Unable to load kernel driver (not yet supported on this kernel version) #1823

MarekKnapek · 2023-08-22T10:47:50Z

Steps preceding reproduction:

Use SystemInformer normally.
Click Help -> Check for updates.
Update downloads, installs.
Unable to load kernel driver.
Restart computer.

Steps to reproduce:

Start System Informer (I'm admin but starting without admin privileges).
Go to main menu -> System -> Show details of all processes.
UAC dialog appears, Click YES.
"Unable to load kernel driver" message appears. More info in [1] and [2].
System Informer has limited capabilities due to not having access to its kernel driver.

Details:

System Informer version 3.0.7029 (f647fb0) x64.
Windows Server 2022 x64, 21H2, 10.0.20348.1906 (running in cloud inside QEMU).
SystemInformer.exe SHA-1 b09759778099468188434408f929d675ce289b97.
SystemInformer.sys SHA-1 ae6b8522ca5205b4cef89606ea6c7d043e81dc4f.
ntdll.dll SHA-1 4ffc26a940dffa2931923c345eb9824f76dcfca4.
ntoskrnl.exe SHA-1 ecbad74c2629f4dd516c35887b8e5d0b7032b135.

[1]

[Window Title]
System Informer

[Main Instruction]
Unable to load kernel driver

[Content]
Unable to load the kernel driver service.

The request is not supported.

Kernel version: 10.0.20348.1906
State mask: 0x00000000

[ ] Don't show this message again  [OK]

[2]

The text was updated successfully, but these errors were encountered:

ge0rdi · 2023-08-22T11:22:39Z

I have the same with 10.0.1941.3391 kernel.

I assume it is related to recent dyndata changes and these builds are simply not supported by driver yet.
Hopefully the support will be added soon.

jxy-s · 2023-08-22T17:56:55Z

I have the same with 10.0.19401.3391 kernel.

I only have 10.0.19041.3393 at the moment and there aren't symbols available. @ge0rdi could you send me your ntoskrnl.exe 10.0.19041.3391? Discord, email, or attach it here should be fine.

Windows Server 2022 x64, 21H2, 10.0.20348.1906

I'm adding Windows Server 2022 offsets soon.

ge0rdi · 2023-08-22T18:49:41Z

could you send me your ntoskrnl.exe 10.0.19041.3391?

E-mail sent.

jxy-s · 2023-08-22T18:59:26Z

Thanks for getting me the build @ge0rdi - like you mentioned in the email symbols are also not yet published for 3391 yet. Once they are I'll make sure dyndata gets updated.

@MarekKnapek I added dyndata for Server 2022 here: 03f5c8c - it'll get picked up in the next build

MagicAndre1981 · 2023-08-22T19:21:12Z

Microsoft released KB5029331 first as 19041.3391 and 2nd version is 19041.3393 in Release Preview/Insider version which is now also releaded to public in version 3393.

ge0rdi · 2023-08-22T19:49:53Z

Thank you @MagicAndre1981 .
After manual Windows update check I'm on .3393 too.

MagicAndre1981 · 2023-08-22T20:43:54Z

ok, on 1809 LTSC 17763.4737 I also miss the ++ , so no driver is loaded for System Informer version 3.0.7029, but I dont get the messagebox

MarekKnapek · 2023-08-22T21:11:16Z

Out of curiosity: What is this dyndata thing for? I can see that it is stored into the Registry. It is definitely not a Windows thing, it is SystemInformer thing. Maybe for communication between the user-space part of SI with kernel-space part? But why is it needed? What purpose it serves? What would happen if it was not there? What are alternatives for it? Why is it needed to be Windows version specific? Sorry for bothering you with so many questions.

jxy-s · 2023-08-22T21:21:52Z

What is this dyndata thing for? ... Maybe for communication between the user-space part of SI with kernel-space part? But why is it needed? What purpose it serves?

