DSE bypass not working on 20H2 after KB5003173 update

[hfiref0x]

DSE bypass not working on 20H2 after KB5003173 update

[hfiref0x]

Yes, CI.DLL now uses Microsoft WIL extensively. It numerous calls at CiInitialize ruins previous algorithm of CipInitialize lookup.

[mihaly044]

Thanks, @hfiref0x !
I think I have got it working thanks to your accurate information.
I'll make a PR later today after I'm done testing.

[hfiref0x]

Thanks, but no need. I'm planning to rewrite this part completely.

[hfiref0x]

The code for DSE manipulations are from DSEFix in mostly unmodified state. It turns out it also has some very ancient bug which one I likely added when I was moving this repository to the github from kernelmode.info. This also will be fixed.

[Narumiii]

I can confirm after the commit it still dones't work

[Narumiii]

[hfiref0x]

There has been no commits in master branch. Try exe from dev111 instead (https://github.com/hfiref0x/KDU/blob/v111/Bin/kdu.exe). If it still fails to work then upload your Windows\system32\CI.DLL somewhere (not on github) and post here a link to it.

[Narumiii]

Sorry my fault you are right these version works, anyways if needed here is my CI.dll, by the way many thanks to you for your effort and work on kernel research https://anonfiles.com/R5R9r2w3u6/ci_dll

[hfiref0x]

Thanks, I've checked your file. KDU from dev111 should work fine with it.