Skip to content

fix: Windows 11 25H2 26200.7462 ntokrnl.exe offsets #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
imwqqz wants to merge 2 commits into
base: master
Choose a base branch
from
+11 −1
Open

fix: Windows 11 25H2 26200.7462 ntokrnl.exe offsets #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f34fe20
fix: Windows 11 25H2 26200.7462 ntokrnl.exe offsets
imwqqz Dec 16, 2025
6eed328
fix: Completed incompleted instructions
imwqqz Dec 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion README.MD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ This is the implementation for the Valthrun driver protocol as a kernel driver.

- Visual Studio 2022
- Windows Kernel Development Kit
- LLVM Compiler Infrastructure
Copy link

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing whitespace detected. Remove the trailing whitespace at the end of this line to maintain code consistency.

Suggested change
- LLVM Compiler Infrastructure
- LLVM Compiler Infrastructure

Copilot uses AI. Check for mistakes.
- Cargo Make (`cargo install --force cargo-make`)

### Build the driver
Expand All @@ -17,7 +18,8 @@ This is the implementation for the Valthrun driver protocol as a kernel driver.
cd driver-standalone
# Create a release build.
# The result will be located at "../target/x86_64-pc-windows-msvc/release/valthrun-driver.sys"
# The result will be located at "../target/x86_64-pc-windows-msvc/release/valthrun-driver.dll"
cargo b -r
# Now we Strip the driver to get valthrun-driver.sys via Strip-Driver.ps1 linking input to espected realese build "../target/x86_64-pc-windows-msvc/release/valthrun-driver.dll".
Copy link

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Spelling error: "espected" should be "expected".

Suggested change
# Now we Strip the driver to get valthrun-driver.sys via Strip-Driver.ps1 linking input to espected realese build "../target/x86_64-pc-windows-msvc/release/valthrun-driver.dll".
# Now we Strip the driver to get valthrun-driver.sys via Strip-Driver.ps1 linking input to expected realese build "../target/x86_64-pc-windows-msvc/release/valthrun-driver.dll".

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Spelling error: "realese" should be "release".

Suggested change
# Now we Strip the driver to get valthrun-driver.sys via Strip-Driver.ps1 linking input to espected realese build "../target/x86_64-pc-windows-msvc/release/valthrun-driver.dll".
# Now we Strip the driver to get valthrun-driver.sys via Strip-Driver.ps1 linking input to expected release build "../target/x86_64-pc-windows-msvc/release/valthrun-driver.dll".

Copilot uses AI. Check for mistakes.
```
8 changes: 8 additions & 0 deletions driver/src/offsets.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,14 @@ pub fn initialize_nt_offsets() -> anyhow::Result<()> {
0x01,
0x05,
),

/* Win 11 25H2 26200.7462 */
Signature::offset(
obfstr!("_EPROCESS.ThreadListHead (26200.7462)"),
obfstr!("4C 8D B1 ? ? ? ? 48 8B F2"),
0x03,
),
Comment on lines +113 to +117
Copy link

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This signature appears to be in the wrong array. The signature is labeled as "_EPROCESS.ThreadListHead (26200.7462)" which suggests it should be searching for the ThreadListHead offset, but it's placed in the ps_get_next_process array. This signature should be moved to the eprocess_thread_list_head array (around line 163-187) where other ThreadListHead signatures are located.

Copilot uses AI. Check for mistakes.

Copy link

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trailing whitespace detected. Remove the trailing whitespace at the end of this line to maintain code consistency.

Copilot uses AI. Check for mistakes.
/* Windows 10 19045.4046 */
Signature::relative_address(
obfstr!("PsGetNextProcess (19045.4046)"),
Expand Down