They're undocumented offsets used for both protections and APIs from the client:

systeminformer/KSystemInformer/include/dyndata.h

Lines 31 to 75 in 4c28c8f

    
           EXT ULONG KphDynEgeGuid OFFDEFAULT; 
        
           EXT ULONG KphDynEpObjectTable OFFDEFAULT; 
        
           EXT ULONG KphDynEreGuidEntry OFFDEFAULT; 
        
           EXT ULONG KphDynHtHandleContentionEvent OFFDEFAULT; 
        
           EXT ULONG KphDynOtName OFFDEFAULT; 
        
           EXT ULONG KphDynOtIndex OFFDEFAULT; 
        
           EXT ULONG KphDynObDecodeShift OFFDEFAULT; 
        
           EXT ULONG KphDynObAttributesShift OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcCommunicationInfo OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcOwnerProcess OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcConnectionPort OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcServerCommunicationPort OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcClientCommunicationPort OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcHandleTable OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcHandleTableLock OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcAttributes OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcAttributesFlags OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcPortContext OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcPortObjectLock OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcSequenceNo OFFDEFAULT; 
        
           EXT ULONG KphDynAlpcState OFFDEFAULT; 
        
           EXT ULONG KphDynKtReadOperationCount OFFDEFAULT; 
        
           EXT ULONG KphDynKtWriteOperationCount OFFDEFAULT; 
        
           EXT ULONG KphDynKtOtherOperationCount OFFDEFAULT; 
        
           EXT ULONG KphDynKtReadTransferCount OFFDEFAULT; 
        
           EXT ULONG KphDynKtWriteTransferCount OFFDEFAULT; 
        
           EXT ULONG KphDynKtOtherTransferCount OFFDEFAULT; 
        
           EXT ULONG KphDynLxPicoProc OFFDEFAULT; 
        
           EXT ULONG KphDynLxPicoProcInfo OFFDEFAULT; 
        
           EXT ULONG KphDynLxPicoProcInfoPID OFFDEFAULT; 
        
           EXT ULONG KphDynLxPicoThrdInfo OFFDEFAULT; 
        
           EXT ULONG KphDynLxPicoThrdInfoTID OFFDEFAULT; 
        
           EXT ULONG KphDynMmSectionControlArea OFFDEFAULT; 
        
           EXT ULONG KphDynMmControlAreaListHead OFFDEFAULT; 
        
           EXT ULONG KphDynMmControlAreaLock OFFDEFAULT; 
        
           EXT PPS_SET_LOAD_IMAGE_NOTIFY_ROUTINE_EX KphDynPsSetLoadImageNotifyRoutineEx DYNIMPORTDEFAULT; 
        
           EXT PPS_SET_CREATE_PROCESS_NOTIFY_ROUTINE_EX2 KphDynPsSetCreateProcessNotifyRoutineEx2 DYNIMPORTDEFAULT; 
        
           EXT PCI_FREE_POLICY_INFO KphDynCiFreePolicyInfo DYNIMPORTDEFAULT; 
        
           EXT PCI_VERIFY_HASH_IN_CATALOG KphDynCiVerifyHashInCatalog DYNIMPORTDEFAULT; 
        
           EXT PCI_CHECK_SIGNED_FILE KphDynCiCheckSignedFile DYNIMPORTDEFAULT; 
        
           EXT PCI_VERIFY_HASH_IN_CATALOG_EX KphDynCiVerifyHashInCatalogEx DYNIMPORTDEFAULT; 
        
           EXT PCI_CHECK_SIGNED_FILE_EX KphDynCiCheckSignedFileEx DYNIMPORTDEFAULT; 
        
           EXT PMM_PROTECT_DRIVER_SECTION KphDynMmProtectDriverSection DYNIMPORTDEFAULT; 
        
           EXT PLXP_THREAD_GET_CURRENT KphDynLxpThreadGetCurrent DYNIMPORTDEFAULT;

What would happen if it was not there? What are alternatives for it?

The driver can't function without them. They're required for the protections to function correctly. The old driver would load without them, but it was arguably mostly useless without them. There was some functionality without them, but it was a bit non-obvious why some things would work and some wouldn't. So, during the rewrite we opted to make it a requirement. This come with the benefit that we know where we don't have support/visibility. Obviously the cost is we have to work harder to have more compatibility.

