Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

無法進入內核模式 #25

Closed
lordforce opened this issue Sep 29, 2020 · 19 comments
Closed

無法進入內核模式 #25

lordforce opened this issue Sep 29, 2020 · 19 comments
Assignees
@lordforce
Labels
question Further information is requested

Comments

@lordforce
Copy link

點擊[進入內核模式]，無效。
image
@BlackINT3
Copy link
Owner

@lordcommander001 點擊左下角的按鈕，进入控制臺，把錯誤日誌貼上來。

@BlackINT3 BlackINT3 added the question Further information is requested label Oct 14, 2020
@alexjinchina
Copy link

@lordcommander001 點擊左下角的按鈕，进入控制臺，把錯誤日誌貼上來。

我这里的情况是没有相应

@manning120008
Copy link

[UNONE::FsReadFileDataW] [WARN] C:\Users\Leee\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://222.210.144.84:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0}
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000428
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\Leee\AppData\Local\Temp\OpenArkDrv64.sys err
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000428
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\Leee\AppData\Local\Temp\OpenArkDrv64.sys err

@hexadecimal233
Copy link

看了一下错误代码，是签名验证不过，64位系统有限制，你驱动是自己编译的吧，你要签名一下或者开testsigning模式

@CrazyLeoJay
Copy link

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

@BlackINT3
Copy link
Owner

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

用最新的版本试试。
若还报错，检查HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OpenArkDrv64注册表键值是否被禁止。

@LipsonX
Copy link

LipsonX commented Mar 6, 2021 •
edited
Loading

我的也有错误，具体日志是：

[UNONE::FsReadFileDataW] [WARN] C:\Users\Lipson\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://125.71.120.71:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0}
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.

@1099255210
Copy link

同样的问题：
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c000009a
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\10992\AppData\Local\Temp\OpenArkDrv64.sys err

@Nero-Li
Copy link

Nero-Li commented Jul 18, 2021

同样的系统版本,2019LTSC,amd的cpu就报这个错,iu就没问题,是不支持AMD吗

@lz347396004
Copy link

试了所有能想到的办法 bios也更新到最新版了 还是无法进入

[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.0.8, build:202009041346
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest.
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\ZZZX\AppData\Local\Temp\OpenArkDrv64.sys err

@fish862003
Copy link

跟上面同样的错误，有什么办法解决么

@lawrenceching
Copy link

lawrenceching commented Aug 20, 2021 •
edited
Loading

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

用最新的版本试试。
若还报错，检查HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OpenArkDrv64注册表键值是否被禁止。

同样的问题，检查过注册表发现并没有这个键值。可否再提供些建议。谢谢。

OpenArk Console
Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk
[UNONE::FsReadFileDataW] [WARN] C:\Users\***\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://221.237.29.124:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0} 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741772 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err

image

系统：Windows10 专业版 20H2 19042.1165

@GavinKing1995
Copy link

作者你好，我也发现了类似的问题，在点击进入内核模式时，没有反应。希望能帮忙看一眼，谢谢。这个是我的日志：

[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] RegSetValueW err:5
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000160
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\CRAZYL~1\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2
[UNONE::PsGetProcessPathW] [ERR] VirtualOpenProcess pid:16124 err:2

用最新的版本试试。
若还报错，检查HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OpenArkDrv64注册表键值是否被禁止。

同样的问题，检查过注册表发现并没有这个键值。可否再提供些建议。谢谢。

OpenArk Console
Copyright (C) 2019 BlackINT3 https://github.com/BlackINT3/OpenArk
[UNONE::FsReadFileDataW] [WARN] C:\Users\***\AppData\Roaming\OpenArk\console\history.txt is empty file
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2 
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://upt.blackint3.com/openark/version.txt 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{"appbd":"201906051417","appfsurl":"http://221.237.29.124:50200/openark/files","appurl":"https://github.com/BlackINT3/OpenArk/releases","appver":"1.0.0","err":0} 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.1.0, build:202011191100 
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] OpenArk is latest. 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741772 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[ArkDrvApi::Object::ObjectSectionEnumR3] [ERR] NtOpenDirectoryObject status:-1073741766 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err 
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\***\AppData\Local\Temp\OpenArkDrv64.sys err

image

系统：Windows10 专业版 20H2 19042.1165

遇到了同样的问题[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
Win10企业版 21H1 19043.1165

@mikasaol
Copy link

签名的证书被吊销了

@autLory
Copy link

autLory commented Sep 10, 2021

[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\lx\AppData\Local\Temp\OpenArkDrv64.sys err
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\lx\AppData\Local\Temp\OpenArkDrv64.sys err
我也遇到这个问题，进不去内核模式

@Rascalpirate
Copy link

[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\WTT\AppData\Local\Temp\OpenArkDrv64.sys err
同是注册表内没有OpenArkDrv64，系统：Windows 10 版本号 20H2 操作系统内部版本 19042.1165

@andronoob
Copy link

#58

@BlackINT3
Copy link
Owner

v1.2.0 fixed.

@owen118z
Copy link

1.2.2 也是这个问题

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lordforce lordforce

Labels
question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests