|
|
EDA365欢迎您登录！
您需要 登录 才可以下载或查看，没有帐号？注册
x
: F3 I, z) e/ t: h; I报错提示如下& V6 ]) x7 R: b1 w o
, t* Y$ U: Z" n4 C
# c6 g! c4 }- k: Y4 j, A$ e& i' f; }VBoxHardening.log日志如下：
5 L# i+ o& N- y+ ?' C! K# a
5 e, ?0 _9 J0 o0 K27fc.33b0: Log file opened: 6.1.12r139181 g_hStartupLog=0000000000000074 g_uNtVerCombined=0xa047ba008 p2 k# r- n6 a5 E- D2 H
27fc.33b0: \SystemRoot\System32\ntdll.dll:$ o" K7 V" r1 w8 y
27fc.33b0: CreationTime: 2020-05-13T04:08:01.305832200Z
- j7 @0 h" R. a27fc.33b0: LastWriteTime: 2020-05-13T04:08:01.364711200Z
8 F7 T1 m: c/ [0 G27fc.33b0: ChangeTime: 2020-08-12T03:51:05.663111000Z I( o6 H9 i" ` q6 N0 ~
27fc.33b0: FileAttributes: 0x20" r1 I4 x- t* M4 I: |
27fc.33b0: Size: 0x1e8460
: z T* c( p& a2 L27fc.33b0: NT Headers: 0xd8% D$ P3 J1 V5 l+ _# u t" U& c
27fc.33b0: Timestamp: 0xb29ecf52+ T5 Z; N" b' O- N; E; {
27fc.33b0: Machine: 0x8664 - amd64! N( H. ~( ?( J/ } D
27fc.33b0: Timestamp: 0xb29ecf52" Q9 T6 ]4 } T7 U$ W! R$ \
27fc.33b0: Image Version: 10.0
9 V/ u/ L E9 Q8 C* M27fc.33b0: SizeOfImage: 0x1f0000 (2031616)& |6 r( M: n* b9 s+ `
27fc.33b0: Resource Dir: 0x17f000 LB 0x6f310
7 W$ \* w2 ~1 ]' P% _/ y' L: I% E27fc.33b0: [Version info resource found at 0xd8! (ID/Name: 0x1; SubID/SubName: 0x409)]
& A1 P* P# e. `; p0 g27fc.33b0: [Raw version resource data: 0x17f0f0 LB 0x380, codepage 0x0 (reserved 0x0)]4 r' i1 E) P: ~7 j- x0 _
27fc.33b0: ProductName: Microsoft® Windows® Operating System
" W7 l" C: \) y( B' \# ^27fc.33b0: ProductVersion: 10.0.18362.815- t* ~$ L$ `# J' D, @* T+ b8 w& [; M
27fc.33b0: FileVersion: 10.0.18362.815 (WinBuild.160101.0800)
9 g- s/ Z! M! Z. z) Q27fc.33b0: FileDescription: NT Layer DLL7 b$ O9 v) v/ m3 P% [: U- b! O, V
27fc.33b0: \SystemRoot\System32\kernel32.dll:
* b9 V% o) ?+ v2 x [27fc.33b0: CreationTime: 2020-07-15T02:37:51.154008500Z$ s/ ~0 R( [. X" |! r
27fc.33b0: LastWriteTime: 2020-07-15T02:37:51.189919900Z* ]2 `) D: \3 f" V" _
27fc.33b0: ChangeTime: 2020-08-12T03:51:05.332995100Z
; Q u5 { }$ a/ f1 }1 z/ @" c4 v! ~( v27fc.33b0: FileAttributes: 0x20
3 ?) r, h% H* |: O2 Z O27fc.33b0: Size: 0xb0498
: f! q" r: T' {0 Z- a27fc.33b0: NT Headers: 0xe8
! ^% L: s" P* B3 l. p27fc.33b0: Timestamp: 0xce6bbd735 A. D W) F- \) J4 p
27fc.33b0: Machine: 0x8664 - amd64
; L5 t" q& e" k2 f27fc.33b0: Timestamp: 0xce6bbd73
& ]$ n% g$ D B K- `/ j27fc.33b0: Image Version: 10.0
; P; z+ v U4 ~- U! S, l27fc.33b0: SizeOfImage: 0xb2000 (729088)4 M0 T" l4 g2 K- x; X8 Q: e
27fc.33b0: Resource Dir: 0xb0000 LB 0x520$ D- `- a* v' m* i
27fc.33b0: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]
4 E) Q+ J x0 B27fc.33b0: [Raw version resource data: 0xb00b0 LB 0x3a4, codepage 0x0 (reserved 0x0)]
- W, H& G5 V7 E( A. e27fc.33b0: ProductName: Microsoft® Windows® Operating System- ^% F+ p: ~; c! J
27fc.33b0: ProductVersion: 10.0.18362.959+ c% s8 P# O' o# j
27fc.33b0: FileVersion: 10.0.18362.959 (WinBuild.160101.0800)
* d$ q* a+ P5 l- Q* }) s27fc.33b0: FileDescription: Windows NT BASE API Client DLL5 p' l$ Q* T7 }) n
27fc.33b0: \SystemRoot\System32\KernelBase.dll:
. p: o# b+ {. Z( E5 Q& y. l/ B27fc.33b0: CreationTime: 2020-08-12T03:50:16.150249100Z5 Y+ \$ {7 v! S' X* p- x! ^6 Y
27fc.33b0: LastWriteTime: 2020-08-12T03:50:16.238020800Z