Why is it needed to be Windows version specific?

Because they're undocumented offsets that are version-specific.

poqdavid · 2023-08-23T00:01:49Z

I hope this helps. I am experiencing the same issue after installing KB5029351. Before this update, I only got that message once when I installed Build 3.0.7029, but now I get it every time I launch System Informer.

jxy-s · 2023-08-23T22:25:22Z

137cc3a adds support for 10.0.19041.3393 and 10.0.22621.2215

Will be in next build 👍

ge0rdi · 2023-08-24T06:39:55Z

I can confirm that with latest SI driver loads on 19041.3393.
Thank you very much.

MagicAndre1981 · 2023-08-25T06:58:49Z

Ok, I disabled the warning dialog in setting, when I activate the dialog, I see this for 17763.4737:

jxy-s · 2023-08-25T09:22:04Z

@MagicAndre1981 when I was scraping to rebuild the offsets I missed three builds:
10.0.17763.4499
10.0.17763.4644
10.0.17763.4737

I just went over them and the offsets didn't change from 10.0.17763.4377 - I updated dyndata here: f733df4 - will be in next build 👍

poqdavid · 2023-09-12T23:55:46Z

The same error happened again right after installing update KB5030219, OS build 22621.2283

jxy-s · 2023-09-13T01:03:33Z

Thanks for letting me to @poqdavid - I'm grabbing the new versions now.

kotenok2000 · 2023-09-13T01:05:45Z

22621.2283
Should i send my ntoskrnl.exe?
ntoskrnl.zip

jxy-s · 2023-09-13T01:11:24Z

Symbols are not yet available for 10.0.22621.2283, I'll keep checking back - when they're available I'll update dyndata 👍

jxy-s · 2023-09-13T02:32:11Z

d859dad will be in next build 👍

MagicAndre1981 · 2023-09-13T05:26:38Z

as expected I also get the warning again for 1809:

and 1904x.3448:

poqdavid · 2023-09-13T19:54:46Z

@jxy-s out of curiosity when you guys update System Informer for newer kernels does it lose its compatibility with older kernels?
Cause I have been thinking to switch to RP channel on Windows and I was curious about how this whole thing works

jxy-s · 2023-09-13T23:38:33Z

you guys update System Informer for newer kernels does it lose its compatibility with older kernels

No, it doesn't break compatibility. We support older kernels. We support release builds for Win10+ x64/ARM64. The supported kernel versions are specified in https://github.com/winsiderss/systeminformer/blob/master/kphlib/kphdyn.xml

RP channel on Windows

We do not yet support preview builds. Updates to those kernels are too frequent for me to keep up with manually. I'm hoping to finish some automation eventually to support them.

MagicAndre1981 · 2023-09-14T05:39:45Z

I noticed I have an older SI Rev.6806 running on another Win10 17763 and here I see the ++ so driver is loaded on 17763.4851 🤔 🤷‍♂️

jxy-s · 2023-09-14T05:49:25Z

I noticed I have an older SI Rev.6806 running on another Win10 17763 and here I see the ++ so driver is loaded on 17763.4851 🤔 🤷‍♂️

See: #1823 (comment)

Dyndata format had to change and I went to rebuild all the offsets using some tooling. I missed a few versions. I've corrected it already, once a new build is out that kernel will be supported.

Older releases supported it with the older format. But there were bugs.

kotenok2000 · 2023-09-14T10:37:42Z

Why process hacker displayed +
and systeminformer displays ++?

