Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to load kernel driver (not yet supported on this kernel version) #1823

Open
MarekKnapek opened this issue Aug 22, 2023 · 236 comments
Open
Assignees

Comments

@MarekKnapek
Copy link
Contributor

MarekKnapek commented Aug 22, 2023

ISSUE DESCRIPTION HAS BEEN REWRITTEN BY MAINTAINER @jxy-s:

image

This issue is for requesting support for new Windows kernel versions. The kernel driver will refuse to load on a Windows operating system running a kernel (ntoskrnl.exe) version that it does not recognize. This behavior is by design. The driver relies on specific data that must be updated and published to support new kernel versions. This data includes internal offsets within the operating system, which the driver uses to provide extended capabilities and system inspection. The data is signed using a cryptographic algorithm and verified by the driver before it is loaded. This signing process ensures that the data has been produced by the project maintainers and not by a third party, preventing potential misuse or abuse of the kernel driver.

To request support, please post a screenshot of the error dialog (see example above).

Please note: Support for new kernel versions may be delayed for various reasons. Usually, Microsoft makes the necessary information public within 24 hours of a new kernel version being released. However, on rare occasions, this information may take days or even a week to appear. In some cases, Microsoft may not provide sufficient information, requiring more effort on our part to update the data. Additionally, delays may occur if the maintainers are occupied with other tasks. While we typically respond to new kernel versions within 48 hours of their release, there are times when it may take up to a week. We are working on automating this process to improve our response time.

We appreciate your efforts in requesting support for new kernel versions and ask for your patience while we work through the necessary updates.

@ge0rdi

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@jxy-s jxy-s self-assigned this Aug 22, 2023
@ge0rdi

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@ge0rdi

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@MarekKnapek

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@poqdavid

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@ge0rdi

This comment was marked as outdated.

@jxy-s jxy-s closed this as completed Aug 24, 2023
@MagicAndre1981

This comment was marked as outdated.

@dmex dmex reopened this Aug 25, 2023
@jxy-s

This comment was marked as outdated.

@poqdavid

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@kotenok2000

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@poqdavid

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@kotenok2000

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@jxy-s

This comment was marked as outdated.

@MagicAndre1981

This comment was marked as outdated.

@jxy-s
Copy link
Member

jxy-s commented Sep 14, 2024

I would like to inform everyone involved in this thread that the next build will include significant changes to dynamic data. These changes were necessary to better support the automation of dynamic data generation. I have gone through and generated the dynamic data manifest for a large number of supported kernels.

As a result, we will be trialing support for ntkrla57 and preview builds 🎉. However, please note that for preview builds, Microsoft may not always provide the information needed to generate the dynamic data. Our long-term goal is to fully automate both the generation and validation of dynamic data, but we still have some work to do in fully vetting the current tooling.

That being said, since there are significant changes and a regeneration of dynamic data, there is a possibility that some kernels may have been missed or other issues could arise. I appreciate your patience as we work through these.

A new build will be available soon™️.

@poqdavid
Copy link

Does this mean that you will be able to support Insider channels, such as Release Preview, as well?

@jxy-s
Copy link
Member

jxy-s commented Sep 14, 2024

Does this mean that you will be able to support Insider channels, such as Release Preview, as well?

Yes, as long as Microsoft provides the necessary information. There are two scenarios to consider. First, with the automated metadata we currently have access to, testing shows we achieve around 90% coverage of kernels. However, in some cases, we may need to manually retrieve the kernel binary, either through user submission or by other alternative means.

@DavidXanatos
Copy link
Contributor

Does this mean that you will be able to support Insider channels, such as Release Preview, as well?

Yes, as long as Microsoft provides the necessary information. There are two scenarios to consider. First, with the automated metadata we currently have access to, testing shows we achieve around 90% coverage of kernels. However, in some cases, we may need to manually retrieve the kernel binary, either through user submission or by other alternative means.

Are you using the provided PDB files or also other data sources?