. G& j, @/ `0 i+ \' r27fc.33b0: ChangeTime: 2020-08-12T09:44:10.047506100Z
' e8 @6 ?- c; S, y; M27fc.33b0: FileAttributes: 0x20
7 _5 }" q- Z* n+ a0 w2 }27fc.33b0: Size: 0x2a3868
0 H# P# P6 D. @& G27fc.33b0: NT Headers: 0xf8
3 b+ A5 r2 u2 f" p' z- @27fc.33b0: Timestamp: 0x91b9349a: k" z3 v% S8 t
27fc.33b0: Machine: 0x8664 - amd64% m# T# H% V, N m! K/ t
27fc.33b0: Timestamp: 0x91b9349a
* a! q. ]' O D' H5 h* O27fc.33b0: Image Version: 10.0
% n; A7 H2 c- n27fc.33b0: SizeOfImage: 0x2a4000 (2768896)9 B! f$ B6 b5 X3 [
27fc.33b0: Resource Dir: 0x27e000 LB 0x548
) k1 C& Z8 p9 A, j5 m4 G0 c g27fc.33b0: [Version info resource found at 0x90! (ID/Name: 0x1; SubID/SubName: 0x409)]7 r* G5 Q5 l9 t0 ?+ ^' f& I
27fc.33b0: [Raw version resource data: 0x27e0b0 LB 0x3bc, codepage 0x0 (reserved 0x0)]
1 T9 \6 G2 M. B8 _27fc.33b0: ProductName: Microsoft® Windows® Operating System
i1 h, m; z0 k# L: F. `27fc.33b0: ProductVersion: 10.0.18362.997
/ _ X) x+ i; s) `27fc.33b0: FileVersion: 10.0.18362.997 (WinBuild.160101.0800)
( P8 k1 J5 f9 ^0 r6 {' P* j+ D27fc.33b0: FileDescription: Windows NT BASE API Client DLL. D3 w! n$ f1 M2 b
27fc.33b0: \SystemRoot\System32\apisetschema.dll:
9 e) n5 o9 w4 c' }3 z* j27fc.33b0: CreationTime: 2019-03-19T04:43:54.837151500Z
1 L. p( _8 T: B, M" a5 a8 r27fc.33b0: LastWriteTime: 2019-03-19T04:43:54.837151500Z: Y% R; L+ i( ^; z3 V0 _1 N$ C
27fc.33b0: ChangeTime: 2020-08-12T03:51:05.320029000Z- I5 |' I" z: e% z
27fc.33b0: FileAttributes: 0x20 z8 h. M( T4 [+ m
27fc.33b0: Size: 0x1d028
& w- ?& s7 C) t( J1 c27fc.33b0: NT Headers: 0xc8
$ G. m2 Y" ~8 E; d27fc.33b0: Timestamp: 0xd6ced080% ?( b9 x$ s2 N$ {, Z
27fc.33b0: Machine: 0x8664 - amd64! H! E6 w6 H# \& H2 O W
27fc.33b0: Timestamp: 0xd6ced080
. I# x' O$ M J8 ~. x27fc.33b0: Image Version: 10.0
9 f! B) V; u8 {5 u: l27fc.33b0: SizeOfImage: 0x1e000 (122880)
: ^2 {; @' x3 g+ y7 U27fc.33b0: Resource Dir: 0x1d000 LB 0x408
3 y' t4 x0 [$ [: Z( h27fc.33b0: [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
/ S5 J) u* Z1 E; y+ v27fc.33b0: [Raw version resource data: 0x1d060 LB 0x3a8, codepage 0x0 (reserved 0x0)]
8 I9 _. l) j- Z* C$ L [& `27fc.33b0: ProductName: Microsoft® Windows® Operating System
- F6 z# v2 I" l9 X6 F/ X( @( J27fc.33b0: ProductVersion: 10.0.18362.1
1 D/ K. G* t- R; F, l27fc.33b0: FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
) H0 W- O4 z; y# `27fc.33b0: FileDescription: ApiSet Schema DLL
' P/ `! W& q& ~27fc.33b0: NtOpenDirectoryObject failed on \Driver: 0xc0000022% R- n- |2 \' ]+ {/ I$ m. X# H
27fc.33b0: supR3HardenedWinFindAdversaries: 0x0; K4 x5 q& \- v7 @* x# D
27fc.33b0: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume6\virtualBox'* u B: N9 I, I: } K% ?$ [+ z" w
27fc.33b0: Calling main()
0 S4 n- |# E B* D5 n; w2 V* {- P27fc.33b0: SUPR3HardenedMain: pszProgName=VirtualBoxVM fFlags=0x25 J, A. r# [; T1 A. ^
27fc.33b0: supR3HardenedWinInitAppBin(0x2): '\Device\HarddiskVolume6\virtualBox'
K) `- ~% J, w @4 _27fc.33b0: SUPR3HardenedMain: Respawn #1
: h- }# j! W! a2 E( q$ L9 e27fc.33b0: System32: \Device\HarddiskVolume3\Windows\System32
Y2 {: S5 F0 o+ X' _27fc.33b0: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS, U! n$ o: i4 J5 V" V _2 G
27fc.33b0: KnownDllPath: C:\Windows\System32; M" `( V: T- _3 l
27fc.33b0: supR3HardenedWinInit: PeRForming a limited self purification...5 }' l6 W) k7 b+ |
27fc.33b0: supHardNtVpScanVirtualMemory: enmKind=SELF_PURIFICATION$ W& d) o7 Q$ T' O; V# v
27fc.33b0: *0000000000000000-0000000000acffff 0x0001/0x0000 0x0000000# D( a$ d8 x% R1 q1 n# M" h
27fc.33b0: *0000000000ad0000-0000000000adffff 0x0004/0x0004 0x0040000
$ F2 ~) u' f! r. e Z1 o% e- f5 r27fc.33b0: 0000000000ae0000-0000000000aeffff 0x0001/0x0000 0x0000000
, P6 C: D6 u g4 n6 S0 E9 J) h0 ?# \27fc.33b0: *0000000000af0000-0000000000b0afff 0x0002/0x0002 0x00400004 g- z2 G% J- R+ z5 F: ^
27fc.33b0: 0000000000b0b000-0000000000b0ffff 0x0001/0x0000 0x0000000
4 l2 B" j0 G$ {0 @- d27fc.33b0: *0000000000b10000-0000000000b13fff 0x0002/0x0002 0x0040000
: s3 V' ^ e0 d0 I27fc.33b0: 0000000000b14000-0000000000b1ffff 0x0001/0x0000 0x0000000
& A; T! s* a: `( S1 _27fc.33b0: *0000000000b20000-0000000000b21fff 0x0004/0x0004 0x0020000
0 @+ Z& l! i" V2 s6 v8 l, I27fc.33b0: 0000000000b22000-0000000000b2ffff 0x0001/0x0000 0x0000000
. x' r$ q" `4 K9 m' {27fc.33b0: *0000000000b30000-0000000000bf6fff 0x0002/0x0002 0x0040000
" ]! b/ i3 [+ r+ ^( u+ n9 ~3 m) r27fc.33b0: 0000000000bf7000-0000000000bfffff 0x0001/0x0000 0x0000000
0 Y; }' y5 e9 ?# [ ]27fc.33b0: *0000000000c00000-0000000000d8efff 0x0000/0x0004 0x0020000
- a) R/ O1 D1 M2 J# T) R27fc.33b0: 0000000000d8f000-0000000000d91fff 0x0004/0x0004 0x0020000( s4 O/ {% J. K; S8 x' X
27fc.33b0: 0000000000d92000-0000000000dfffff 0x0000/0x0004 0x00200007 |, H, c* `& O) T' U
27fc.33b0: *0000000000e00000-0000000000eb8fff 0x0000/0x0004 0x0020000
6 H. X& h' I4 E) f3 M4 W9 r) {# }27fc.33b0: 0000000000eb9000-0000000000ebbfff 0x0104/0x0004 0x0020000" B2 U5 B' g1 [ `1 m
27fc.33b0: 0000000000ebc000-0000000000efffff 0x0004/0x0004 0x0020000' |( T- Z/ C! q% N% s# b5 ^
27fc.33b0: *0000000000f00000-0000000000f01fff 0x0004/0x0004 0x0020000
- D6 l" b0 x- g6 o" {3 o# g; R w27fc.33b0: 0000000000f02000-0000000000f19fff 0x0000/0x0004 0x0020000. w9 W" l3 u" W+ c
27fc.33b0: 0000000000f1a000-0000000000ffffff 0x0001/0x0000 0x00000007 U- t4 t3 @3 ~3 y k V
27fc.33b0: *0000000001000000-0000000001004fff 0x0004/0x0004 0x00200006 n' f- r( t1 d5 N6 u' m% {0 E
27fc.33b0: 0000000001005000-00000000010fffff 0x0000/0x0004 0x0020000
" s- O+ T" A, s' k27fc.33b0: *0000000001100000-000000000111cfff 0x0004/0x0004 0x00200007 Z( g Q" Q5 i, Q% Z
27fc.33b0: 000000000111d000-00000000011fffff 0x0000/0x0004 0x0020000
" e6 Q {! Q7 K- A) j) w/ ]6 c( g5 I27fc.33b0: 0000000001200000-00000000012effff 0x0001/0x0000 0x0000000- m3 ^! L( n5 e) Q3 v/ G) }
27fc.33b0: *00000000012f0000-00000000012fefff 0x0004/0x0004 0x0020000. E+ T- N. Z! S9 x3 G) V
27fc.33b0: 00000000012ff000-00000000012fffff 0x0000/0x0004 0x0020000
: u& d+ k" q5 G' V27fc.33b0: *0000000001300000-0000000001303fff 0x0000/0x0004 0x0020000% m5 N% A Q0 |
27fc.33b0: 0000000001304000-00000000014f4fff 0x0004/0x0004 0x00200001 T; z+ U y8 c/ t& v' B
27fc.33b0: 00000000014f5000-00000000014f5fff 0x0000/0x0004 0x0020000
0 [% i! F/ \% N% n27fc.33b0: 00000000014f6000-000000007ffdffff 0x0001/0x0000 0x0000000
4 }4 a& h) ]+ ]2 B9 y27fc.33b0: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
