last version of wincheck

it`s last because of
My former employer was so so nice that he allowed me to publish this build. Btw I seek new job

Download
Mirror

Changelog: 

• add support of Windows 1909
• add support of new RFG relocs. As usually kernel itself has bad IMAGE_DYNAMIC_RELOCATION_TABLE - it contains zero type somewhere inside IMAGE_DYNAMIC_RELOCATION
• add dumping of WMI_LOGGER_CONTEXTs for InfinityHook detection (with -wmi option)
• add dumping of PsAltSystemCallHandlers
• add dumping of PoPdcCallbacks (with -pofx option)
• add dumping of PpmPlatformStates (with -ppm option)
• add dumping callbacks registered with RtlRegisterFeatureConfigurationChangeNotification function 

kernel resource FUNCTIONEXTENTLIST

I commited today plugin for processing 64bit kernel resource with name "FUNCTIONEXTENTLIST" (located in RCDATA)

It seems that processing of this resource happens in huge unnamed sub called from famous KiFilterFiberContext, so this is apparently part of PatchGuard. Format of this resource relative simple.
At start we have signature CTXE for compressed data (LTXE for noncompressed but I have never seen this). Data unpacking with RtlDecompressBufferEx function. In packed data we have table with pair offsets, first to RUNTIME_FUNCTION recognised from IDA and second to some additional RUNTIME_FUNCTION (which usually skipped in IDA Pro for unknown reason)

And even after calling this plugin there are lots of some valid RUNTIME_FUNCTION in .pdata section - I don`t know why

there will be no more new versions of wincheck

bcs all source code belongs to my former employer
I do not have time and motivation to rewrite it for free
Sorry