VBoxHardenedLoader
VBoxHardenedLoader copied to clipboard
Loader ends with an error NTSTATUS (0xC000009A)
Describe the bug After running loader.exe It fails with an error.
To Reproduce Start loader.exe See the results
Expected behavior It should load the driver.
Screenshots none
Environment Windows 10 Pro - 21H2 (OS Build 19044.1466) loader - master and dev202 (loader from both branches did not work) AMD Ryzen CPU
Additional context loader log:
VirtualBox Hardened Loader v2.0.2.2008
[>] Entering VBoxLdrMain
LDR: Listing process token privileges...
LDR: SeLockMemoryPrivilege Disabled
LDR: SeIncreaseQuotaPrivilege Disabled
LDR: SeSecurityPrivilege Disabled
LDR: SeTakeOwnershipPrivilege Disabled
LDR: SeLoadDriverPrivilege Disabled
LDR: SeSystemProfilePrivilege Disabled
LDR: SeSystemtimePrivilege Disabled
LDR: SeProfileSingleProcessPrivilege Disabled
LDR: SeIncreaseBasePriorityPrivilege Disabled
LDR: SeCreatePagefilePrivilege Disabled
LDR: SeBackupPrivilege Disabled
LDR: SeRestorePrivilege Disabled
LDR: SeShutdownPrivilege Disabled
LDR: SeDebugPrivilege Enabled
LDR: SeSystemEnvironmentPrivilege Disabled
LDR: SeChangeNotifyPrivilege Enabled (Default Enabled)
LDR: SeRemoteShutdownPrivilege Disabled
LDR: SeUndockPrivilege Disabled
LDR: SeManageVolumePrivilege Disabled
LDR: SeImpersonatePrivilege Enabled (Default Enabled)
LDR: SeCreateGlobalPrivilege Enabled (Default Enabled)
LDR: SeIncreaseWorkingSetPrivilege Disabled
LDR: SeTimeZonePrivilege Disabled
LDR: SeCreateSymbolicLinkPrivilege Disabled
LDR: SeDelegateSessionUserImpersonatePrivilege Disabled
LDR: VirtualBox version 6.1.6
LDR: Windows version: 10.0 build 19044
LDR: Maximum User Mode address 0x7FFFFFFEFFFF
Pattern matching: 'VBOX'
Pattern FACP (pre v6.1) was not found
FACP (v6.1+) 0x35227
Pattern RSDT (pre 6.1) was not found
RSDT (6.1+) 0x3548e
XSDT 0x355e5
APIC 0x3583b
HPET 0x359e4
MCFG 0x35ae8
VBOXCPU 0x3fc20
Pattern VBOX generic (pre 6.1) was not found
VBOX (6.1+) 0x12f5cc
Pattern matching: 'VirtualBox'
VirtualBox 0x134a38
VirtualBox__ 0x1441a0
VirtualBox GIM 0x144828
VirtualBox VMM 0x145000
Pattern matching: 'Configuration'
Pattern Configuration (pre 6.1) was not found
Configuration (6.1+) 0x141275
Pattern matching: Hardware ID
80EE 0x92d1
80EE 0x20e61
80EE 0x20e85
80EE 0x47bb5
BEEF 0x20e77
BEEF 0x20e91
CAFE 0x47c5d
LDR: Patch table created
LDR: SeDebugPrivilege assigned
LDR: SeLoadDriverPrivilege assigned
[>] Entering MapTsugumi
[>] Entering ProviderCreate
[>] Entering StartVulnerableDriver
LDR: NtLoadDriver, NTSTATUS (0xC000009A)
[!] Unable to load vulnerable driver, NTSTATUS (0xC000009A)
[<] Leaving StartVulnerableDriver
[<] Leaving ProviderCreate
[!] ProviderCreate failed, abort
LDR: Cannot inject monitor code
[<] Leaving VBoxLdrMain
Windows event viewer log:
The description for Event ID 26 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
\??\E:\vboxhardener\IntelNal.sys failed to load
The message resource is present but the message was not found in the message table
This error code corresponds to STATUS_INSUFFICIENT_RESOURCES. You may be running out of file handles.
How can I tell that system is running out of file handles? What is the limit?