{"id":32643966,"url":"https://github.com/x0reaxeax/rtschecker","last_synced_at":"2026-04-16T18:37:55.321Z","repository":{"id":319414776,"uuid":"1075471967","full_name":"x0reaxeax/RTSChecker","owner":"x0reaxeax","description":"EFI RTS Hook Detector (Windows Kernel Driver)","archived":false,"fork":false,"pushed_at":"2025-10-13T23:18:49.000Z","size":419,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-19T03:14:01.504Z","etag":null,"topics":["detection","efi","hooks","kernel-driver","malware-research","poc","undocumented","windows","windows-kernel","windows-x64"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/x0reaxeax.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-13T14:46:18.000Z","updated_at":"2025-10-13T23:22:15.000Z","dependencies_parsed_at":"2025-10-19T03:14:05.234Z","dependency_job_id":"dfe5c6bc-017a-466c-a203-38b55baeb4ea","html_url":"https://github.com/x0reaxeax/RTSChecker","commit_stats":null,"previous_names":["x0reaxeax/rtschecker"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/x0reaxeax/RTSChecker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/x0reaxeax%2FRTSChecker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/x0reaxeax%2FRTSChecker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/x0reaxeax%2FRTSChecker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/x0reaxeax%2FRTSChecker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/x0reaxeax","download_url":"https://codeload.github.com/x0reaxeax/RTSChecker/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/x0reaxeax%2FRTSChecker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":281925779,"owners_count":26584821,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-31T02:00:07.401Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["detection","efi","hooks","kernel-driver","malware-research","poc","undocumented","windows","windows-kernel","windows-x64"],"created_at":"2025-10-31T03:58:27.885Z","updated_at":"2025-10-31T03:59:40.708Z","avatar_url":"https://github.com/x0reaxeax.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RTSChecker - PoC Windows Kernel Driver for detecting simple hooks on EFI Runtime Services\n\n## How it works\n\n### Resolving pointers\nThe driver resolves a pointer to an undocumented table `HalEfiRuntimeServicesTable`, which holds vaddr64 pointers to EFI Runtime Services.  \nThis table is consistently (across multiple versions) loaded from `nt!HalEfiSetEnvironmentVariable` function in latest Windows versions (tested up to W11 24H2).  \nPreviously, these functions were not present in `NTOSKRNL.EXE`, but instead mapped from HAL thunks (`HAL.DLL`) (I haven't looked much into this.)  \nFor such old NTOSKRNL versions, this driver won't work (see [Tested NTOSKRNL versions](#tested-ntoskrnl-versions) for more info).  \nMore on this below.  \n\nNote: All disassembly + references are specific to `NTOSKRNL.EXE` v10.0.19041.5007 (Win10 22H2).\n\n### `HalEfiRuntimeServicesTable` layout\nThe `HalEfiRuntimeServicesTable` table differs from the UEFI-spec layout, which Windows internally defines like this:\n```c\n00000000 struct _VIRTUAL_EFI_RUNTIME_SERVICES // sizeof=0x70\n00000000 {                                       // XREF: _KSR_FIRMWARE_INFORMATION/r\n00000000     unsigned __int64 GetTime;\n00000008     unsigned __int64 SetTime;\n00000010     unsigned __int64 GetWakeupTime;\n00000018     unsigned __int64 SetWakeupTime;\n00000020     unsigned __int64 SetVirtualAddressMap;\n00000028     unsigned __int64 ConvertPointer;\n00000030     unsigned __int64 GetVariable;\n00000038     unsigned __int64 GetNextVariableName;\n00000040     unsigned __int64 SetVariable;\n00000048     unsigned __int64 GetNextHighMonotonicCount;\n00000050     unsigned __int64 ResetSystem;\n00000058     unsigned __int64 UpdateCapsule;\n00000060     unsigned __int64 QueryCapsuleCapabilities;\n00000068     unsigned __int64 QueryVariableInfo;\n00000070 };\n```\nThis UEFI-spec compatible table comes from `struct _EFI_FIRMWARE_INFORMATION`.  \nThe `HalEfiRuntimeServicesTable` is basically another undocumented and stripped-down version of this table, and instead looks like this:\n```c\n/**\n* Windows uses internal implementations in place of some EFI RTS functions.\n* Example:\n*   Get/SetWakeupTime are using internal implementation `HalpAcpiPmRegisterWrite` -\n*   The firmware implementations remain in physical memory, close to `(PHYSMEM) SetTime()`.\n*/\ntypedef struct _HAL_EFI_RUNTIME_SERVICES_TABLE {\n    LPVOID GetTime;                   // 0x00\n    LPVOID SetTime;                   // 0x08\n    LPVOID ResetSystem;               // 0x10\n    LPVOID GetVariable;               // 0x18\n    LPVOID GetNextVariableName;       // 0x20\n    LPVOID SetVariable;               // 0x28\n    LPVOID UpdateCapsule;             // 0x30\n    LPVOID QueryCapsuleCapabilities;  // 0x38\n    LPVOID QueryVariableInfo;         // 0x40\n} HAL_EFI_RUNTIME_SERVICES_TABLE, *PHAL_EFI_RUNTIME_SERVICES_TABLE;\n```\nI couldn't find any type references to this table in IDA or in general, therefore this structure is built upon a direct phys64 pointer comparison with dumped `EFI_RUNTIME_SERVICES` addresses from a UEFI application.  \n\u003cb\u003eEDIT:\u003c/b\u003e  \n\u003ci\u003eOf course, I found this article after doing manual comparison, super cool stuff, check it out - [Experiment in extracting runtime drivers on Windows](https://standa-note.blogspot.com/2020/12/experiment-in-extracting-runtime.html)  \nThis article also talks about resolving this pointer via a call to `HalQuerySystemInformation`, however, as stated in the article - \"`HalEfiRuntimeServicesBlock` can be found with `HalQuerySystemInformation()` up until only 19H2.\"\u003c/i\u003e  \n  \nA pointer to this table can be resolved in various ways, however in this driver, this project opts for grabbing the offset from a function called `HalEfiSetEnvironmentVariable()`, which seems to be a reliable way for grabbing this reference.  \nThe only problem is that the function `HalEfiSetEnvironmentVariable()` is not exported, and therefore can't be retrieved via `MmGetSystemRoutineAddress()` function.  \nHowever, the wrapper function `HalSetEnvironmentVariableEx()` - which internally calls `HalEfiSetEnvironmentVariable()`, seems to be consistently exported across new NTOSKRNL versions.  \n  \nIn order to locate this `CALL`, a unique (one match per whole image) binary pattern / signature is used to search in a modest range, starting from `HalSetEnvironmentVariableEx+0x0`.  \n\n```asm\n; Disassembly of NTOSKRNL.EXE - 10.0.19041.6328\n;\nHalSetEnvironmentVariableEx+11D  4D 8B CF                  mov     r9, r15\nHalSetEnvironmentVariableEx+120  4C 89 6C 24 20            mov     [rsp+0A0h+var_80], r13\nHalSetEnvironmentVariableEx+125  44 8B C7                  mov     r8d, edi\nHalSetEnvironmentVariableEx+128  49 8B D4                  mov     rdx, r12\nHalSetEnvironmentVariableEx+12B  49 8B CE                  mov     rcx, r14\nHalSetEnvironmentVariableEx+12E  E8 55 00 00 00            call    HalEfiSetEnvironmentVariable ; ─────────────────────────┐\n                                                                                                ;                          │\nHalEfiSetEnvironmentVariable     HalEfiSetEnvironmentVariable proc near  ; CODE XREF: HalSetEnvironmentVariableEx+111↑p \u003c──┘\nHalEfiSetEnvironmentVariable                                             ; HalSetEnvironmentVariableEx+12E↑p\nHalEfiSetEnvironmentVariable     40 53                     push    rbx\nHalEfiSetEnvironmentVariable+2   48 83 EC 30               sub     rsp, 30h\nHalEfiSetEnvironmentVariable+6   48 8B 05 BB D8 DB 00      mov     rax, cs:HalEfiRuntimeServicesTable ; \u003c- PHAL_EFI_RUNTIME_SERVICES_TABLE\n```\n\nFrom the resolved pointer to `HalEfiRuntimeServicesTable`, the code starts analyzing physaddr32 pointers for hooks.  \n\nNote: See [Another juicy reference](#another-juicy-reference) for an additional interesting reference to `HalEfiRuntimeServicesTable`.  \n\n### Hook analysis\n#### 1. Offset/distance checks\nThe hook analysis relies on a dumb approach of having a known ~~trusted~~ baseline physical address, around which the EFI RTS are supposed to be located in memory.  \nIf the option `RTS_MSB_FROM_TRUSTED_BASELINE` in [RiskScore.c](https://github.com/x0reaxeax/RTSChecker/tree/master/RiskScore.c) is set to `0` (default), a selected EFI RuntimeService physaddr32 pointer will be used for this baseline address.  \nIf the option is set to `1`, this baseline address is instead retrieved from `RTS_TRUSTED_BASELINE_ADDR`, which can be specified by the user.  \nCurrently, I have no sane click-to-load-and-ready way of resolving the address of `gRT`, so the code is limited to this demented approach, until I find something sane.  \nThis baseline address is used for offset/distance checks across the EFI RTS pointers.  \n#### 2. Inline hook detection\nZydis-backed detection for presence of simple inline hooks at the very beginning of the RTS functions' prologues.  \n\nBased on a combined analysis, a \"risk score\" is calculated.  \n\n## Limitations and bypasses\nSwapping `gRT` pointer = bypass  \nInline hook after function prologue = bypass  \nAll EFI RTS pointers hooked + no `RTS_TRUSTED_BASELINE_ADDR` set = bypass  \nA lot more, LOL  \n\n\n## Tested NTOSKRNL versions\n\n| Windows Version | NTOSKRNL Version                |\n|-----------------|---------------------------------|\n| Win11 24H2      | 10.0.26100.2605                 |\n| Win10 22H2      | 10.0.19045.5854 \u003cbr\u003e 10.0.19041.6328 \u003cbr\u003e 10.0.19041.2006 |\n\nShould work with any NTOSKRNL version starting from `(\u003e=) 10.0.18936.1000` (based on binary pattern search).  \nThe latest NTOSKRNL version I could get my hands on was from Win11 25H2 - `10.0.26100.6584`, with confirmed match from binary pattern search.  \n\nSignature for `HallEfiSetEnvironentVariableSignature` found/verified in following NTOSKRNL.EXE versions:\n\u003cdetails\u003e\n  \u003csummary\u003eMatching Version List (click to expand)\u003c/summary\u003e\n  \n  | NTOSKRNL Version             |\n  |----------------------------  |\n  | 10.0.26100.6584 (Win11 25H2) |\n  | 10.0.26100.2605  |\n  | 10.0.22621.2861  |\n  | 10.0.22621.2506  |\n  | 10.0.22621.2428  |\n  | 10.0.22621.2283  |\n  | 10.0.22621.1848  |\n  | 10.0.22000.978   |\n  | 10.0.19041.6328  |\n  | 10.0.19045.5854  |\n  | 10.0.19041.3030  |\n  | 10.0.19041.2006  |\n  | 10.0.19631.1     |\n  | 10.0.18980.1     |\n  | 10.0.18965.1005  |\n  | 10.0.18950.1000  |\n  | 10.0.18936.1000  |\n     \n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003eYARA binary pattern rule (click to expand)\u003c/summary\u003e\n\n```yara\nrule CALL_HalEfiSetEnvironmentVariable_Universal {\n    strings:\n        $sig1 = {\n            4D 8B CF\n            4C 89 6C 24 20\n            44 8B C7\n            49 8B D4\n            49 8B CE\n            E8\n        }\n    condition:\n        ($sig1)\n}\n```\n\n\u003c/details\u003e\n\n\n## Tests\n### Test with no hooks\n```\n[RTSChecker] DriverEntry called\n[RTSChecker] HalSetEnvironmentVariableEx address: 0xFFFFF8045B2BC8B0\n[RTSChecker] Signature for call to HalSetEnvironmentVariableEx found at 0xFFFFF8045B2BC9E5\n[RTSChecker] Call to HalSetEnvironmentVariableEx located at 0xFFFFF8045B2BC9F6\n[RTSChecker] Relative address offset: 0x00007D3D\n[RTSChecker] HalEfiSetEnvironmentVariable address: 0xFFFFF8045B2C4739\n[RTSChecker] HAL_EFI_RUNTIME_SERVICES_TABLE located at 0xFFFFF8045BC01870\n[RTSChecker] RTS Addresses:\n  * GetTime................... @ 0xFFFFF8045FA06191  [PHYS: 0x0FB74191]\n  * SetTime................... @ 0xFFFFF8045FA061A7  [PHYS: 0x0FB741A7]\n  * ResetSystem............... @ 0xFFFFF8045FA14163  [PHYS: 0x0FB82163]\n  * GetVariable............... @ 0xFFFFF8045FA0D175  [PHYS: 0x0FB7B175]\n  * GetNextVariableName....... @ 0xFFFFF8045FA0D1AF  [PHYS: 0x0FB7B1AF]\n  * SetVariable............... @ 0xFFFFF8045FA0D28A  [PHYS: 0x0FB7B28A]\n  * UpdateCapsule............. @ 0xFFFFF8045FA111EB  [PHYS: 0x0FB7F1EB]\n  * QueryCapsuleCapabilities.. @ 0xFFFFF8045FA11297  [PHYS: 0x0FB7F297]\n  * QueryVariableInfo......... @ 0xFFFFF8045FA0D21D  [PHYS: 0x0FB7B21D]\n[RTSChecker] Analyzing RTS addresses for risk score...\n[RTSChecker] MSB Trusted Baseline: 0x0f000000 -\u003e MSB=0x0F SecondHighNibble=0x0\n[RTSChecker] Majority nibble baseline (addresses): 0xB\n[RTSChecker] RTS address analysis (count = 9)\n * [00] Addr=0x0fb74191 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B74191 -\u003e risk=0 \n * [00] Checking for inline hooks at [V] 0xFFFFF8045FA06191...\n * [00] No inline hooks detected at [V] 0xFFFFF8045FA06191 [OK]\n * [**] * * *\n * [01] Addr=0x0fb741a7 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B741A7 -\u003e risk=0 \n * [01] Checking for inline hooks at [V] 0xFFFFF8045FA061A7...\n * [01] No inline hooks detected at [V] 0xFFFFF8045FA061A7 [OK]\n * [**] * * *\n * [02] Addr=0x0fb82163 Top12=0xFB8 MSB=0x0F Second=0xB8 HighNibble=0xB GapFromTrusted=0x00B82163 -\u003e risk=0 \n * [02] Checking for inline hooks at [V] 0xFFFFF8045FA14163...\n * [02] No inline hooks detected at [V] 0xFFFFF8045FA14163 [OK]\n * [**] * * *\n * [03] Addr=0x0fb7b175 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B175 -\u003e risk=0 \n * [03] Checking for inline hooks at [V] 0xFFFFF8045FA0D175...\n * [03] No inline hooks detected at [V] 0xFFFFF8045FA0D175 [OK]\n * [**] * * *\n * [04] Addr=0x0fb7b1af Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B1AF -\u003e risk=0 \n * [04] Checking for inline hooks at [V] 0xFFFFF8045FA0D1AF...\n * [04] No inline hooks detected at [V] 0xFFFFF8045FA0D1AF [OK]\n * [**] * * *\n * [05] Addr=0x0fb7b28a Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B28A -\u003e risk=0 \n * [05] Checking for inline hooks at [V] 0xFFFFF8045FA0D28A...\n * [05] No inline hooks detected at [V] 0xFFFFF8045FA0D28A [OK]\n * [**] * * *\n * [06] Addr=0x0fb7f1eb Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7F1EB -\u003e risk=0 \n * [06] Checking for inline hooks at [V] 0xFFFFF8045FA111EB...\n * [06] No inline hooks detected at [V] 0xFFFFF8045FA111EB [OK]\n * [**] * * *\n * [07] Addr=0x0fb7f297 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7F297 -\u003e risk=0 \n * [07] Checking for inline hooks at [V] 0xFFFFF8045FA11297...\n * [07] No inline hooks detected at [V] 0xFFFFF8045FA11297 [OK]\n * [**] * * *\n * [08] Addr=0x0fb7b21d Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B21D -\u003e risk=0 \n * [08] Checking for inline hooks at [V] 0xFFFFF8045FA0D21D...\n * [08] No inline hooks detected at [V] 0xFFFFF8045FA0D21D [OK]\n * [**] * * *\n[RTSChecker] Majority: MSB=0x0F MajorityNibble=0xB\n[RTSChecker] Mismatches aggregated.....[OK]\n[RTSChecker] Inline hooks analyzed.....[OK]\n[RTSChecker]  -\u003e total_risk=   0       [OK]\n[RTSChecker] RTS address analysis completed, no issues found.