Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Latest changes #9

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Latest changes #9

wants to merge 5 commits into from

Conversation

GeorgeK1ng
Copy link

@GeorgeK1ng GeorgeK1ng commented Sep 15, 2022 •
edited
Loading

Hi,

I have updated repository with latest changes.

v11 changes.

  1. Added Windows 7 ntoskrnl.exe v6.1.7601.25920 (win7sp1_ldr_escrow.220316-1740) exports
    x64
    EtwSetInformation
    FsRtlPrepareToReuseEcp
    FsRtlRegisterUncProviderEx2
    IoEnumerateRegisteredFiltersListEx
    IoRegisterFsRegistrationChangeMountAwareEx
    KeConnectInterruptForHal
    KeFlushCurrentTbImmediately
    PsDereferenceKernelStack
    PsReferenceKernelStack
    RtlIsSandboxedToken
    SeGetLogonSessionToken

    x86
    EtwSetInformation
    FsRtlPrepareToReuseEcp
    FsRtlRegisterUncProviderEx2
    IoEnumerateRegisteredFiltersListEx
    IoRegisterFsRegistrationChangeMountAwareEx
    KeConnectInterruptForHal
    KiMcaExceptionHandlerWrapper
    PsDereferenceKernelStack
    PsReferenceKernelStack
    RtlIsSandboxedToken
    SeGetLogonSessionToken

  2. Added Windows Vista ntoskrnl.exe v6.0.6003.21442 (vistasp2_ldr_escrow.220307-1719) exports
    x64
    FsRtlInitializeExtraCreateParameter
    FsRtlInitializeExtraCreateParameterList
    FsRtlPrepareToReuseEcp
    FsRtlRegisterUncProviderEx2
    IoRegisterFsRegistrationChangeMountAware
    KeConnectInterruptForHal
    KeFlushCurrentTbImmediately
    PsDereferenceKernelStack
    PsReferenceKernelStack
    RtlIsSandboxedToken

    x86
    FsRtlInitializeExtraCreateParameter
    FsRtlInitializeExtraCreateParameterList
    FsRtlPrepareToReuseEcp
    FsRtlRegisterUncProviderEx2
    IoRegisterFsRegistrationChangeMountAware
    KeConnectInterruptForHal
    KiMcaExceptionHandlerWrapper
    PsDereferenceKernelStack
    PsReferenceKernelStack
    RtlIsSandboxedToken

  3. Added IoSynchronousCallDriver by Mov AX, 0xDEAD, https://msfn.org/board/topic/181615-ntoskrnl-emu_extender-for-windows-xp2003/?do=findComment&comment=1221893

  4. Added blank stubs (to fix missing imports) to allow porting Windows 8.0 Build 8056 Generic SD+MMC driver run under XP - 7. Proper code needs to be added, but currently driver starts and work without issues
    PoFxRegisterDevice
    PoFxUnregisterDevice
    PoFxSetComponentLatency
    PoFxSetComponentResidency
    PoFxStartDevicePowerManagement
    PoFxCompleteIdleState
    PoFxCompleteIdleCondition
    PoFxReportDevicePoweredOn
    PoFxCompleteDevicePowerNotRequired
    PoFxActivateComponent
    PoFxIdleComponent

  5. Added changes from pappyN4 repository, https://github.com/pappyN4/NTOSKRNL_Emu
    Added RtlInitAnsiStringEx, RtlInitUnicodeStringEx. Updated Readme

v12 changes

  1. Added memcmp to be able to port AMD RCRAID driver. Source code comes from https://stackoverflow.com/questions/5017659/implementing-memcmp

  2. Added MmMapIoSpaceEx which return MmMapIoSpace, according to MS documentation it should work
    https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmmapiospaceex
    https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmmapiospace

  3. Added RtlDowncaseUnicodeChar

@GeorgeK1ng
Update ntoskrn8.c
1589363 
Added IoSynchronousCallDriver function
@GeorgeK1ng
Update ntoskrnl_redirects.h
76c2b1b 
// added missing exports according to ntoskrnl.exe v6.0.6003.21442 for Vista x32 target

bypass(FsRtlInitializeExtraCreateParameter)
bypass(FsRtlInitializeExtraCreateParameterList)
bypass(FsRtlPrepareToReuseEcp)
bypass(FsRtlRegisterUncProviderEx2)
bypass(IoRegisterFsRegistrationChangeMountAware)
bypass(KeConnectInterruptForHal)
bypass(KeFlushCurrentTbImmediately)
bypass(PsDereferenceKernelStack)
bypass(PsReferenceKernelStack)
bypass(RtlIsSandboxedToken)


// added missing exports according to ntoskrnl.exe v6.0.6003.21442  for Vista x64 target

bypass(FsRtlInitializeExtraCreateParameter)
bypass(FsRtlInitializeExtraCreateParameterList)
bypass(FsRtlPrepareToReuseEcp)
bypass(FsRtlRegisterUncProviderEx2)
bypass(IoRegisterFsRegistrationChangeMountAware)
bypass(KeConnectInterruptForHal)
bypass(KiMcaExceptionHandlerWrapper)
bypass(PsDereferenceKernelStack)
bypass(PsReferenceKernelStack)
bypass(RtlIsSandboxedToken)




// added missing exports according to ntoskrnl.exe v6.1.7601.25920 for Win7 x32 target

bypass(EtwSetInformation)
bypass(FsRtlPrepareToReuseEcp)
bypass(FsRtlRegisterUncProviderEx2)
bypass(IoEnumerateRegisteredFiltersListEx)
bypass(IoRegisterFsRegistrationChangeMountAwareEx)
bypass(KeConnectInterruptForHal)
bypass(KiMcaExceptionHandlerWrapper)
bypass(PsDereferenceKernelStack)
bypass(PsReferenceKernelStack)
bypass(RtlIsSandboxedToken)
bypass(SeGetLogonSessionToken)




// added missing exports according to ntoskrnl.exe v6.1.7601.25920 for Win7 x64 target


bypass(EtwSetInformation)
bypass(FsRtlPrepareToReuseEcp)
bypass(FsRtlRegisterUncProviderEx2)
bypass(IoEnumerateRegisteredFiltersListEx)
bypass(IoRegisterFsRegistrationChangeMountAwareEx)
bypass(KeConnectInterruptForHal)
bypass(KeFlushCurrentTbImmediately)
bypass(PsDereferenceKernelStack)
bypass(PsReferenceKernelStack)
bypass(RtlIsSandboxedToken)
bypass(SeGetLogonSessionToken)


// added new custom function IoSynchronousCallDriver for < Win8 target
k8_win8(   	IoSynchronousCallDriver,			8)
@GeorgeK1ng
Add files via upload
8a86bf9 
1) Added memcmp function
2) Merged code with latest changes in pappyN4 repository - https://github.com/pappyN4/NTOSKRNL_Emu
- Updated Readme
- Added RtlInitAnsiStringEx + RtlInitUnicodeStringEx functions
3) Changed file version to 12 (pappyN4 changes should be like v11) so this new merge is latest possible extender
@GeorgeK1ng
Add files via upload
3b62a5f
@K4sum1
Copy link

K4sum1 commented Sep 19, 2022

I noticed the redirects file has RTLDowncaseUnicodeChar, but when built for Vista, the ntoskrn8.sys doesn't have the function. I need RTLDowncaseUnicodeChar please.

@GeorgeK1ng
Copy link
Author

I noticed the redirects file has RTLDowncaseUnicodeChar, but when built for Vista, the ntoskrn8.sys doesn't have the function. I need RTLDowncaseUnicodeChar please.

This means it needs to be coded for older systems. This function is only redirected in Windows 7 from it's native kernel

@K4sum1
Copy link

K4sum1 commented Sep 20, 2022

I noticed the redirects file has RTLDowncaseUnicodeChar, but when built for Vista, the ntoskrn8.sys doesn't have the function. I need RTLDowncaseUnicodeChar please.

This means it needs to be coded for older systems. This function is only redirected in Windows 7 from it's native kernel

It exists in ntdll since XP, so it just needs to be redirected to ntoskrn8.sys.

@GeorgeK1ng
Copy link
Author

I noticed the redirects file has RTLDowncaseUnicodeChar, but when built for Vista, the ntoskrn8.sys doesn't have the function. I need RTLDowncaseUnicodeChar please.

This means it needs to be coded for older systems. This function is only redirected in Windows 7 from it's native kernel

It exists in ntdll since XP, so it just needs to be redirected to ntoskrn8.sys.

What driver exactly require that? Can you link it? I need to check it before adding proper code

@K4sum1
Copy link

K4sum1 commented Sep 26, 2022

What driver exactly require that? Can you link it? I need to check it before adding proper code

AMD GPU drivers starting with 15.12. I can get up to 15.11.x working by changing a few functions to their Vista compatible counterparts, but 15.12 adds RTLDowncaseUnicodeChar, and no matter what I do, I always get a BSOD after boot.

https://www.guru3d.com/files-details/amd-radeon-software-crimson-15-12-driver-download.html

@GeorgeK1ng
Copy link
Author

GeorgeK1ng commented Sep 27, 2022 •
edited
Loading

What driver exactly require that? Can you link it? I need to check it before adding proper code

AMD GPU drivers starting with 15.12. I can get up to 15.11.x working by changing a few functions to their Vista compatible counterparts, but 15.12 adds RTLDowncaseUnicodeChar, and no matter what I do, I always get a BSOD after boot.

https://www.guru3d.com/files-details/amd-radeon-software-crimson-15-12-driver-download.html

Can you list also other functions that needs to be redirected?

IncompatibleFunction -> CompatibleOne

I can probably do that in extender too

@K4sum1
Copy link

K4sum1 commented Sep 28, 2022

Sorry for the late response, I've been busy. I can't really test anything currently until next week. Also on top of changing the functions, I have to use the extended kernel as there's more stuffs without it that is a bit of a wall, so it won't really be accurate what I say.

@GeorgeK1ng
Copy link
Author

GeorgeK1ng commented Oct 7, 2022 •
edited
Loading

Sorry for the late response, I've been busy. I can't really test anything currently until next week. Also on top of changing the functions, I have to use the extended kernel as there's more stuffs without it that is a bit of a wall, so it won't really be accurate what I say.

Hi I will update this project soon, I have added RTLDowncaseUnicodeChar as it's really easy function

@K4sum1
Copy link

K4sum1 commented Oct 8, 2022

Can't wait

@K4sum1
Copy link

K4sum1 commented Oct 17, 2022

Sorry for the late response, I've been busy. I can't really test anything currently until next week. Also on top of changing the functions, I have to use the extended kernel as there's more stuffs without it that is a bit of a wall, so it won't really be accurate what I say.

Hi I will update this project soon, I have added RTLDowncaseUnicodeChar as it's really easy function :)

Hey, it's been over a week, and I really want to try this.

@GeorgeK1ng
Copy link
Author

Sorry for the late response, I've been busy. I can't really test anything currently until next week. Also on top of changing the functions, I have to use the extended kernel as there's more stuffs without it that is a bit of a wall, so it won't really be accurate what I say.

Hi I will update this project soon, I have added RTLDowncaseUnicodeChar as it's really easy function :)

Hey, it's been over a week, and I really want to try this.

Project files updated

@K4sum1
Copy link

K4sum1 commented Oct 18, 2022

Thank you, I have been able to get up to 18.3.4 working on my test machine with this. Currently trying out pro drivers to see what's the newest there I can get working.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@GeorgeK1ng @K4sum1