Incompatible with Windows Update KB4056892

[TSheep]

With the latest security patch of windows installed, the target EProcess can not be parsed from the Systems EProcess AktiveProcessLinks.
The reads of virtual memory from the System process return invalid results due to the Virtual->Physical address translation failing.

offsets and dirbase have been verified correctly using WinDbg

[+0x028] DirectoryTableBase : 0x1aa002 [Type: unsigned __int64]

[TheDevHub]

Did you ever find a solution to this?

[TheDevHub]

Also, it seems the issue occurs before 'translation'; specifically in GetKernelDirBase()

I verified that both EPPidOffset and EPNameOffset match the hard-coded value for Win10:

/*0x2E0*/     VOID*        UniqueProcessId;
/*0x450*/     UINT8        ImageFileName[15];

	uint64_t GetKernelDirBase()
	{
		if (mKernelDir != 0)
			return mKernelDir;
		
		auto result = ScanPoolTag("Proc", [&](uint64_t address) -> bool
		{ 
			uint64_t peprocess;
			char buffer[0xFFFF];
			if (!Read(address, (uint8_t*)buffer, sizeof(buffer)))
				return false;
			for (char* ptr = buffer; (uint64_t)ptr - (uint64_t)buffer <= sizeof(buffer); ptr++)
				if (!strcmp(ptr, "System"))
					peprocess = address + (uint64_t)ptr - (uint64_t)buffer - EPNameOffset;

			uint64_t pid = 0;
			if (!Read(peprocess + EPPidOffset, (uint8_t*)&pid, sizeof(pid)))
				return false;

			if (pid == 4) // This never succeeds, PID appears as 0x10000001 in all contexts where strcmp succeeds.
			{
				if (!Read(peprocess + EPDirBaseOffset, (uint8_t*)&mKernelDir, sizeof(mKernelDir)))
					return false;
				if (peprocess == TranslateLinearAddress(mKernelDir, SFGetEProcess(4))) {
					printf("Found System CR3\n");
					return true;		
				}
			}
			return false;
		});

		if (result)
			return mKernelDir;
		return 0;
	}

Unfortunately after all this time I have still been unable to find a solution to this issue.

[kuh4it]

     for (size_t i = 0; i < sizeof(buffer) - sizeof(uint64_t); ++i) {
            if (memcmp(&buffer[i], "System", 6) == 0) {
                peprocess = address + i - EPNameOffset;
                break;
            }
        }