\n```\n\n### Test with single pointerswap hook\n```\n[RTSChecker] DriverEntry called\n[RTSChecker] HalSetEnvironmentVariableEx address: 0xFFFFF8045B2BC8B0\n[RTSChecker] Signature for call to HalSetEnvironmentVariableEx found at 0xFFFFF8045B2BC9E5\n[RTSChecker] Call to HalSetEnvironmentVariableEx located at 0xFFFFF8045B2BC9F6\n[RTSChecker] Relative address offset: 0x00007D3D\n[RTSChecker] HalEfiSetEnvironmentVariable address: 0xFFFFF8045B2C4739\n[RTSChecker] HAL_EFI_RUNTIME_SERVICES_TABLE located at 0xFFFFF8045BC01870\n[RTSChecker] RTS Addresses:\n  * GetTime................... @ 0xFFFFF8045FA06191  [PHYS: 0x0FB74191]\n  * SetTime................... @ 0xFFFFF8045FA061A7  [PHYS: 0x0FB741A7]\n  * ResetSystem............... @ 0xFFFFF8045FA14163  [PHYS: 0x0FB82163]\n  * GetVariable............... @ 0xFFFFF8045FA0D175  [PHYS: 0x0FB7B175]\n  * GetNextVariableName....... @ 0xFFFFF8045FA0D1AF  [PHYS: 0x0FB7B1AF]\n  * SetVariable............... @ 0xFFFFF8045FA0D28A  [PHYS: 0x0FB7B28A]\n  * UpdateCapsule............. @ 0xFFFFF8045B212D4A  [PHYS: 0x02C12D4A]\n  * QueryCapsuleCapabilities.. @ 0xFFFFF8045FA11297  [PHYS: 0x0FB7F297]\n  * QueryVariableInfo......... @ 0xFFFFF8045FA0D21D  [PHYS: 0x0FB7B21D]\n[RTSChecker] Analyzing RTS addresses for risk score...\n[RTSChecker] MSB Trusted Baseline: 0x0f000000 -\u003e MSB=0x0F SecondHighNibble=0x0\n[RTSChecker] Majority nibble baseline (addresses): 0xB\n[RTSChecker] RTS address analysis (count = 9)\n * [00] Addr=0x0fb74191 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B74191 -\u003e risk=0 \n * [00] Checking for inline hooks at [V] 0xFFFFF8045FA06191...\n * [00] No inline hooks detected at [V] 0xFFFFF8045FA06191 [OK]\n * [**] * * *\n * [01] Addr=0x0fb741a7 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B741A7 -\u003e risk=0 \n * [01] Checking for inline hooks at [V] 0xFFFFF8045FA061A7...\n * [01] No inline hooks detected at [V] 0xFFFFF8045FA061A7 [OK]\n * [**] * * *\n * [02] Addr=0x0fb82163 Top12=0xFB8 MSB=0x0F Second=0xB8 HighNibble=0xB GapFromTrusted=0x00B82163 -\u003e risk=0 \n * [02] Checking for inline hooks at [V] 0xFFFFF8045FA14163...\n * [02] No inline hooks detected at [V] 0xFFFFF8045FA14163 [OK]\n * [**] * * *\n * [03] Addr=0x0fb7b175 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B175 -\u003e risk=0 \n * [03] Checking for inline hooks at [V] 0xFFFFF8045FA0D175...\n * [03] No inline hooks detected at [V] 0xFFFFF8045FA0D175 [OK]\n * [**] * * *\n * [04] Addr=0x0fb7b1af Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B1AF -\u003e risk=0 \n * [04] Checking for inline hooks at [V] 0xFFFFF8045FA0D1AF...\n * [04] No inline hooks detected at [V] 0xFFFFF8045FA0D1AF [OK]\n * [**] * * *\n * [05] Addr=0x0fb7b28a Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B28A -\u003e risk=0 \n * [05] Checking for inline hooks at [V] 0xFFFFF8045FA0D28A...\n * [05] No inline hooks detected at [V] 0xFFFFF8045FA0D28A [OK]\n * [**] * * *\n * [06] Addr=0x02c12d4a Top12=0x2C1 MSB=0x02 Second=0xC1 HighNibble=0xC GapFromTrusted=0x0C3ED2B6 -\u003e risk=65 [HOOK DETECTED]\n * [06] Checking for inline hooks at [V] 0xFFFFF8045B212D4A...\n * [06] No inline hooks detected at [V] 0xFFFFF8045B212D4A [OK]\n * [**] * * *\n * [07] Addr=0x0fb7f297 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7F297 -\u003e risk=0 \n * [07] Checking for inline hooks at [V] 0xFFFFF8045FA11297...\n * [07] No inline hooks detected at [V] 0xFFFFF8045FA11297 [OK]\n * [**] * * *\n * [08] Addr=0x0fb7b21d Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B21D -\u003e risk=0 \n * [08] Checking for inline hooks at [V] 0xFFFFF8045FA0D21D...\n * [08] No inline hooks detected at [V] 0xFFFFF8045FA0D21D [OK]\n * [**] * * *\n[RTSChecker] Majority: MSB=0x0F MajorityNibble=0xB\n[RTSChecker] Mismatches aggregated.....[OK]\n[RTSChecker] Inline hooks analyzed.....[OK]\n[RTSChecker]  -\u003e total_risk=  65       [WARNING: HOOK DETECTED]\n[RTSChecker] RTS address analysis completed, RISK SCORE: 65\n```\n\n### Test with inline hook\n```\n[RTSChecker] DriverEntry called\n[RTSChecker] HalSetEnvironmentVariableEx address: 0xFFFFF8045B2BC8B0\n[RTSChecker] Signature for call to HalSetEnvironmentVariableEx found at 0xFFFFF8045B2BC9E5\n[RTSChecker] Call to HalSetEnvironmentVariableEx located at 0xFFFFF8045B2BC9F6\n[RTSChecker] Relative address offset: 0x00007D3D\n[RTSChecker] HalEfiSetEnvironmentVariable address: 0xFFFFF8045B2C4739\n[RTSChecker] HAL_EFI_RUNTIME_SERVICES_TABLE located at 0xFFFFF8045BC01870\n[RTSChecker] RTS Addresses:\n  * GetTime................... @ 0xFFFFF8045FA06191  [PHYS: 0x0FB74191]\n  * SetTime................... @ 0xFFFFF8045FA061A7  [PHYS: 0x0FB741A7]\n  * ResetSystem............... @ 0xFFFFF8045FA14163  [PHYS: 0x0FB82163]\n  * GetVariable............... @ 0xFFFFF8045FA0D175  [PHYS: 0x0FB7B175]\n  * GetNextVariableName....... @ 0xFFFFF8045FA0D1AF  [PHYS: 0x0FB7B1AF]\n  * SetVariable............... @ 0xFFFFF8045FA0D28A  [PHYS: 0x0FB7B28A]\n  * UpdateCapsule............. @ 0xFFFFF8045FA111EB  [PHYS: 0x0FB7F1EB]\n  * QueryCapsuleCapabilities.. @ 0xFFFFF8045FA11297  [PHYS: 0x0FB7F297]\n  * QueryVariableInfo......... @ 0xFFFFF8045FA0D21D  [PHYS: 0x0FB7B21D]\n[RTSChecker] Analyzing RTS addresses for risk score...\n[RTSChecker] MSB Trusted Baseline: 0x0f000000 -\u003e MSB=0x0F SecondHighNibble=0x0\n[RTSChecker] Majority nibble baseline (addresses): 0xB\n[RTSChecker] RTS address analysis (count = 9)\n * [00] Addr=0x0fb74191 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B74191 -\u003e risk=0 \n * [00] Checking for inline hooks at [V] 0xFFFFF8045FA06191...