Kernel Driver not loading after latest Windows 11 update

[amochurros2002]

---

Valthrun Kernel Driver

Failed to initialize the Valthrun Kernel Driver version 0.3.4:

Code: 0xCF000003
Error: initialize NT_OFFSETS

Caused by:
Failed to find _EPROCESS.ThreadListHead

For more information please refer to
https://wiki.valth.run/link/vtdk-1

OK

.\kdmapper.exe .\kernel_driver.sys
[<] Loading vulnerable driver, Name: FOmPFpZkcIFfueYPGXWRPwMqMLF
[+] NtLoadDriver Status 0x0
[+] PiDDBLock found with third pattern
[+] PiDDBCacheTable found with second pattern
[+] PiDDBLock Ptr 0xfffff800e6dcb88b
[+] PiDDBCacheTable Ptr 0xfffff800e6dcb713
[+] PiDDBLock Locked
[+] Found Table Entry = 0xFFFFBF0814068120
[+] PiDDBCacheTable Cleaned
[+] g_KernelHashBucketList Found 0xFFFFF800788B1090
[+] g_HashCacheLock Locked
[+] Found In g_KernelHashBucketList: FOmPFpZkcIFfueYPGXWRPwMqMLF
[+] g_KernelHashBucketList Cleaned
[+] MmUnloadedDrivers Cleaned: FOmPFpZkcIFfueYPGXWRPwMqMLF
[+] WdFilterDriverList Cleaned: \Users\xuxa\AppData\Local\Temp\FOmPFpZkcIFfueYPGXWRPwMqMLF
[+] Image base has been allocated at 0xFFFFE783214E0000
[+] Skipped 0x1000 bytes of PE Header
[+] Load config directory wasn't found, probably StackCookie not defined, fix cookie skipped
[<] Calling DriverEntry 0xFFFFE783214E0060
[+] Callback example called
[+] DriverEntry returned 0xcf000003
[<] Unloading vulnerable driver
[+] NtUnloadDriver Status 0x0
[+] Vul driver data destroyed before unlink
[+] success

[amochurros2002]

Update: reversing the security Windows 11 update (kb5072033) made it work again.

So, it's regarding something about that.

[imwqqz]

Issue should be fixed with #7 PR

[AliAlmasi]

@imwqqz No it's not fixed yet. im getting the same error while trying to run with valthrun loader:

windows spec:

Edition	Windows 11 Enterprise
Version	24H2
Installed on	‎9/‎7/‎2025
OS build	26100.7462
Experience	Windows Feature Experience Pack 1000.26100.275.0

also this error while uninstalling sec update kb5072033 (cc @amochurros2002 ):

[imwqqz]

I think that you will have to clone the repo which contains the fix to let it works.

[AliAlmasi]

I think that you will have to clone the repo which contains the fix to let it works.

@imwqqz what repo contains the fix? isn't this repo supposed to be for valthrun kernel driver?

[imwqqz]

https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests #7 is a pull request it hadnt been merged atm by the repo owner.