1 S* G; U+ c, D8 S8 {27fc.33b0: 000000007ffe1000-000000007ffeefff 0x0001/0x0000 0x0000000
2 ]+ T: U8 q/ ~, Y1 E* ?27fc.33b0: *000000007ffef000-000000007ffeffff 0x0002/0x0002 0x0020000
! \+ _' Z. R" f27fc.33b0: 000000007fff0000-00007ff465c8ffff 0x0001/0x0000 0x0000000
$ d2 b) z# \7 C. v3 X27fc.33b0: *00007ff465c90000-00007ff465c94fff 0x0002/0x0002 0x00400001 S4 ~& u. r# B p
27fc.33b0: 00007ff465c95000-00007ff465d8ffff 0x0000/0x0002 0x0040000! s* f C7 ^+ N
27fc.33b0: *00007ff465d90000-00007ff565daffff 0x0000/0x0004 0x0020000& O: I& q0 b e( m7 `
27fc.33b0: *00007ff565db0000-00007ff567daffff 0x0000/0x0004 0x0020000
' {" X- U0 r6 `7 y- c9 N* b4 w27fc.33b0: 00007ff567db0000-00007ff567db0fff 0x0004/0x0004 0x0020000
( C4 D2 l" h/ `6 q6 O0 ~5 d27fc.33b0: 00007ff567db1000-00007ff567dbffff 0x0001/0x0000 0x00000000 O& w! @# z- i6 F9 s) I1 C6 K
27fc.33b0: *00007ff567dc0000-00007ff567dc0fff 0x0002/0x0002 0x00400000 w" _8 S! F1 ] V, D& C) `
27fc.33b0: 00007ff567dc1000-00007ff567dcffff 0x0001/0x0000 0x0000000. d/ [' s2 {$ B( `; \% V; L' h. v+ L
27fc.33b0: *00007ff567dd0000-00007ff567e02fff 0x0002/0x0002 0x0040000* s$ b$ g2 \3 a2 W7 M4 |- O( G) n
27fc.33b0: 00007ff567e03000-00007ff646a3ffff 0x0001/0x0000 0x0000000
4 t( e1 X" g" ^% [27fc.33b0: *00007ff646a40000-00007ff646a40fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe V0 b# m6 h! F* r Y0 ~; h
27fc.33b0: 00007ff646a41000-00007ff646ab6fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
Z/ b7 U+ P* _. J( {4 _! h27fc.33b0: 00007ff646ab7000-00007ff646ab7fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
9 h3 c0 P D/ p. K27fc.33b0: 00007ff646ab8000-00007ff646afffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
( i% f4 d- I2 W$ j) O& I27fc.33b0: 00007ff646b00000-00007ff646b02fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe1 E1 t/ J( z' ^9 y0 n
27fc.33b0: 00007ff646b03000-00007ff646b05fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe1 R- I- @: @' s1 Z* A5 t
27fc.33b0: 00007ff646b06000-00007ff646b08fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe2 N# d2 A# t7 `7 \1 _! P
27fc.33b0: 00007ff646b09000-00007ff646b09fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
" R; b9 a- Y3 `27fc.33b0: 00007ff646b0a000-00007ff646b0bfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
9 r9 ?5 j, B4 d# U3 R27fc.33b0: 00007ff646b0c000-00007ff646b0cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
0 ]! @( a- @1 X j* w( ^27fc.33b0: 00007ff646b0d000-00007ff646b55fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe) v6 p/ w/ {* g6 w) Q8 U( Q( G
27fc.33b0: 00007ff646b56000-00007ff938fcffff 0x0001/0x0000 0x0000000* w. x( Z7 f1 s4 \. f
27fc.33b0: *00007ff938fd0000-00007ff938fd0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll" w" ]* P: B7 _2 \; B( B
27fc.33b0: 00007ff938fd1000-00007ff9390d5fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll/ @( i$ \ g2 T4 m+ @
27fc.33b0: 00007ff9390d6000-00007ff939238fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll" E+ ^( j- J9 b; S. |/ |( D+ i4 L
27fc.33b0: 00007ff939239000-00007ff93923cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll7 W. b* i3 b- @5 C! |9 X" s2 b, }
27fc.33b0: 00007ff93923d000-00007ff93923dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