\n * [00] No inline hooks detected at [V] 0xFFFFF8045FA06191 [OK]\n * [**] * * *\n * [01] Addr=0x0fb741a7 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B741A7 -\u003e risk=0 \n * [01] Checking for inline hooks at [V] 0xFFFFF8045FA061A7...\n * [01] No inline hooks detected at [V] 0xFFFFF8045FA061A7 [OK]\n * [**] * * *\n * [02] Addr=0x0fb82163 Top12=0xFB8 MSB=0x0F Second=0xB8 HighNibble=0xB GapFromTrusted=0x00B82163 -\u003e risk=0 \n * [02] Checking for inline hooks at [V] 0xFFFFF8045FA14163...\n * [02] MOV/LEA + JMP reg trampoline found at 0xFFFFF8045FA14163 ('lea rax, [0xFFFFF8045FA1417E]' + 'jmp rax')\n * [02] Inline hook detected at [V] 0xFFFFF8045FA14163 -\u003e risk +55 [CRITICAL]\n * [**] * * *\n * [03] Addr=0x0fb7b175 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B175 -\u003e risk=0 \n * [03] Checking for inline hooks at [V] 0xFFFFF8045FA0D175...\n * [03] No inline hooks detected at [V] 0xFFFFF8045FA0D175 [OK]\n * [**] * * *\n * [04] Addr=0x0fb7b1af Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B1AF -\u003e risk=0 \n * [04] Checking for inline hooks at [V] 0xFFFFF8045FA0D1AF...\n * [04] No inline hooks detected at [V] 0xFFFFF8045FA0D1AF [OK]\n * [**] * * *\n * [05] Addr=0x0fb7b28a Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B28A -\u003e risk=0 \n * [05] Checking for inline hooks at [V] 0xFFFFF8045FA0D28A...\n * [05] No inline hooks detected at [V] 0xFFFFF8045FA0D28A [OK]\n * [**] * * *\n * [06] Addr=0x0fb7f1eb Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7F1EB -\u003e risk=0 \n * [06] Checking for inline hooks at [V] 0xFFFFF8045FA111EB...\n * [06] No inline hooks detected at [V] 0xFFFFF8045FA111EB [OK]\n * [**] * * *\n * [07] Addr=0x0fb7f297 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7F297 -\u003e risk=0 \n * [07] Checking for inline hooks at [V] 0xFFFFF8045FA11297...\n * [07] No inline hooks detected at [V] 0xFFFFF8045FA11297 [OK]\n * [**] * * *\n * [08] Addr=0x0fb7b21d Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B21D -\u003e risk=0 \n * [08] Checking for inline hooks at [V] 0xFFFFF8045FA0D21D...\n * [08] No inline hooks detected at [V] 0xFFFFF8045FA0D21D [OK]\n * [**] * * *\n[RTSChecker] Majority: MSB=0x0F MajorityNibble=0xB\n[RTSChecker] Mismatches aggregated.....[OK]\n[RTSChecker] Inline hooks analyzed.....[OK]\n[RTSChecker]  -\u003e total_risk=  55       [WARNING: HOOK DETECTED]\n[RTSChecker] RTS address analysis completed, RISK SCORE: 55\n```\n\n### Test with multiple hooks (combined)\n```\n[RTSChecker] DriverEntry called\n[RTSChecker] HalSetEnvironmentVariableEx address: 0xFFFFF8045B2BC8B0\n[RTSChecker] Signature for call to HalSetEnvironmentVariableEx found at 0xFFFFF8045B2BC9E5\n[RTSChecker] Call to HalSetEnvironmentVariableEx located at 0xFFFFF8045B2BC9F6\n[RTSChecker] Relative address offset: 0x00007D3D\n[RTSChecker] HalEfiSetEnvironmentVariable address: 0xFFFFF8045B2C4739\n[RTSChecker] HAL_EFI_RUNTIME_SERVICES_TABLE located at 0xFFFFF8045BC01870\n[RTSChecker] RTS Addresses:\n  * GetTime................... @ 0xFFFFF8045FA06191  [PHYS: 0x0FB74191]\n  * SetTime................... @ 0xFFFFF8045FA061A7  [PHYS: 0x0FB741A7]\n  * ResetSystem............... @ 0xFFFFF8045FA14163  [PHYS: 0x0FB82163]\n  * GetVariable............... @ 0xFFFFF8045FA0D175  [PHYS: 0x0FB7B175]\n  * GetNextVariableName....... @ 0xFFFFF8045FA0D1AF  [PHYS: 0x0FB7B1AF]\n  * SetVariable............... @ 0xFFFFF8045FA0D28A  [PHYS: 0x0FB7B28A]\n  * UpdateCapsule............. @ 0xFFFFF8045B212D4A  [PHYS: 0x02C12D4A]\n  * QueryCapsuleCapabilities.. @ 0xFFFFF8045FA11297  [PHYS: 0x0FB7F297]\n  * QueryVariableInfo......... @ 0xFFFFF8045FA0D21D  [PHYS: 0x0FB7B21D]\n[RTSChecker] Analyzing RTS addresses for risk score...\n[RTSChecker] MSB Trusted Baseline: 0x0f000000 -\u003e MSB=0x0F SecondHighNibble=0x0\n[RTSChecker] Majority nibble baseline (addresses): 0xB\n[RTSChecker] RTS address analysis (count = 9)\n * [00] Addr=0x0fb74191 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B74191 -\u003e risk=0 \n * [00] Checking for inline hooks at [V] 0xFFFFF8045FA06191...\n * [00] No inline hooks detected at [V] 0xFFFFF8045FA06191 [OK]\n * [**] * * *\n * [01] Addr=0x0fb741a7 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B741A7 -\u003e risk=0 \n * [01] Checking for inline hooks at [V] 0xFFFFF8045FA061A7...\n * [01] No inline hooks detected at [V] 0xFFFFF8045FA061A7 [OK]\n * [**] * * *\n * [02] Addr=0x0fb82163 Top12=0xFB8 MSB=0x0F Second=0xB8 HighNibble=0xB GapFromTrusted=0x00B82163 -\u003e risk=0 \n * [02] Checking for inline hooks at [V] 0xFFFFF8045FA14163...\n * [02] CALL found at 0xFFFFF8045FA14163 ('call 0xFFFFF8043E4F0052' | len=5)\n * [02] Inline hook detected at [V] 0xFFFFF8045FA14163 -\u003e risk +55 [CRITICAL]\n * [**] * * *\n * [03] Addr=0x0fb7b175 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B175 -\u003e risk=0 \n * [03] Checking for inline hooks at [V] 0xFFFFF8045FA0D175...