MagicAndre1981 · 2023-09-14T11:27:51Z

the + and ++ show that both have different driver usage levels while ++ is the best

MagicAndre1981 · 2023-09-17T15:49:29Z

3.0.7148 fixed it on 19045.3448, but NOT for 17763.4851

MarekKnapek · 2024-04-10T06:07:00Z

Windows Server 2022 x64 10.0.20348.2402

http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/6855f5581047000/ntoskrnl.exe
http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/66546C893F1136BF8732FF5773F692651/ntkrnlmp.pdb

kotenok2000 · 2024-04-10T09:16:42Z

ntoskrnl.zip

jxy-s · 2024-04-10T23:36:27Z

10.0.22621.3447, 10.0.20348.2400, 10.0.19041.4291 - c8725ae

10.0.17763.5696 - 999ab69

3.0.7566 - Help > Check for updates - 👍

MichaelDavidGK · 2024-04-24T04:32:10Z

10.0.22621.3527
ntoskrnl.zip

jxy-s · 2024-04-27T02:38:04Z

10.0.22621.3527, 10.0.19041.4355 - fc042be

3.0.7579 - Help > Check for updates - 👍

manciuszz · 2024-05-01T21:44:56Z

10.0.26100.268
ntoskrnl.zip

kotenok2000 · 2024-05-01T21:47:56Z

Is that insider version?

MagicAndre1981 · 2024-05-01T21:50:17Z

26100.x will be 24H2, but they finished it already so that OEMs can preinstall new Devices with that version.

vedalken254 · 2024-05-06T14:13:14Z

Just as a little tidbit of info for those who may have been on the release channel like I was, Version 3.0.7579 is on the Canary update channel so if you currently have 3.0.7578 installed and are getting this error, go to Help > Switch Update Channel > Canary and allow it to check for updates and authorize the install which will automatically download 7579. Hope this helps anyone who may have still been stuck on this. In my specific case, this applied to Windows 11 23H2 with Kernel version 10.0.22621.3527.

Hadn't seen this mentioned so I figured I'd help out for the sake of people maybe googling the issue.

MagicAndre1981 · 2024-05-14T17:53:00Z

KB5037768 (OS Builds 19044.4412 and 19045.4412)

KB5037765 (OS Build 17763.5820)

ntoskrnl_17763.5820.zip

KB5037771 (OS Builds 22621.3593 and 22631.3593)

KB5037782 (OS Build 20348.2461)

KB5037770 (OS Build 22000.2960)

MarekKnapek · 2024-05-15T01:11:22Z

Windows Server 2022 x64:

https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/3A6EB0D31047000/ntoskrnl.exe
https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/C339CA26E8E26BB7F4C9BB7B8244A46A1/ntkrnlmp.pdb

p-yukusai · 2024-05-15T20:46:07Z

kotenok2000 · 2024-05-15T20:51:20Z

ntoskrnl.zip

ToddIndry37 · 2024-05-17T00:10:17Z

Same thing here after got cumulative update recently. Forwarded from my latest issue.

jxy-s · 2024-05-17T14:42:12Z

10.0.22621.3593, 10.0.20348.2461, 10.0.19041.4412, 10.0.17763.5820 - 4af54b6

3.0.7643 - Help > Check for updates - 👍

DavidXanatos · 2024-05-17T17:46:29Z

does not seam to quite work

kotenok2000 · 2024-05-17T17:51:12Z

latest version is 7643
you have 7548

DavidXanatos · 2024-05-17T17:54:56Z

check for update doe snot give me 7643 also not on https://systeminformer.sourceforge.io/downloads
may be its still building

kotenok2000 · 2024-05-17T17:57:10Z

change update channel to canary.

RewaskIta · 2024-05-19T12:52:43Z

how i change the channel to canary?

MarekKnapek · 2024-05-19T12:56:43Z

RewaskIta · 2024-05-19T13:05:56Z

and with process hacker 2?

kotenok2000 · 2024-05-19T13:08:46Z

uninstall it and install system informer.

