diff --git a/src/BlackBoneDrv/BlackBoneDrv.c b/src/BlackBoneDrv/BlackBoneDrv.c index f81598d..e7f2ea7 100644 --- a/src/BlackBoneDrv/BlackBoneDrv.c +++ b/src/BlackBoneDrv/BlackBoneDrv.c @@ -261,7 +261,7 @@ NTSTATUS BBInitDynamicData( IN OUT PDYNAMIC_DATA pData ) if (ver_short != WINVER_81) return STATUS_NOT_SUPPORTED; #elif defined (_WIN10_) - if (ver_short != WINVER_10 && ver_short != WINVER_10_AU) + if (ver_short != WINVER_10 && ver_short != WINVER_10_AU && ver_short != WINVER_10_CU) return STATUS_NOT_SUPPORTED; #endif @@ -331,7 +331,7 @@ NTSTATUS BBInitDynamicData( IN OUT PDYNAMIC_DATA pData ) pData->ExRemoveTable -= 0x5E; break; - // Windows 10, build 14393/10586 + // Windows 10, build 15063/14393/10586 case WINVER_10: if (verInfo.dwBuildNumber == 10586) { @@ -363,6 +363,24 @@ NTSTATUS BBInitDynamicData( IN OUT PDYNAMIC_DATA pData ) if (NT_SUCCESS(BBScanSection("PAGE", (PCUCHAR)"\x48\x8D\x7D\x18\x48\x8B", 0xCC, 6, (PVOID)&pData->ExRemoveTable))) pData->ExRemoveTable -= 0x60; + status = BBLocatePageTables( pData ); + break; + } + else if (verInfo.dwBuildNumber == 15063) + { + pData->ver = WINVER_10_CU; + pData->KExecOpt = 0x0; + pData->Protection = 0x0; + pData->ObjTable = 0x0; + pData->VadRoot = 0x620; + pData->NtCreateThdIndex = 0x0; + pData->NtTermThdIndex = 0x0; + pData->PrevMode = 0x0; + pData->ExitStatus = 0x0; + pData->MiAllocPage = 0; + if (NT_SUCCESS(BBScanSection("PAGE", (PCUCHAR)"\x48\x8D\x7D\x18\x48\x8B", 0xCC, 6, (PVOID)&pData->ExRemoveTable))) + pData->ExRemoveTable -= 0x60; + status = BBLocatePageTables( pData ); break; } @@ -401,8 +419,16 @@ NTSTATUS BBLocatePageTables( IN OUT PDYNAMIC_DATA pData ) if (pMmGetPhysicalAddress) { PUCHAR pMiGetPhysicalAddress = *(PLONG)(pMmGetPhysicalAddress + 0xE + 1) + pMmGetPhysicalAddress + 0xE + 5; - pData->DYN_PDE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x49 + 2); - pData->DYN_PTE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x56 + 2); + if (pData->ver >= WINVER_10_CU) + { + pData->DYN_PDE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x43 + 2); + pData->DYN_PTE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x50 + 2); + } + else + { + pData->DYN_PDE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x49 + 2); + pData->DYN_PTE_BASE = *(PULONG_PTR)(pMiGetPhysicalAddress + 0x56 + 2); + } return STATUS_SUCCESS; } diff --git a/src/BlackBoneDrv/Private.c b/src/BlackBoneDrv/Private.c index e8aa0a0..d2f285b 100644 --- a/src/BlackBoneDrv/Private.c +++ b/src/BlackBoneDrv/Private.c @@ -239,7 +239,7 @@ PVOID GetSSDTEntry( IN ULONG index ) /// Found PTE PMMPTE GetPTEForVA( IN PVOID pAddress ) { - if (dynData.ver == WINVER_10_AU) + if (dynData.ver >= WINVER_10_AU) { // Check if large page PMMPTE pPDE = (PMMPTE)(((((ULONG_PTR)pAddress >> PDI_SHIFT) << PTE_SHIFT) & 0x3FFFFFF8ull) + dynData.DYN_PDE_BASE); diff --git a/src/BlackBoneDrv/Private.h b/src/BlackBoneDrv/Private.h index b94b5dc..f846960 100644 --- a/src/BlackBoneDrv/Private.h +++ b/src/BlackBoneDrv/Private.h @@ -142,6 +142,7 @@ typedef enum _WinVer WINVER_81 = 0x0630, WINVER_10 = 0x0A00, WINVER_10_AU = 0x0A01, + WINVER_10_CU = 0x0A02, } WinVer; extern PLIST_ENTRY PsLoadedModuleList; @@ -310,4 +311,4 @@ VOID StartProcessors( IN NOPPROCINFO* Info ); /// Block size to allocate /// Allocated address /// Status code -NTSTATUS AllocateInDiscardedMemory( IN ULONG size, OUT PVOID* ppFoundBase ); \ No newline at end of file +NTSTATUS AllocateInDiscardedMemory( IN ULONG size, OUT PVOID* ppFoundBase );