\n * [03] No inline hooks detected at [V] 0xFFFFF8045FA0D175 [OK]\n * [**] * * *\n * [04] Addr=0x0fb7b1af Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B1AF -\u003e risk=0 \n * [04] Checking for inline hooks at [V] 0xFFFFF8045FA0D1AF...\n * [04] No inline hooks detected at [V] 0xFFFFF8045FA0D1AF [OK]\n * [**] * * *\n * [05] Addr=0x0fb7b28a Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B28A -\u003e risk=0 \n * [05] Checking for inline hooks at [V] 0xFFFFF8045FA0D28A...\n * [05] No inline hooks detected at [V] 0xFFFFF8045FA0D28A [OK]\n * [**] * * *\n * [06] Addr=0x02c12d4a Top12=0x2C1 MSB=0x02 Second=0xC1 HighNibble=0xC GapFromTrusted=0x0C3ED2B6 -\u003e risk=65 [HOOK DETECTED]\n * [06] Checking for inline hooks at [V] 0xFFFFF8045B212D4A...\n * [06] No inline hooks detected at [V] 0xFFFFF8045B212D4A [OK]\n * [**] * * *\n * [07] Addr=0x0fb7f297 Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7F297 -\u003e risk=0 \n * [07] Checking for inline hooks at [V] 0xFFFFF8045FA11297...\n * [07] No inline hooks detected at [V] 0xFFFFF8045FA11297 [OK]\n * [**] * * *\n * [08] Addr=0x0fb7b21d Top12=0xFB7 MSB=0x0F Second=0xB7 HighNibble=0xB GapFromTrusted=0x00B7B21D -\u003e risk=0 \n * [08] Checking for inline hooks at [V] 0xFFFFF8045FA0D21D...\n * [08] No inline hooks detected at [V] 0xFFFFF8045FA0D21D [OK]\n * [**] * * *\n[RTSChecker] Majority: MSB=0x0F MajorityNibble=0xB\n[RTSChecker] Mismatches aggregated.....[OK]\n[RTSChecker] Inline hooks analyzed.....[OK]\n[RTSChecker]  -\u003e total_risk= 120       [CRITICAL: MULTIPLE HOOKS DETECTED]\n[RTSChecker] RTS address analysis completed, RISK SCORE: 120\n```\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003ch2\u003eExtra stuff for read\u003c/h2\u003e\u003c/summary\u003e\n\n### Another juicy reference\nLooking at xrefs for `HalEfiRuntimeServicesBlock`, the following function pops up:\n```c\nNTSTATUS HalInitializeOnResume(\n    PMDL  FirmwareRuntimeInformationMdl,\n    PVOID FirmwareRuntimeInformationVa     // (mapped VA)\n);\n```\nThe reason for initially choosing to look into this function is the fact that it can be relatively easily resolved via `MmGetSystemRoutineAddress`, although not directly.  \nThe actual export is a function called `HalInitializeOnResume()`, which due to being just a small wrapper, can be easily walked to resolve `HalInitializeOnResume()` address.\n```asm\nHalInitializeOnResume                                                   ; __int64 __fastcall HalInitializeOnResume(PMDL FirmwareRuntimeInformationMdl, PVOID FirmwareRuntimeInformationVa)\nHalInitializeOnResume                                                                   public HalInitializeOnResume\nHalInitializeOnResume                                                   HalInitializeOnResume proc near         ; CODE XREF: PopHiberCheckResume+109↓p\nHalInitializeOnResume                                                                                           ; DATA XREF: .pdata:00000000000DCFA8↑o\nHalInitializeOnResume      48 83 EC 28                                                  sub     rsp, 28h        ; Integer Subtraction\nHalInitializeOnResume+4    33 C0                                                        xor     eax, eax        ; Logical Exclusive OR\nHalInitializeOnResume+6    38 05 4C D1 8B 00                                            cmp     byte ptr cs:HalpIommuDeviceCreatedList.ArcWindowsSysPartName, al ; Compare Two Operands\nHalInitializeOnResume+C    75 06                                                        jnz     short loc_38CD44 ; Jump if Not Zero (ZF=0)\nHalInitializeOnResume+E\nHalInitializeOnResume+E                                                 loc_38CD3E:                             ; CODE XREF: HalInitializeOnResume+19↓j\nHalInitializeOnResume+E    48 83 C4 28                                                  add     rsp, 28h        ; Add\nHalInitializeOnResume+12   C3                                                           retn                    ; Return Near from Procedure\nHalInitializeOnResume+12                                                ; ---------------------------------------------------------------------------\nHalInitializeOnResume+13   CC                                                           align 4\nHalInitializeOnResume+14\nHalInitializeOnResume+14                                                loc_38CD44:                             ; CODE XREF: HalInitializeOnResume+C↑j\nHalInitializeOnResume+14   E8 8B 83 13 00                                               call    HalpEfiInitializeOnResume ; Call Procedure\nHalInitializeOnResume+19   EB F3                                                        jmp     short loc_38CD3E ; Jump\nHalInitializeOnResume+19                                                HalInitializeOnResume endp\n```\nThe function prototype had to be manually fixed, since IDA doesn't see any parameter passing inside this wrapper.  \nBy looking at `HalpEfiInitializeOnResume()`, it is immediately clear that there are in fact 2 parameters passed and checked for:\n```asm\nHalpEfiInitializeOnResume                                                   HalpEfiInitializeOnResume proc near     ; CODE XREF: HalInitializeOnResume:loc_38CD44↑p\nHalpEfiInitializeOnResume                                                                                           ; DATA XREF: .pdata:00000000000F01CC↑o\nHalpEfiInitializeOnResume\nHalpEfiInitializeOnResume                                                   var_18          = qword ptr -18h\nHalpEfiInitializeOnResume\nHalpEfiInitializeOnResume      40 53                                                        push    rbx\nHalpEfiInitializeOnResume+2    48 83 EC 30                                                  sub     rsp, 30h        ; Integer Subtraction\nHalpEfiInitializeOnResume+6    48 8B DA                                                     mov     rbx, rdx\nHalpEfiInitializeOnResume+9    48 85 C9                                                     test    rcx, rcx        ; Logical Compare\nHalpEfiInitializeOnResume+C    0F 84 2E 01 00 00                                            jz      loc_4C5214      ; Jump if Zero (ZF=1)\nHalpEfiInitializeOnResume+12   48 85 D2                                                     test    rdx, rdx        ; Logical Compare\nHalpEfiInitializeOnResume+15   0F 84 25 01 00 00                                            jz      loc_4C5214      ; Jump if Zero (ZF=1)\nHalpEfiInitializeOnResume+1B   81 79 28 90 00 00 00                                         cmp     dword ptr [rcx+28h], 90h ; Compare Two Operands\n```\nThese come all the way from a function called `PopHiberCheckResume()`, and an undocumented structure `struct _POP_HIBER_CONTEXT` (this global structure unfortunately doesn't stay populated after use):\n```asm\nPopHiberCheckResume+40   48 8B 2D 09 7B 28 00                                         mov     rbp, cs:HiberContext\nPopHiberCheckResume+47   33 DB                                                        xor     ebx, ebx        ; Logical Exclusive OR\nPopHiberCheckResume+49   48 8B B5 C8 00 00 00                                         mov     rsi, [rbp+0C8h]\nPopHiberCheckResume+50   39 1E                                                        cmp     [rsi], ebx      ; Compare Two Operands\nPopHiberCheckResume+52   0F 84 93 01 00 00                                            jz      loc_99B91B      ; Jump if Zero (ZF=1)\n```\nAnd later passed to `HalInitializeOnResume()`, if a single condition (`if ( *(DWORD32*)([HiberContext+0xC8]) != 0 )`) is passed:\n```asm\nPopHiberCheckResume+FB   48 8B 95 E8 00 00 00                                         mov     rdx, [rbp+0E8h] ; lpRtsBlock\nPopHiberCheckResume+102  48 8B 8D E0 00 00 00                                         mov     rcx, [rbp+0E0h] ; a1\nPopHiberCheckResume+109  E8 F2 14 9F FF                                               call    HalInitializeOnResume ; Call Procedure\n```\nIf we check the definition of `HiberContext` structure and the offset `0xC8` -\n```c\nstruct PO_MEMORY_IMAGE* MemoryImage;                                    //0xc8\n```\nWe can see that this this reads `sizeof(DWORD32)` bytes from `struct PO_MEMORY_IMAGE* MemoryImage;`, i.e. the first `DWORD32` member, which is:\n```c\n//0x3e0 bytes (sizeof)\nstruct PO_MEMORY_IMAGE\n{\n    ULONG Signature;                                                        //0x0\n    //...\n}\n```\nIf the signature is `0`, HAL args are never setup, and the execution jumps to the function's epilogue.\n\nIt might be worth noting that a few checks are evaluated. These appear to be non-blocking if `KdDebugger` isn't present, otherwise, they can land on `INT3` breakpoints:\n1. Check for Hypervisor presence `(HvlHypervisorConnected)` -\u003e do HVL restore/config -\u003e rejoin and continue.`\n2. `KdDebuggerEnabled / KdEventLoggingEnabled / KdPitchDebugger` checks may clear/reinit KD -\u003e if KD still present + `BRKP` magic present -\u003e one `INT3` assert, then rejoin.\n3. `(PopSimulate \u0026 0x40000000)` -\u003e `INT3` -\u003e rejoin.\n\nThe `HiberContext` structure contains useful stuff, such as: \n```c\nstruct PO_MEMORY_IMAGE* MemoryImage;          //0xc8\nstruct _MDL* FirmwareRuntimeInformationMdl;   //0xe0\nVOID* FirmwareRuntimeInformationVa;           //0xe8 (PHAL_EFI_RUNTIME_SERVICES_TABLE)\n```\nThe `PO_MEMORY_IMAGE` structure contains yet even more juicy stuff:\n\u003cdetails\u003e\n  \u003csummary\u003e\u003ccode\u003estruct PO_MEMORY_IMAGE\u003c/code\u003e\u003c/summary\u003e\n\n```c\n//0x3e0 bytes (sizeof)\nstruct PO_MEMORY_IMAGE\n{\n    ULONG Signature;                                                        //0x0\n    ULONG ImageType;                                                        //0x4\n    ULONG CheckSum;                                                         //0x8\n    ULONG LengthSelf;                                                       //0xc\n    ULONGLONG PageSelf;                                                     //0x10\n    ULONG PageSize;                                                         //0x18\n    union _LARGE_INTEGER SystemTime;                                        //0x20\n    