XaFF-XaFF / Cronos-Rootkit

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

kernel security check failure bluescreen

ofaruka opened this issue · comments

i am getting this blue screen whenever i load my driver.

commented

What's your Windows version?

1809

commented

@ofaruka Could you provide more information? How did you load driver? Did you disable DSE?

I have not disabled DSE. I used kdmapper to load it

commented

I have not disabled DSE. I used kdmapper to load it

Did you set custom entry point as required in kdmapper readme?

Yes, I did. I can load my own driver with kdmapper but this gives me bluescreen

commented

That's strange. I was able to load Cronos using kdmapper without any issues. I will do some tests and check if everything works properly.

commented

@ofaruka You won't be able to load Cronos into kernel using kdmapper because the DriverObject is not passed into the driver entry point. This DriverObject is required to create object in Windows devices to communicate between user mode and kernel mode. The version of Cronos that I tested a while ago was modified in such a way that it did not require this object. That Cronos version will not be published, so I apologize for the confusion.