SandFoxy · 2024-05-20T18:09:06Z

kotenok2000 · 2024-05-20T18:12:44Z

Latest version is 3.0.7645

MagicAndre1981 · 2024-05-24T10:14:55Z

There is a hotfix/Out of Band Update for 1809:

KB5039705 (OS Build 17763.5830) Out-of-band
https://support.microsoft.com/en-us/topic/may-23-2024-kb5039705-os-build-17763-5830-out-of-band-2285667a-13a3-4fd9-98a0-e980eb996aac

ntoskrnl_17763.5830.zip

jxy-s self-assigned this Aug 22, 2023

jxy-s closed this as completed Aug 24, 2023

dmex reopened this Aug 25, 2023

jxy-s pinned this issue Apr 21, 2024

jxy-s mentioned this issue May 1, 2024

Unable to load kernel driver #2044

Closed

jxy-s mentioned this issue May 11, 2024

Add kernal mode driver for windows 11 23H2 #2061

Closed

jxy-s mentioned this issue May 17, 2024

Can't load the kernel driver on the latest Windows 11 23H2 build 22631.3593 #2067

Closed

Unable to load kernel driver (not yet supported on this kernel version) #1823

Unable to load kernel driver (not yet supported on this kernel version) #1823

Comments

MarekKnapek commented Aug 22, 2023 • edited by jxy-s

ge0rdi commented Aug 22, 2023

jxy-s commented Aug 22, 2023 • edited

ge0rdi commented Aug 22, 2023

jxy-s commented Aug 22, 2023

MagicAndre1981 commented Aug 22, 2023 • edited

ge0rdi commented Aug 22, 2023

MagicAndre1981 commented Aug 22, 2023

MarekKnapek commented Aug 22, 2023

jxy-s commented Aug 22, 2023

poqdavid commented Aug 23, 2023

jxy-s commented Aug 23, 2023

ge0rdi commented Aug 24, 2023

MagicAndre1981 commented Aug 25, 2023

jxy-s commented Aug 25, 2023 • edited

poqdavid commented Sep 12, 2023 • edited

jxy-s commented Sep 13, 2023

kotenok2000 commented Sep 13, 2023

jxy-s commented Sep 13, 2023

jxy-s commented Sep 13, 2023

MagicAndre1981 commented Sep 13, 2023 • edited

poqdavid commented Sep 13, 2023

jxy-s commented Sep 13, 2023

MagicAndre1981 commented Sep 14, 2023

jxy-s commented Sep 14, 2023 • edited

kotenok2000 commented Sep 14, 2023 • edited

MagicAndre1981 commented Sep 14, 2023

MagicAndre1981 commented Sep 17, 2023

MarekKnapek commented Apr 10, 2024

kotenok2000 commented Apr 10, 2024

jxy-s commented Apr 10, 2024

MichaelDavidGK commented Apr 24, 2024

jxy-s commented Apr 27, 2024

manciuszz commented May 1, 2024

kotenok2000 commented May 1, 2024

MagicAndre1981 commented May 1, 2024 • edited

vedalken254 commented May 6, 2024

MagicAndre1981 commented May 14, 2024 • edited

MarekKnapek commented May 15, 2024

p-yukusai commented May 15, 2024

kotenok2000 commented May 15, 2024 • edited

ToddIndry37 commented May 17, 2024 • edited

jxy-s commented May 17, 2024

DavidXanatos commented May 17, 2024

kotenok2000 commented May 17, 2024

DavidXanatos commented May 17, 2024

kotenok2000 commented May 17, 2024

RewaskIta commented May 19, 2024

MarekKnapek commented May 19, 2024

RewaskIta commented May 19, 2024

kotenok2000 commented May 19, 2024

SandFoxy commented May 20, 2024

kotenok2000 commented May 20, 2024

MagicAndre1981 commented May 24, 2024

MarekKnapek commented Aug 22, 2023 •

edited by jxy-s

jxy-s commented Aug 22, 2023 •

edited

MagicAndre1981 commented Aug 22, 2023 •

edited

jxy-s commented Aug 25, 2023 •

edited

poqdavid commented Sep 12, 2023 •

edited

MagicAndre1981 commented Sep 13, 2023 •

edited

jxy-s commented Sep 14, 2023 •

edited

kotenok2000 commented Sep 14, 2023 •

edited

MagicAndre1981 commented May 1, 2024 •

edited

MagicAndre1981 commented May 14, 2024 •

edited

kotenok2000 commented May 15, 2024 •

edited

ToddIndry37 commented May 17, 2024 •

edited