diff --git a/driver/integrity.c b/driver/integrity.c index 045bb6f..a5835e6 100644 --- a/driver/integrity.c +++ b/driver/integrity.c @@ -257,8 +257,9 @@ StoreModuleExecutableRegionsInBuffer(_Out_ PVOID* Buffer, MM_COPY_ADDRESS address = {0}; INTEGRITY_CHECK_HEADER header = {0}; - //DEBUG_VERBOSE("Storing x regions -> x86 module: %lx", (UINT32)IsModulex86); - //DEBUG_VERBOSE("MmIsAddressValid: %lx", MmIsAddressValid(ModuleBase)); + // DEBUG_VERBOSE("Storing x regions -> x86 module: %lx", + // (UINT32)IsModulex86); DEBUG_VERBOSE("MmIsAddressValid: %lx", + // MmIsAddressValid(ModuleBase)); if (!ModuleBase || !ModuleSize) return STATUS_INVALID_PARAMETER; @@ -1721,6 +1722,11 @@ ValidateSystemModule(_In_ PRTL_MODULE_EXTENDED_INFO Module) goto end; } + /* For now, there is some issue that sometimes occurs when validing x86 + * modules, for now lets skip them.*/ + if (entry->x86) + goto end; + /* * Ideally, we would like to have access to the offset into the module that * doesnt match, allowing us to copy the next 50 bytes for example. Since we