& o- n9 `8 Y/ w7 q" m27fc.33b0: 00007ff93923e000-00007ff939273fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\KernelBase.dll
2 b; s1 x$ J. ~. f( q u27fc.33b0: 00007ff939274000-00007ff93a98ffff 0x0001/0x0000 0x00000001 \8 s5 {3 c3 |1 Y3 \7 c
27fc.33b0: *00007ff93a990000-00007ff93a990fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll O4 @6 N. Z% S' {+ I5 I1 t
27fc.33b0: 00007ff93a991000-00007ff93aa05fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
' _5 I& t) P7 r( Z8 ]5 G! L* S- _27fc.33b0: 00007ff93aa06000-00007ff93aa37fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll* r, Y9 Y4 k, i# A1 \
27fc.33b0: 00007ff93aa38000-00007ff93aa38fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
$ i* l; b, C7 ]7 ^27fc.33b0: 00007ff93aa39000-00007ff93aa39fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
- T# v8 @# e& U1 L% k27fc.33b0: 00007ff93aa3a000-00007ff93aa41fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\kernel32.dll
. K" U% r: D& R# W0 ^% A. w( o27fc.33b0: 00007ff93aa42000-00007ff93badffff 0x0001/0x0000 0x0000000
; [6 y' T/ D" g27fc.33b0: *00007ff93bae0000-00007ff93bae0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
# d; h2 E6 N6 N/ T6 \8 x' ]& f27fc.33b0: 00007ff93bae1000-00007ff93bbf7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll; X) c% N* c6 l& m/ L) k
27fc.33b0: 00007ff93bbf8000-00007ff93bc3efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll- Y) v9 b7 b9 N+ d( `
27fc.33b0: 00007ff93bc3f000-00007ff93bc3ffff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll) A& G( G! K; i% C: }
27fc.33b0: 00007ff93bc40000-00007ff93bc41fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll7 G4 K) R! G: d7 |! c
27fc.33b0: 00007ff93bc42000-00007ff93bc4afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll$ ^3 c2 H7 g+ N; S% r( w
27fc.33b0: 00007ff93bc4b000-00007ff93bccffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll! K# l* ?# m( B5 u9 g6 `! g
27fc.33b0: 00007ff93bcd0000-00007ffffffeffff 0x0001/0x0000 0x0000000
1 j8 p4 C' j* H+ m27fc.33b0: kernel32.dll: timestamp 0xce6bbd73 (rc=VINF_SUCCESS)
1 {; @( ~1 c/ r0 ^6 U27fc.33b0: kernelbase.dll: timestamp 0x91b9349a (rc=VINF_SUCCESS)
! X: n* m3 n2 `% w8 n1 w27fc.33b0: VirtualBoxVM.exe: timestamp 0x5f08d7bc (rc=VINF_SUCCESS)
, Z# {$ A( X. @, x; {% f I$ V. Y27fc.33b0: '\Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe' has no imports2 D1 ]! u$ ~2 T2 l5 A$ I2 G' Q5 E; B
27fc.33b0: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports
- W0 u* O' }; {" e [$ d27fc.33b0: supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> VINF_SUCCESS, cFixes=0* f. z$ m8 ~# b0 J6 @/ Z" h3 @5 X- R
27fc.33b0: '\Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe' has no imports6 n, A t# w9 k, R7 V8 X
27fc.33b0: supHardenedWinVerifyImageByHandle: -> 24202 (\Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe)4 s1 n6 H4 V3 P1 o8 m6 G
27fc.33b0: supR3HardNtEnableThreadCreationEx:6 E8 F& `. G8 x; h& M \
27fc.33b0: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ff93bb51770 pvNtTerminateThread=00007ff93bb7cac0
6 x! F6 Q1 T& p$ m27fc.33b0: supR3HardenedWinDoReSpawn(1): New child 32b0.2564 [kernel32].
