readME

README.md

@@ -32,8 +32,8 @@
 
 # known issues
 
-- the system module validation (NOT the driver integrity check) success rate varies. On some versions it works flawlessy, other times 60% or so of modules will fail, stating that the module regions are not equivalent.
-- process modules integrity checks sometimes crash the user mode app on windows 11.
+- The system module integrity checks on win11 fail due to MmCopyMemory error for around 80% of the modules. While it doesn't cause a blue screen, this is a pretty pathetic success rate. Am looking into it.
+- KPRCB thread check rn is kinda broken
 
 Ive thoroughly tested the driver with verifier in addition to extended testing on my main pc (non vm) so at the least there shouldn't be any bluescreens (hopefully...). If you do find any, feel free to open an issue with the minidump :)
 
@@ -42,6 +42,10 @@ Ive thoroughly tested the driver with verifier in addition to extended testing o
 - Win10 22H2
 - Win11 22H2
 
+# logs example
+
+video of example logs + running on my machine no vm: [video](https://youtu.be/htY83WsMEcc)
+
 # how 2 use
 
 1. Build the project in visual studio, if you experience any build issues - check the drivers project settings are the following:

driver/common.h

@@ -4,8 +4,8 @@
 #include <ntifs.h>
 #include <wdftypes.h>
 
-#define DEBUG_LOG(fmt, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0, "[DONNAAC - INFO] " fmt "\n", ##__VA_ARGS__)
-#define DEBUG_ERROR(fmt, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0, "[DONNAAC - ERROR] " fmt "\n", ##__VA_ARGS__)
+#define DEBUG_LOG(fmt, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0, "donna-ac [INFO] " fmt "\n", ##__VA_ARGS__)
+#define DEBUG_ERROR(fmt, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, 0, "donna-ac [ERROR] " fmt "\n", ##__VA_ARGS__)
 
 #define STATIC static
 

driver/modules.c

@@ -1507,6 +1507,8 @@ LaunchInterProcessInterrupt(
 	NMI_CONTEXT ipi_context = { 0 };
 	PVOID callback_handle;
 
+	DEBUG_LOG("Launching interprocess interrupt");
+
 	ipi_context.core_count = KeQueryActiveProcessorCountEx(0);
 	ipi_context.nmi_core_context =
 		ExAllocatePool2(POOL_FLAG_NON_PAGED, ipi_context.core_count * sizeof(NMI_CORE_CONTEXT), NMI_CONTEXT_POOL);