ULONGLONG InterruptTime;                                                //0x28\n    ULONGLONG FeatureFlags;                                                 //0x30\n    UCHAR HiberFlags;                                                       //0x38\n    UCHAR HiberSimulateFlags;                                               //0x39\n    UCHAR spare[2];                                                         //0x3a\n    ULONG NoHiberPtes;                                                      //0x3c\n    ULONGLONG HiberVa;                                                      //0x40\n    ULONG NoFreePages;                                                      //0x48\n    ULONG FreeMapCheck;                                                     //0x4c\n    ULONG WakeCheck;                                                        //0x50\n    ULONGLONG NumPagesForLoader;                                            //0x58\n    ULONGLONG FirstSecureRestorePage;                                       //0x60\n    ULONGLONG FirstBootRestorePage;                                         //0x68\n    ULONGLONG FirstKernelRestorePage;                                       //0x70\n    ULONGLONG FirstChecksumRestorePage;                                     //0x78\n    ULONGLONG NoChecksumEntries;                                            //0x80\n    struct _PO_HIBER_PERF PerfInfo;                                         //0x88\n    ULONG FirmwareRuntimeInformationPages;                                  //0x280\n    ULONGLONG FirmwareRuntimeInformation[1];                                //0x288\n    ULONG SpareUlong;                                                       //0x290\n    ULONG NoBootLoaderLogPages;                                             //0x294\n    ULONGLONG BootLoaderLogPages[24];                                       //0x298\n    ULONG NotUsed;                                                          //0x358\n    ULONG ResumeContextCheck;                                               //0x35c\n    ULONG ResumeContextPages;                                               //0x360\n    UCHAR Hiberboot;                                                        //0x364\n    UCHAR SecureLaunched;                                                   //0x365\n    UCHAR SecureBoot;                                                       //0x366\n    ULONGLONG HvPageTableRoot;                                              //0x368\n    ULONGLONG HvEntryPoint;                                                 //0x370\n    ULONGLONG HvReservedTransitionAddress;                                  //0x378\n    ULONGLONG HvReservedTransitionAddressSize;                              //0x380\n    ULONGLONG BootFlags;                                                    //0x388\n    ULONGLONG RestoreProcessorStateRoutine;                                 //0x390\n    ULONGLONG HighestPhysicalPage;                                          //0x398\n    ULONGLONG BitlockerKeyPfns[4];                                          //0x3a0\n    ULONG HardwareSignature;                                                //0x3c0\n    union _LARGE_INTEGER SMBiosTablePhysicalAddress;                        //0x3c8\n    ULONG SMBiosTableLength;                                                //0x3d0\n    UCHAR SMBiosMajorVersion;                                               //0x3d4\n    UCHAR SMBiosMinorVersion;                                               //0x3d5\n    UCHAR HiberResumeXhciHandoffSkip;                                       //0x3d6\n    UCHAR InitializeUSBCore;                                                //0x3d7\n    UCHAR ValidUSBCoreId;                                                   //0x3d8\n    UCHAR USBCoreId;                                                        //0x3d9\n    UCHAR SkipMemoryMapValidation;                                          //0x3da\n};\n```\n\u003c/details\u003e\n\nLot of good shit, but unfortunately, as said earlier, the `HiberContext` structure is freed/zeroed out after use via `PopFreeHiberContext()`:   \n(call stack):   \n\n```c\nPopFreeHiberContext\nPopUnlockAfterSleepWorker\nPopTransitionSystemPowerStateEx\nNtSetSystemPowerState\n```\n\n\u003c/details\u003e\n\n\n## Sources, credits, references, special thanks\n- [Zydis](https://zydis.re/), [Zydis - GitHub](https://github.com/zyantific/zydis) - Disassembler backing\n- [EDK2](https://github.com/tianocore/edk2) - UEFI Spec\n- [Satoshi's note](https://standa-note.blogspot.com/2020/12/experiment-in-extracting-runtime.html) - \"Experiment in extracting runtime drivers on Windows\"\n- [Vergilius Project](https://www.vergiliusproject.com/) - Undocumented Windows kernel structures\n- [gmh5225/ntoskrnl_file_collection](https://github.com/gmh5225/ntoskrnl_file_collection) - NTOSKRNL.EXE archive collection for pattern scanning\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fx0reaxeax%2Frtschecker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fx0reaxeax%2Frtschecker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fx0reaxeax%2Frtschecker/lists"}