: L+ @$ I1 i. Q27fc.33b0: supR3HardNtChildGatherData: PebBaseAddress=0000000000b2e000 cbPeb=0x388
3 d( n, j5 B% w27fc.33b0: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ff93bae0000 uNtDllChildAddr=00007ff93bae0000
y1 z! S+ U# E5 \/ R9 c1 [27fc.33b0: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ff93bb51770
5 c( L! K# ^. @- q- R/ v27fc.33b0: supR3HardenedWinSetupChildInit: Initial context:0 v) b: L- p4 Q# f( b
rax=0000000000000000 rbx=0000000000000000 rcx=00007ff646a47900 rdx=0000000000b2e000: Z' z0 C$ i0 ^6 d2 i7 D
rsi=0000000000000000 rdi=0000000000000000 r8 =0000000000000000 r9 =0000000000000000
0 m; i/ H# H5 Rr10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
$ L: r+ v6 B+ b; [$ \& ?9 ur14=0000000000000000 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
: E1 M4 N6 P/ @5 Orip=00007ff93bb4ce30 rsp=000000000096fa68 rbp=0000000000000000 ctxflags=0010001b
- q# L; P9 t: I3 k5 F; E( p4 Ocs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 eflags=00000200 mxcrx=00001f803 K- C1 V1 }1 _1 N+ x
P3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=0000000000000000
. t, j3 z- _! c- Vdr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
3 w& a/ `+ Y% N- s5 Ddr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000
# ^4 j$ { I0 N. R/ n0 T8 T P1 T3 Slbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=00000000000000005 c; f! X7 L6 S& I6 U' a* \
27fc.33b0: supR3HardenedWinSetupChildInit: Start child.! Y8 U7 A0 ?- Z
27fc.33b0: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.. N' T5 w' r* V; h. n, t/ _
27fc.33b0: supR3HardNtChildPurify: Startup delay kludge #1/0: 268 ms, 23 sleeps% }" a2 a/ M# W
27fc.33b0: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION2 p7 h+ M$ D8 _' ]: m# H, f
27fc.33b0: *0000000000000000-000000000082ffff 0x0001/0x0000 0x0000000( E* m! J4 G( e6 v( d
27fc.33b0: *0000000000830000-000000000084ffff 0x0004/0x0004 0x0020000: X; @4 i8 @' _; l/ E# l+ l( [6 |
27fc.33b0: *0000000000850000-000000000086afff 0x0002/0x0002 0x0040000
9 f! y v* L ]1 t9 X27fc.33b0: 000000000086b000-000000000086ffff 0x0001/0x0000 0x0000000
. y$ \9 G4 W) W; i27fc.33b0: *0000000000870000-000000000096afff 0x0000/0x0004 0x00200004 @3 G. ]+ M% Q- x( w2 P
27fc.33b0: 000000000096b000-000000000096dfff 0x0104/0x0004 0x00200008 g! [+ U* ~" k, O% ~# |
27fc.33b0: 000000000096e000-000000000096ffff 0x0004/0x0004 0x00200000 z: |' N( g9 w. O. j0 z2 X1 m# Q: X
27fc.33b0: *0000000000970000-0000000000973fff 0x0002/0x0002 0x0040000; i% b) P2 ^0 W& l; h* d
27fc.33b0: 0000000000974000-000000000097ffff 0x0001/0x0000 0x0000000( t! g* t, l8 F- O2 k
27fc.33b0: *0000000000980000-0000000000981fff 0x0004/0x0004 0x0020000
4 w0 \7 b6 r5 y4 ]' g t( \27fc.33b0: 0000000000982000-00000000009fffff 0x0001/0x0000 0x0000000% e% i! ^3 l8 L( }
27fc.33b0: *0000000000a00000-0000000000b2dfff 0x0000/0x0004 0x0020000
1 ^" w6 V5 y: H27fc.33b0: 0000000000b2e000-0000000000b30fff 0x0004/0x0004 0x0020000
& N: _; d n& h5 {# t; ]27fc.33b0: 0000000000b31000-0000000000bfffff 0x0000/0x0004 0x0020000" ?4 w4 D8 S5 o* [/ ^- I
27fc.33b0: 0000000000c00000-000000007ffdffff 0x0001/0x0000 0x0000000! G+ s8 ?- x& l9 i7 n. k6 j
27fc.33b0: *000000007ffe0000-000000007ffe0fff 0x0002/0x0002 0x0020000
