sixtyvividtails
@sixtyvividtails.bsky.social
66 followers
28 following
35 posts
probably not a mimic
Posts
Media
Videos
Starter Packs
![Algo for computing volume serial and various other info.
Note if 7 minutes is enough for you 😼, you can preimage the hash instantly (2-6 close values).
Edit your serial via NtWriteFile("C:",buf,0x200), or via Sysinternals VolumeId.exe.
But then we can detect tampered serials! Only 0x7F80094B values are "genuine" (out of the full 2⁶⁴ space).
uint compute_volume_serial32(uint srcId = 0)
{
uint id = srcId;
while (!id || id == 0xFFFFFF80)
{
uint64 time64 = KUSER_SHARED_DATA.SystemTime;
id = (uint)time64;
if (!id)
id = (uint)(time64 >> 0x20);
}
for (uint i = 0; i < 4; ++i)
id = rotr(id + (uchar)(id >> (8 * i)), 2);
return id;
}
uint64 compute_volume_serial64()
{
uint dword0 = compute_volume_serial32(0); // 0x7F80094B values
uint dword1 = compute_volume_serial32(dword0); // 0x3FC12F4F values
return ((uint64)dword1 << 0x20) | dword0;
}
Set new serial: NtWriteFile(`\??\C:`). No slash.
You may need to write entire sector.
Get 32-bit serial: dir C:
Get 64-bit serial: fsutil fsinfo ntfsinfo C:
Get 64-bit serial w/o admin rights:
$b=[int64[]](0,0,0);`
$f='NtQueryInformationFile';`
(Add-Type -m "[DllImport(`"ntdll`")]public static extern int $f(IntPtr h,int[]s,long[]b,int L,int C);"x -pas)::`
$f([IO.FileStream]::new("$env:windir\win.ini",'Open','Read').Handle,(0,0,0),$b,24,59);`
'{0:X016}'-f $b[0]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jxtkgvs5pvvanhchjvldmtvi/bafkreifo6qm7jcfiq7srnbbtlvhpzdjk4t3g5gjmsy3zh7vtzy37pxlbru@jpeg)
![Part1:
Decompilation of winload!MmArchInitialize, where MmArchKsegBias is selected as random value in the range [0; 0x77FFFF000]. So, from 0 to 30 GB (0x1E GB).
That value is used to bias MmArchKsegBase, which gets put into MmArchKsegAddressRange.Minimum. And that var is utilized for virtual address allocations, including VAs for images like ntoskrnl.exe.
Part2:
Part of nt!MiAssignTopLevelRanges decompile. There we can observe BaseVa for AssignedRegionSystemImages VA region type gets assigned as current imagebase of the ntoskrnl, aligned down by 512_GB. Since BaseVa is explicitly assigned, function will skip call to MiAssignSystemVa() for that region type.
So despite randomization of relative starts of most of the 0x12 regions in win11 24H2, we can assume that they all aligned by 512_GB (or 256_TB for LA57), and "AssignedRegionSystemImages" region type always starts at 0xFFFF_FF80_0000_0000.
And we can also assume ntoskrnl always starts in the first ~30.5_GB of that region.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jxtkgvs5pvvanhchjvldmtvi/bafkreigkibtocovxghwzn4h4wlwhzaduljdb4m6rfi62wrjis4warlfsue@jpeg)
![dumpbin.exe /loadConfig ntosknrl.exe
File Type: EXECUTABLE IMAGE
Section contains the following load config:
00000140 size
...
// +78/C0, not used anymore
0 DynamicValueRelocTable
...
// +88/E0; offset in section, normally right after the regular relocs
00005C8C DynamicValueRelocTableOffset
// +8C/E4; 1-based section index, normally it's .relocs
0024 DynamicValueRelocTableSection
...
Symbol VA: FFFFDE0000000000
Fixup RVAs:
[00000000] = page 00201000 rva 00201B94 type 0
[00000001] = page 00204000 rva 0020430D type 0
...
ntoskrnl.exe 24H2 has 9 dynamic value fixups:
0xFFFFDE0000000000 MM_PFN_DATABASE, 1264 refs
0xFFFFF68000000000 PTE_BASE, 1011 refs
0xFFFFF6FB40000000 PDE_BASE, 64
0xFFFFF6FB7DA00000 PPE_BASE, 6
0xFFFFF6FB7DBED000 PXE_BASE, 192
0xFFFFF6FB7DBEDF68 PXE_SELFMAP, 85
0xFFFFF6FFFFFFFFFF PTE_TOP, 129
0xFFFFF6FB7FFFFFFF PDE_TOP, 10
0xFFFFF6FB7DBEDFFF PXE_TOP, 48
SecureKernel.exe 24H2 has 13 dynamic value fixups:
0xFFFFE80000000000 SKMM_PFN_DATABASE, 142 refs
0xFFFFEFFFFFFFFFFF SKMM_PFN_DATABASE_END, 117
0xFFFFF60000000000 SKMM_NTE_BASE, 93
0xFFFFF67FFFFFFFFF SKMM_NTE_TOP, 41
0xFFFFF68000000000 SKMM_PTE_BASE, 372
0xFFFFF6FB40000000 SKMM_PDE_BASE, 6
0xFFFFF6FB7DA00000 SKMM_PPE_BASE, 2
0xFFFFF6FB7DBED000 SKMM_PXE_BASE, 712
0xFFFFF6FB7DBEDF68 SKMM_PXE_SELFMAP, 10
0xFFFFF6FB7FFFFFFF SKMM_PDE_TOP, 1
0xFFFFF6FFFFFFFFFF SKMM_PTE_TOP, 55
0xFFFFF78000000000 KI_USER_SHARED_DATA, 150 (writeable)
0x000000007FFE0000 0x7FFE0000 KI_USER_SHARED_DATA_R3, 2 (readable)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jxtkgvs5pvvanhchjvldmtvi/bafkreifydde5ocoxydtvur2yjxir6zr2lr5annr6dh56mjbb7gfav6u3w4@jpeg)
