66*
77* VERSION: 1.48
88*
9- * DATE: 25 Mar 2026
9+ * DATE: 02 May 2026
1010*
1111* KDU tests.
1212*
@@ -137,7 +137,10 @@ NTSTATUS DebugQueryCiOptionsFromMappedImage(
137137}
138138
139139ULONG_PTR DebugQueryCurrentCiOptionsAddress (
140- _In_ ULONG NtBuildNumber)
140+ _In_ ULONG NtBuildNumber,
141+ _In_opt_ LPCWSTR DllPath,
142+ _In_ BOOL QueryTest
143+ )
141144{
142145 NTSTATUS ntStatus;
143146 ULONG loadedImageSize;
@@ -156,13 +159,19 @@ ULONG_PTR DebugQueryCurrentCiOptionsAddress(
156159 return 0 ;
157160 }
158161
159- if (!GetSystemDirectoryW (szFullModuleName, MAX_PATH)) {
160- printf_s (" [!] GetSystemDirectoryW failed, gle=%lu\r\n " , GetLastError ());
161- return 0 ;
162- }
162+ if (QueryTest) {
163+ _strcpy (szFullModuleName, DllPath);
164+ }
165+ else {
166+
167+ if (!GetSystemDirectoryW (szFullModuleName, MAX_PATH)) {
168+ printf_s (" [!] GetSystemDirectoryW failed, gle=%lu\r\n " , GetLastError ());
169+ return 0 ;
170+ }
163171
164- _strcat (szFullModuleName, L" \\ " );
165- _strcat (szFullModuleName, CI_DLL);
172+ _strcat (szFullModuleName, L" \\ " );
173+ _strcat (szFullModuleName, CI_DLL);
174+ }
166175
167176 mappedImageBase = LoadLibraryEx (szFullModuleName, NULL , DONT_RESOLVE_DLL_REFERENCES);
168177 if (mappedImageBase == NULL ) {
@@ -237,7 +246,7 @@ VOID KDUTestLoad()
237246
238247VOID KDUTestDSE (PKDU_CONTEXT Context)
239248{
240- ULONG_PTR g_CiOptions = DebugQueryCurrentCiOptionsAddress (USER_SHARED_DATA->NtBuildNumber );
249+ ULONG_PTR g_CiOptions = DebugQueryCurrentCiOptionsAddress (USER_SHARED_DATA->NtBuildNumber , NULL , FALSE );
241250 ULONG_PTR oldValue = 0 , newValue = 0x0 , testValue = 0 ;
242251 KDU_PROVIDER* prov = Context->Provider ;
243252
@@ -263,6 +272,17 @@ VOID KDUTestDSE(PKDU_CONTEXT Context)
263272 }
264273}
265274
275+ VOID KDUTestDSEQuery (
276+ _In_ ULONG NtBuildNumber
277+ )
278+ {
279+ ULONG_PTR g_CiOptions = DebugQueryCurrentCiOptionsAddress (NtBuildNumber, L" C:\\ Dumps\\ CI_26100_8246.dll" , TRUE );
280+ if (g_CiOptions == 0 )
281+ printf_s (" [!] g_CiOptions not found\r\n " );
282+ else
283+ printf_s (" [+] g_CiOptions %llX" , g_CiOptions);
284+ }
285+
266286BOOL WINAPI TestPhysMemEnumCallback (
267287 _In_ ULONG_PTR Address,
268288 _In_ PVOID UserContext)
@@ -492,8 +512,9 @@ VOID KDUTest()
492512{
493513 PKDU_CONTEXT Context;
494514
495- // KDUTestLoad();
496- // TestSymbols();
515+ // KDUTestLoad();
516+ // TestSymbols();
517+ // KDUTestDSEQuery(NT_WIN11_24H2);
497518 Context = KDUProviderCreate (KDU_PROVIDER_SHANGKE_WHD,
498519 FALSE ,
499520 NT_WIN10_20H1,
0 commit comments