" u# `- j, d k. Q( R27fc.33b0: 000000007ffe1000-000000007ffeefff 0x0001/0x0000 0x00000006 H5 M5 H: r3 Q
27fc.33b0: *000000007ffef000-000000007ffeffff 0x0002/0x0002 0x0020000
' l' H3 y1 M+ `6 M3 ]/ X27fc.33b0: 000000007fff0000-00007ff5ec1bffff 0x0001/0x0000 0x0000000- J0 {" f% `# b7 d) S3 c5 M
27fc.33b0: *00007ff5ec1c0000-00007ff5ec1c0fff 0x0002/0x0002 0x0040000
" q# L8 _* O0 }& F* H* U2 E27fc.33b0: 00007ff5ec1c1000-00007ff5ec1cffff 0x0001/0x0000 0x0000000
# `! y6 i5 u* c! B8 U+ @* Y27fc.33b0: *00007ff5ec1d0000-00007ff5ec202fff 0x0002/0x0002 0x0040000
( @( g5 Y% b/ B2 |5 F# ~2 k+ u27fc.33b0: 00007ff5ec203000-00007ff646a3ffff 0x0001/0x0000 0x00000000 k0 z6 D* P7 Y% W5 G/ n
27fc.33b0: *00007ff646a40000-00007ff646a40fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe5 H$ Q( X' u) \2 l5 U+ j$ }
27fc.33b0: 00007ff646a41000-00007ff646ab6fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
+ w, M y. z9 k' m. z: k/ l27fc.33b0: 00007ff646ab7000-00007ff646ab7fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
% f: _* f1 {4 H. K, E' N27fc.33b0: 00007ff646ab8000-00007ff646afffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
! A4 L1 ~- k7 c* x27fc.33b0: 00007ff646b00000-00007ff646b00fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe( O8 d" J7 I3 u$ z9 l
27fc.33b0: 00007ff646b01000-00007ff646b01fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe. E3 s" a) Y2 L
27fc.33b0: 00007ff646b02000-00007ff646b06fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe9 j, k, f( T$ ]+ E8 t2 B, b+ i
27fc.33b0: 00007ff646b07000-00007ff646b07fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
! O& I" r3 q5 s9 h$ H27fc.33b0: 00007ff646b08000-00007ff646b08fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe
4 i6 U* y3 ?3 [$ U8 p27fc.33b0: 00007ff646b09000-00007ff646b0cfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe# w( ]1 o3 b& S0 m5 I# [
27fc.33b0: 00007ff646b0d000-00007ff646b55fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe/ }1 s. B& }( y( }! V: H
27fc.33b0: 00007ff646b56000-00007ff93badffff 0x0001/0x0000 0x0000000' {! Y. D y1 m( v
27fc.33b0: *00007ff93bae0000-00007ff93bae0fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll o0 {, r' T* k! R7 S
27fc.33b0: 00007ff93bae1000-00007ff93bbf7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
2 ^* w9 p' l) p' p# X27fc.33b0: 00007ff93bbf8000-00007ff93bc3efff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
$ R3 K1 q( P) F4 c27fc.33b0: 00007ff93bc3f000-00007ff93bc4afff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll. D w2 K" C! u8 R
27fc.33b0: 00007ff93bc4b000-00007ff93bc59fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
1 O9 n0 h ^* F27fc.33b0: 00007ff93bc5a000-00007ff93bc5afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
# k# v! c7 M a( V G" {27fc.33b0: 00007ff93bc5b000-00007ff93bc5dfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll, D* C1 q+ k8 F4 Z f4 c& l
27fc.33b0: 00007ff93bc5e000-00007ff93bccffff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\ntdll.dll
+ s2 W9 ]6 b: r( Q7 k; q0 a27fc.33b0: 00007ff93bcd0000-00007ffffffeffff 0x0001/0x0000 0x0000000- S" ]% v4 S) u( _( q8 ~- d
27fc.33b0: supR3HardNtChildPurify: Done after 274 ms and 0 fixes (loop #0).
