DeepThaw v1.3

DeepThaw v1.3
Currently, this tool only supports unfreezing Deep Freeze on Windows 10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strong recommendations:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
1.Used minifilter to restrict file read/write (implementing item 5 of the TO‑DO list).
2.In IOCTL_DISABLE_DEEPFRZ, adjusted the order of registry writes and hooking of the DeepFrz driver object.
3.Added OS version verification.

本工具目前只支持解除DeepFreeze在Windows 10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行
强烈建议：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
1.使用minifilter限制了文件的读写（实现了TO-DO list的第五点）
2.在IOCTL_DISABLE_DEEPFRZ中，调整了注册表写入以及挂钩DeepFrz驱动对象的顺序
3.加入了操作系统版本验证