From 6895b1723d979390abcad7aa7f487107005a7b1d Mon Sep 17 00:00:00 2001 From: donnaskiez Date: Sun, 9 Jun 2024 17:38:22 +1000 Subject: [PATCH] x86 temp fix --- driver/integrity.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/driver/integrity.c b/driver/integrity.c index 045bb6f..a5835e6 100644 --- a/driver/integrity.c +++ b/driver/integrity.c @@ -257,8 +257,9 @@ StoreModuleExecutableRegionsInBuffer(_Out_ PVOID* Buffer, MM_COPY_ADDRESS address = {0}; INTEGRITY_CHECK_HEADER header = {0}; - //DEBUG_VERBOSE("Storing x regions -> x86 module: %lx", (UINT32)IsModulex86); - //DEBUG_VERBOSE("MmIsAddressValid: %lx", MmIsAddressValid(ModuleBase)); + // DEBUG_VERBOSE("Storing x regions -> x86 module: %lx", + // (UINT32)IsModulex86); DEBUG_VERBOSE("MmIsAddressValid: %lx", + // MmIsAddressValid(ModuleBase)); if (!ModuleBase || !ModuleSize) return STATUS_INVALID_PARAMETER; @@ -1721,6 +1722,11 @@ ValidateSystemModule(_In_ PRTL_MODULE_EXTENDED_INFO Module) goto end; } + /* For now, there is some issue that sometimes occurs when validing x86 + * modules, for now lets skip them.*/ + if (entry->x86) + goto end; + /* * Ideally, we would like to have access to the offset into the module that * doesnt match, allowing us to copy the next 50 bytes for example. Since we