125 Commits

Author SHA1 Message Date
hfiref0x 7ddb5bc882 Add DBPACK and packed resource DB support
Introduce DBPACK tool and packed resource database support.
Adds a new DBPACK utility and project (Source/Utils/DBPACK) and a kdu.db resource; provides dbmanifest.txt and moves many per-driver/data binaries into the packer data area.
Clean up Tanikaze project files and filters to remove many inlined resource entries and update resource.rc/resource.h to reference the single kdu.db RCDATA.
Several binary resource files were updated as part of the packing process.
2026-06-12 21:54:21 +07:00
hfiref0x 31edcfb279 v 1.4.9
Add LECO LECOMA driver as provider 64
2026-06-12 10:41:14 +07:00
hfiref0x eaa3c21a4c v 1.4.9
PGRHostControl typo fix
2026-06-10 23:51:01 +07:00
hfiref0x 843839d6c8 v 1.4.9
Add FLIR PGRHostControl driver as provider 63
2026-06-10 11:13:01 +07:00
hfiref0x 7d13110307 v 1.4.9
Better handling for embedded certificates for list/listcsv commands
2026-06-08 00:16:06 +07:00
hfiref0x 93338d4dbc v 1.4.9
Added new command -listcsv to export database metadata into csv file format
KDUDB: introduce AdvisoryId to hold specific MITRE CVE id if present, update gProvEntry entries
KDUDB: signer information now parsed in-memory from provider image during -list/-listcsv commands
2026-06-06 19:03:00 +07:00
hfiref0x 66998a098e Add hashing and Matrox driver; update physmap
Added Matrox driver as provider 62
Update list command: display file SHA1, Authenticode SHA1, page SHA1, page SHA256 hashes for each provider in database
Update readme: add provider 62 to the descriptions table and provide hashes
2026-06-06 12:42:34 +07:00
hfiref0x b538466159 v 1.4.9
Added AMD affdriver (RPMC) as provider 61
2026-06-05 12:29:18 +07:00
hfiref0x b8d965bf31 Correct function comment for RipRelativeStore32
Fix another typo
2026-05-30 21:52:45 +07:00
hfiref0x 8ab1b1cfc2 Update comments
Update descriptions (rename from their debug names)
2026-05-30 21:47:13 +07:00
hfiref0x 26c4e3dbc8 Add synthetic g_CiOptions query tests
Add synthetic CI.dll tests and integrate them into the project.
2026-05-30 11:24:55 +07:00
hfiref0x 260c0a0e23 Fix for Win8/8.1
Add RIP-relative 32-bit mov store detector to avoid false positive on g_CiKernelApis
2026-05-30 02:00:34 +07:00
hfiref0x a8097ee58c Refactor CI query
Address #138
Update headers
2026-05-29 18:22:31 +07:00
hfiref0x 670482fe1b Update tests
Added test case for DSE query
2026-05-02 22:41:24 +07:00
hfiref0x 590c6dcb1e Add embedded providers DB and loader
Introduce an embedded providers database and wire it into the build.
2026-04-02 23:22:56 +07:00
hfiref0x 383f8929a2 Add hypervisor & environment detection and fixes
Improve diagnostics and fix some bugs

Signed-off-by: hfiref0x <hfiref0x@users.noreply.github.com>
2026-04-02 13:14:30 +07:00
hfiref0x 1be07da558 v 1.4.8
Added Guangzhou Shangke Information Technology Co., Ltd. WinHwDrv driver as provider 60
2026-03-30 11:35:57 +07:00
hfiref0x e7b47f2fbc Update consts.h 2026-03-28 17:30:46 +07:00
hfiref0x 5867217277 v 1.4.8
Added Digital Electronics Corp. Ipctype driver as provider 59
2026-03-28 17:26:53 +07:00
hfiref0x e3a516f93e v 1.4.8
Added Teledyne CorMem driver as provider 58
2026-03-28 13:42:11 +07:00
hfiref0x 3458bf75c5 v 1.4.7
Added Lenovo LnvMSRIO (CVE-2025-8061) as provider 57
Centralized Superfetch-based virtual->physical translation and per-page kernel read/write logic for providers 55, 56 and 57
Readme update
2026-03-27 12:41:58 +07:00
hfiref0x 3d5e63fbf0 v 1.4.6
Add KDU_EPROCESS_OFFSETS and KDUGetEprocessOffsets to centralize EPROCESS offsets (PsProtection and mitigation flags) and refactor ps.* logic to use the new API. Add provider callback verification before performing PS patches. Fix multiple bugs: correct instruction validation logic in dsefix, use explicit size cast in zemana, handle NULL SD case and avoid double-free in ipcsvc, add dbghelp existence check before LoadLibrary in sym, rename TEXT_SECTION_LEGNTH->TEXT_SECTION_LENGTH and use it in victim, and add retry limit for IPC connect. Update many embedded driver/resource binaries accordingly.
2026-02-17 16:53:14 +07:00
fxrstor 05fa67ba5b providers: add Toshiba TPwSav 2025-12-19 22:11:11 +05:30
hfiref0x 6aed10d103 Add decompression support to PCOMP utility
Updated PCOMP to support a decompression mode via the '-d' argument. Updated project files to add new source, adjust toolset, and support case-insensitive string comparison. Minor fix in sup.cpp to use SystemSuperfetchInformation enum.
2025-12-19 22:54:05 +07:00
Alan Li d26678973f Add Windows Server 2022 support for -ps and -pm commands 2025-12-07 15:36:06 +08:00
hfiref0x d97e5a3801 Refactor physical memory IO and improve driver calls
Replaces DeviceIoControl with supCallDriverEx for physical memory read/write operations in tpup.cpp, improving error handling and status checks. Removes unused global variable, updates logging messages, and fixes type usage in sup.cpp for better reliability and code clarity.
2025-12-03 07:55:36 +07:00
hfiref0x 53358e15a4 Add UNREFERENCED_PARAMETER for Context in TestSuperfetch
Added UNREFERENCED_PARAMETER(Context) to suppress unused parameter warning in the TestSuperfetch function.
2025-12-02 19:30:47 +07:00
hfiref0x 1b3a3bbc5c v1.4.5
Migrated to MSVS 2026 with latest SDK and build tools
Added TechPowerUp ThrottleStop (CVE-2025-7771) as provider 55
Added physical and kernel memory read/write via Superfetch translation support
Readme and RTL's update
2025-12-02 19:22:13 +07:00
hfiref0x 2d5ba13010 Update version, fix memory leaks and improve error handling
Fix memory leaks by adding missing supHeapFree calls and improve error handling in victim.cpp and shellcode.cpp. Update project toolset to v143 in GenAsIo2Unlock.vcxproj and adjust debugger arguments. Minor bug fixes and code cleanups in process mitigation, string formatting, and command-line argument parsing.
2025-12-01 19:32:55 +07:00
hfiref0x b53d1470bd Refactor process protection and mitigation handling
Simplified string conversion functions for protection types and signers using arrays. Added KDUGetProtectionOffset to centralize PS_PROTECTION offset selection. Refactored mitigation flags offset selection and unified EPROCESS offset macros. Improved resource cleanup and error handling in process creation and protection routines. Updated offsets and macro definitions in ps.h for clarity and maintainability.
2025-11-08 21:01:22 +07:00
Soph 4cb06b51e4 MitigationFlags and Protection offsets for 25H2 2025-10-18 02:04:53 +01:00
cailllev 823a23dcf6 move definitions 2025-10-17 09:05:50 +02:00
cailllev 857a66adfe remove magic numbers 2025-10-15 15:33:41 +02:00
cailllev 84bad3e7f0 bugfix overwrite value from UCHAR to ULONG, add -pm1 and -pm2 args to select flag1 or 2 to overwrite, or both with -pm 2025-10-15 15:04:24 +02:00
cailllev 5a303bf003 add -pm switch (remove ProcessMitigationsFlags1 and 2) 2025-10-13 23:09:11 +02:00
cailllev ff7a52f7b5 add -psw (WinTcb PPL) support 2025-10-05 15:56:48 +02:00
hfiref0x 173ece98ab v 1.4.4
Headers update
2025-09-20 10:55:36 +07:00
cailllev 251666e17c add Win 11 support for -pse, closes #115 2025-09-16 16:09:19 +02:00
hfiref0x b29873b3af v 1.4.4
Update kdubase.h
2025-08-19 14:41:50 +07:00
hfiref0x 3f8d114733 v 1.4.4
Remove dead code
Fix pattern matching for CiInitialize scan
Fix symbols resolution for DSE values
Fix some typos
Fix EPROCESS corruption case
2025-08-19 14:32:49 +07:00
hfiref0x 35ca4554fe v 1.4.4
Update headers
2025-08-18 15:14:45 +07:00
hfiref0x 88633c9b7a v1.4.4
Each shellcode variant updated to fix latest MSVC trashing issue
Made NetEase driver fully functional
RTLs updated
2025-08-18 15:01:22 +07:00
hfiref0x a3f40c3f95 v1.4.4
Added NetEase NeacSafe64 driver (CVE-2025-45737) as provider 54, with all it disadvantages it is still valuable for DSE bypass
2025-07-19 21:56:41 +07:00
hfiref0x bd105fd9ee Update Utils 2025-07-09 21:20:25 +07:00
hfiref0x 4c03da9a46 Update rtls 2025-06-27 14:30:45 +07:00
hfiref0x c6af6f8fbd v1.4.3
Added fresh HwRwDrv.x64 (WinRing0 tweaked copy-paste) driver as provider 53
2024-11-10 12:24:06 +07:00
hfiref0x fd69cebde0 dev142-dsefix
Address #98 issue
2024-09-23 10:09:51 +07:00
hfiref0x 8bd890d5e4 v 1.4.2
Added Intel ME tools driver as provider 52
2024-04-02 11:50:29 +07:00
hfiref0x cfd84e195a v 1.4.1
Block loading of unsupported db files #92
2024-03-31 04:21:44 +07:00
hfiref0x eccadfb4d7 Update KDU.vcxproj
Set quoted path for release configuration also.
2024-01-07 11:31:42 +07:00