% \. Q {' [- l+ M4 F32b0.2564: Log file opened: 6.1.12r139181 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa047ba00
" \5 C! b. o- U$ q' T32b0.2564: supR3HardenedVmProcessInit: uNtDllAddr=00007ff93bae0000 g_uNtVerCombined=0xa047ba00 (stack ~000000000096f4f8)! B6 M: _/ C! {5 X
32b0.2564: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)( Q4 ]9 H. @ {6 P" W; K/ U
32b0.2564: New simple heap: #1 0000000000d00000 LB 0x400000 (for 2031616 allocation) p3 H, q9 @; ]
32b0.2564: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume6\virtualBox'" {6 P9 h i+ M# O8 ]) r
32b0.2564: System32: \Device\HarddiskVolume3\Windows\System324 ?4 Z$ ^( J: z& Q* h, ~
32b0.2564: WinSxS: \Device\HarddiskVolume3\Windows\WinSxS
% Y$ @' i- w' H* Z, ?2 r0 {, P32b0.2564: KnownDllPath: C:\Windows\System32
" o9 v( n& ~ c9 }: W9 d. m32b0.2564: supR3HardenedVmProcessInit: Opening vboxdrv stub...
' o _6 u$ f6 }* B3 C+ d9 x$ n2 y8 _27fc.33b0: supR3HardNtEnableThreadCreationEx:
4 y+ h0 {2 ^ m4 m; d& Q* h32b0.2564: supR3HardenedWinReadErrorInfoDevice: 'Unknown image file \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe at 00007ff646a40000. (rc83Exp=-91)'7 F/ Z7 G3 c+ }7 N
32b0.2564: Error -5633 in supR3HardenedWinReSpawn! (enmWhat=3)
( y8 G# v! d& V$ a( G4 y7 n32b0.2564: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5633 (0xffffe9ff) (rcNt=0xe986e9ff)) t f9 c( P6 y# W5 }
VBoxDrvStub error: Unknown image file \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe at 00007ff646a40000. (rc83Exp=-91)$ T5 W# E. V& U( `$ {' z- n0 \
27fc.33b0: supR3HardenedWinCheckChild: enmRequest=2 rc=-5633 enmWhat=3 supR3HardenedWinReSpawn: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5633 (0xffffe9ff) (rcNt=0xe986e9ff)) o+ Z7 u% ?5 H- M
VBoxDrvStub error: Unknown image file \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe at 00007ff646a40000. (rc83Exp=-91)8 H) p9 {& b0 u
32b0.2564: KiUserExceptionDispatcher: 0xc0000005 (0000000000000001, 0000000000000024) @ 00007ff93bae72a6 (flags=0x0)" w6 J) d2 T+ q+ \6 w q
rax=0000000000000000 rbx=00007ff93bc452c0 rcx=00007ff93bc452c0 rdx=00000000fffffffa
" K% h3 y6 a! k9 {7 i. trsi=0000000000000000 rdi=00007ff93bc44f00 r8 =0000000000000000 r9 =00007ff93bc45200: V2 _+ y1 V/ l: x, e( a
r10=0000000000000000 r11=0000000000968d90 r12=0000000000000000 r13=0000000000b2f000
@5 k8 y, \9 Rr14=0000000000000001 r15=0000000000000000 P1=0000000000000000 P2=0000000000000000
% \8 q; V( i9 B9 g& ]. Mrip=00007ff93bae72a6 rsp=0000000000968bf0 rbp=00000000ffffe900 ctxflags=0010005f
. G0 B0 w. b; A: a0 i% Scs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b eflags=00010213 mxcrx=00001f80
! r8 Y( J- s6 A+ J7 DP3=0000000000000000 P4=0000000000000000 P5=0000000000000000 P6=00000000000000009 t7 T3 I t* D$ V$ ?/ w1 W
dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000- D, d1 ~& f5 M |2 d
dr6=0000000000000000 dr7=0000000000000000 vcr=0000000000000000 dcr=0000000000000000! d! u* m. K6 I: e z
lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000, B! q. n4 ?/ d$ Z g# o
27fc.33b0: Error -5633 in supR3HardenedWinReSpawn! (enmWhat=3)
5 t# B# ~- x* A- K' r27fc.33b0: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5633 (0xffffe9ff) (rcNt=0xe986e9ff)! M; ~* ]% y) T7 K0 R
VBoxDrvStub error: Unknown image file \Device\HarddiskVolume6\virtualBox\VirtualBoxVM.exe at 00007ff646a40000. (rc83Exp=-91)0 A" h: U+ I% y! ~& T8 y) s
/ e7 `9 x& a0 f+ W5 h. G9 ^4 a1 Z0 b: O9 h# X) S/ u
: m/ A1 h5 z$ n9 u
! H" \4 o0 g: `) c
: a3 d! D9 l; v+ Qvboxdrv已运行
; T# E) J& b7 S) V- q; L9 ]- q% Y9 I* g& n) C
请问大神们改如何解决这个问题
2 k. A0 J' b' {; M8 N/ f7 G |
|
/1 
发表于 2021-7-13 13:34
收藏
淘帖
支持！
反对！