA26BF5B75B95061\fltMgr.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\YDuOfficeD\AppData\Roaming\OpenArk\symbols\netio.pdb\ED433384CCF68CA28CFC2A6B824BD5361\netio.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\YDuOfficeD\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\C5C7712FC62F7EBC581841883742D71C1\ntkrnlmp.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\YDuOfficeD\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\AF9F01468F625DE8F9DEF882E814C2E91\win32kfull.pdb
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\YDuOfficeD\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err

commented

好多人都有这个问题，看作者提交记录，好久没有上线的样子

commented

这是我的哈，楼主优先

OpenArk Console
Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk
[UNONE::FsReadFileDataW] [WARN] C:\Users\wmr\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{
"err": 0,
"appver": "1.3.0",
"appbd": "202302271420",
"appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=",
"appurl": "https://github.com/BlackINT3/OpenArk/releases"
}

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\40A84F07DA2975D6677E3C3512E5D1FA1\fltMgr.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\netio.pdb\9EE7BD721D3DEF087E3DBC8DD61C95411\netio.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\A86510E04C620A65E38FD604A54931A81\ntkrnlmp.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\83513BAE091978E237A6C04EA803BFE51\win32kfull.pdb
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\wmr\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\40A84F07DA2975D6677E3C3512E5D1FA1\fltMgr.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\netio.pdb\9EE7BD721D3DEF087E3DBC8DD61C95411\netio.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\A86510E04C620A65E38FD604A54931A81\ntkrnlmp.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\83513BAE091978E237A6C04EA803BFE51\win32kfull.pdb
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\wmr\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\fltMgr.pdb\40A84F07DA2975D6677E3C3512E5D1FA1\fltMgr.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\netio.pdb\9EE7BD721D3DEF087E3DBC8DD61C95411\netio.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\ntkrnlmp.pdb\A86510E04C620A65E38FD604A54931A81\ntkrnlmp.pdb
[Kernel::ParseKernelSymbol] [INFO] PDB: C:\Users\wmr\AppData\Roaming\OpenArk\symbols\win32kfull.pdb\83513BAE091978E237A6C04EA803BFE51\win32kfull.pdb
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\wmr\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err

commented

v1.3.2 released.