@jxy-s
Copy link
Member

jxy-s commented Sep 14, 2024

Does this mean that you will be able to support Insider channels, such as Release Preview, as well?

Yes, as long as Microsoft provides the necessary information. There are two scenarios to consider. First, with the automated metadata we currently have access to, testing shows we achieve around 90% coverage of kernels. However, in some cases, we may need to manually retrieve the kernel binary, either through user submission or by other alternative means.

Are you using the provided PDB files or also other data sources?

We are positioned to leverage multiple data sources.

@DavidXanatos
Copy link
Contributor

I would like to inform everyone involved in this thread that the next build will include significant changes to dynamic data. These changes were necessary to better support the automation of dynamic data generation. I have gone through and generated the dynamic data manifest for a large number of supported kernels.

As a result, we will be trialing support for ntkrla57 and preview builds 🎉. However, please note that for preview builds, Microsoft may not always provide the information needed to generate the dynamic data. Our long-term goal is to fully automate both the generation and validation of dynamic data, but we still have some work to do in fully vetting the current tooling.

That being said, since there are significant changes and a regeneration of dynamic data, there is a possibility that some kernels may have been missed or other issues could arise. I appreciate your patience as we work through these.

A new build will be available soon™️.

is this the "Saturday, 14th of September, 2024 Canary" build

Also a small OT request: would it be possible to link with every canary release the exact git tag it was built from? Or may be that's already the case and I just don't know where to find that info LOL

@MagicAndre1981
Copy link
Contributor

Also a small OT request: would it be possible to link with every canary release the exact git tag it was built from? Or may be that's already the case and I just don't know where to find that info LOL

In check for updates dialog you see the short git hash

image

image

@DavidXanatos
Copy link
Contributor

I noticed that the latest DynData are not for the latest ARM64 Win11 yet:

grafik

@jxy-s
Copy link
Member

jxy-s commented Sep 22, 2024

I noticed that the latest DynData are not for the latest ARM64 Win11 yet:

grafik

Added a few more ARM64 kernels in these commits:
f247ebc
bf387c7

Unsure exactly why those were not reported to me automatically, will investigate that - but they'll be available in the next build 👍.

@MagicAndre1981
Copy link
Contributor

Unsure exactly why those were not reported to me automatically, will investigate that - but they'll be available in the next build 👍.

has your logic detected the latest RP Updates for Windows 11 23H2 (KB5043145) and 24H2(KB5043178)?

image

Or do you still only support retail updates?

@jxy-s
Copy link
Member

jxy-s commented Sep 24, 2024

The automation primarily depends on SystemInformer running on those builds and checking for updates at least once. However, I have alternative methods to backfill any missing information.

Or do you still only support retail updates?

We’re currently tentatively trialing support for all releases, not just retail.

Regarding those specific kernels, my tooling indicates to me that Microsoft has not yet provided the necessary data for those kernels.

@0xGREG

This comment was marked as outdated.

@jxy-s

This comment was marked as off-topic.

@fansteven7

This comment was marked as off-topic.

@jxy-s

This comment was marked as off-topic.

@fansteven7

This comment was marked as off-topic.

@dandeliondream

This comment was marked as off-topic.

@jxy-s

This comment was marked as off-topic.

@dandeliondream

This comment was marked as off-topic.

@MagicAndre1981

This comment was marked as off-topic.

@trparky
Copy link
Contributor

trparky commented Nov 5, 2024

image

@kotenok2000
Copy link

Latest version canary channel updates to is 3.1.24305.0

@Giantvince1
Copy link

{DDA690E2-A6AF-40F1-AD1A-263C8C80916C}
This is Windows 11 Enterprise LTSC 2024. Latest canary producing this error as of time of writing. Let me know if you need me to send my ntoskrnl.exe file and/or where to find the PDB needed.

@Giantvince1
Copy link

Thank you for the new build; my kernel is now supported by the driver too!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests