RogueKiller 11 beta

[Tigzy]

Hello,

RogueKiller 11 is right behind the door
We need you to test it before it replaces the official version (currently 10.X.X).

It's quite critical because the only major change is about the Kernel Driver. We have re-coded all the driver from scratch, following best practices to ensure it's compatible with all operating systems (from Windows XP to Windows 10, 32 and 64 bits) and with all environments.

Why is it critical? Because a bug in the Kernel Driver means Blue Screen Of Death, which is not particularly a good thing. Yeah, that's annoying.
So we need as much tests as possible to ensure no bug is left before it's moved in production.


You will find the binaries here:

• (32 bits) http://download.adlice.com/RogueKiller/RogueKiller_beta.exe
• (64 bits) http://download.adlice.com/RogueKiller/RogueKillerX64_beta.exe

What's new?

• Rewritten all kernel code. From scratch.
• Kernel Hooks detections are now made on userland side, in common with IAT hooks detection. Easier to maintain, more efficient.
• Minified amount of code on Kernel side for safier code.
• Driver is now aware of Windows 8/8.1/10.

No big change in the flow, nor in the UI.
The most important occurs while Antirootkit scan => SSDT, Shadow SSDT, IRPs, Filters. IAT scan isn't affected.

I have a BSOD, what do I do?

• Go in C:/Windows/minidumps, find the file that has been generated (blabla.dmp).
• Send it to us: http://upload.adlice.com, or attach in comments (it's a small file).

Thanks for your help 

[greysmouth]

Hi Boss. It doesn't the matter if my PC crashes. Nothing compared to more than ten BSODs after installing Win 10 Pro: that's why it's free! My best regards, greysmouth BO IT.

[firefoxthebomb]

Thanks for the opportunity to test this beta out.

I have ran it on a Windows 10 64bit VM not much installed on it.  Any who it did cause an issue where the computer rebooted.  I have attached the minidump file for your review.

[Tigzy]

Thanks!

[Tigzy]

Thanks for the opportunity to test this beta out.

I have ran it on a Windows 10 64bit VM not much installed on it.  Any who it did cause an issue where the computer rebooted.  I have attached the minidump file for your review.

Hey, I'm loaded the minidump but it doesn't contain much information.
Do you have an idea where it BSoD during the scan?

[Roger]

Hi

Thanks for letting us testing RogueKiller 11 beta, but unfortunately my HP Laptop with Windows 10 installed crashed with.

Attached is the minidump as requested. Renamed from dmp to txt.

[Curson]

Hi Roger,

Thanks for the feedback.

Regards.

[Tigzy]

Thanks all,
Minidumps were all on same bug: Reading kernel memory in a bad way.

A beta 3 will come soon, I'll keep you informed.

[Tigzy]

Hello,
beta 3 is online (same link, replaces old version)

firefoxthebomb and Roger Schwarz may I ask you to tell me if it crashes again?
Thanks a lot!

[Roger]

Hi

This time with new version 3 it worked without crash, great! The results I have uploaded to your upload directory for review.

Thank you again.
Roger

[Tigzy]

Thanks
Received your email, IAT hooks are another problem (code is common with version 10) and are fixed on in a different way.
If you can reproduce the Chrome hooks, then it'd be great if you can send a full memory dump of Chrome process (with Process Explorer / Process Hacker)

[greysmouth]

Hi. here the last log file running beta 3. Actually, I never had any BSODs since running RK beta in Win 10 Pro enviroment. Regards, greysmouth BO IT.

[Curson]

Hi greysmouth,

Thanks.
Could you please attach the JSON version of the log in your next reply ?

Regards.

[greysmouth]

Hi greysmouth,

Thanks.
Could you please attach the JSON version of the log in your next reply ?

Regards.

I'm not allowed..greysmouth BO IT.

[Curson]

Hi greysmouth,

Coud you try to rename the .json file to .txt ?

EDIT : You will now normally be able to upload .json files as well.

Regards.