Windows 24H2 CI.DLL!g_CiOptions search pattern is broken

[Whothatmofo]

can't seem to get it to work properly with windows 24h2 and cant load drivers.

[hfiref0x]

Very informative. Show kdu -diag.

[Whothatmofo]

[hfiref0x]

It cannot find internal CI.DLL variable. Attach your CI.DLL somewhere and post a link to it.

[Whothatmofo]

ci.dll from system32, correct

[Whothatmofo]

https://drive.google.com/file/d/1zs_ZttCD4Bj61bNl62hexPX7uGH4Nrv7/view?usp=drive_link

[hfiref0x]

Your link gives "Access denied".

[Whothatmofo]

try it now, sorry hfire

[hfiref0x]

Open dsefix.cpp and replace KDUpCheckInstructionBlock with

ULONG KDUpCheckInstructionBlock(
    _In_ PBYTE Code,
    _In_ ULONG Offset
)
{
    ULONG offset = Offset;
    hde64s hs;

    RtlSecureZeroMemory(&hs, sizeof(hs));

    hde64_disasm(&Code[offset], &hs);
    if ((hs.flags & F_ERROR) || (hs.len != 3)) {
        return 0;
    }

    //
    // mov     r9, rbx
    //
    if (Code[offset] != 0x4C ||
        Code[offset + 1] != 0x8B)
    {
        return 0;
    }

    offset += hs.len;

    hde64_disasm(&Code[offset], &hs);
    if ((hs.flags & F_ERROR) || (hs.len != 3)) {
        return 0;
    }

    //
    // mov     r8, rdi 
    // 
    // or 
    //
    // mov     r8d, edi
    //
    if (Code[offset] != 0x4C && 
        Code[offset] != 0x44 &&
        Code[offset + 1] != 0x8B)
    {
        return 0;
    }

    offset += hs.len;

    hde64_disasm(&Code[offset], &hs);
    if (hs.flags & F_ERROR)
        return 0;

    if (hs.len == 3) {

        //
        // mov     rdx, rsi
        //
        if (Code[offset] != 0x48 ||
            Code[offset + 1] != 0x8B)
        {
            return 0;
        }
    }
    else if (hs.len == 5)
    {
        //
        // mov[rsp + 38h + 28h], rax
        //
        if (Code[offset] != 0x48 ||
            Code[offset + 1] != 0x89)
        {
            return 0;
        }

        offset += hs.len;
        hde64_disasm(&Code[offset], &hs);
        if (hs.flags & F_ERROR || hs.len != 3) {
            return 0;
        }
        //
        // mov     rdx, rsi
        //
        if (Code[offset] != 0x48 ||
            Code[offset + 1] != 0x8B)
        {
            return 0;
        }
    }
    else {
        return 0;
    }

    offset += hs.len;

    hde64_disasm(&Code[offset], &hs);
    if ((hs.flags & F_ERROR) || (hs.len != 2)) {
        return 0;
    }

    //
    // mov     ecx, ebp
    //
    if (Code[offset] != 0x8B ||
        Code[offset + 1] != 0xCD)
    {
        return 0;
    }

    return offset + hs.len;
}

Tell me if it works.
edit: fixed code tags

[Whothatmofo]

will update you soon as i can

[Whothatmofo]

working perfect hfire. ty!