Crash in 22H2 and nothing in 25H2

[juzt3]

how title says this are my results, a crash and in 25h2 it displays 4 lines and then it closes. i obviously have notepad opened

[krispybyte]

What is your exact windows build (e.g. 10.0.26100.7627)? Or if you can provide a hash of your ntoskrnl.exe so I check
Can you provide a crash dump?

[krispybyte]

I've just tested, the issue on 25h2 where you only get a few lines printed and then the program occurs when the vulnerable driver the project use - athpexnt.sys is not loaded. Be sure to load it.

As for 22h2, have you updated all of the gadget offsets?

[TempAccountNull]

I've just tested, the issue on 25h2 where you only get a few lines printed and then the program occurs when the vulnerable driver the project use - athpexnt.sys is not loaded. Be sure to load it.

As for 22h2, have you updated all of the gadget offsets?

You need to copy your ntoskrnl.exe from your system folder. Do NOT move it!

copy C:\\Windows\\System32\\ntoskrnl.exe Windows10-22H2\\KB-19045.6691.exe

Important

Some ntoskrnl.exe files are not uploaded on the MSFT server, but the pdb's are!
So, to remedy this, you'd have to get a local copy per version from the machine.

Why this happens

• One of the reasons for this that I can see, for example Windows 10 22H2 is not currently supported as the website.
  • It does not support it and various other versions that are pushed. You have to make a script for it manually.
• The ntoskrnl itself is not published on the backend, but the pdb is!

Supporting a custom NTOSKRNL to update offsets

For the Rop scanner to support the new generated folder alongside the json file.
Example: The website supports up to 19041 but not 19045. For Windows 10 ESU.

Two that I have
Windows10-22H2.zip

KB-19045.6691.exe 
EXE: https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/98D4189901046000/ntoskrnl.exe 
PDB: https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/D77BCF89B92E26FDE60AE34C894DAE371/ntkrnlmp.pdb

KB-19041.6807.exe
EXE: https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/2FBE967601046000/ntoskrnl.exe
PDB: https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/DFE5A00EF3F2E5952C223D63ED6EEAB01/ntkrnlmp.pdb

Fixing generate_gadgets.py to support our manual overrides

File: download_ntoskrnl.py

            # Skip download for local files
            if url == "Local System Copy" or url == "Local File" or not url.startswith('http'):
                if os.path.exists(filepath):
                    print(f"  [✓] Local file found: {filename}")
                else:
                    print(f"  [!] Local file missing: {filename}")
                    print(f"      Expected at: {filepath}")
                continue

• The Script I use so you can verify that ropper gets the required gadgets in `Gadgets` folder.

Fixed file

def download_ntoskrnl_files():
    json_files = [f for f in os.listdir() if f.endswith('.json')]

    for file in json_files:
        folder_name = os.path.splitext(file)[0]

        if not os.path.exists(folder_name):
            os.makedirs(folder_name)

        print(f"\n📁 Processing {file}")

        with open(file, 'r', encoding='utf-8') as f:
            try:
                data = json.load(f)
            except json.JSONDecodeError:
                print(f"  [!] Invalid JSON in {file}, skipping.")
                continue

        for entry in data:
            if entry.get("Name", "").lower() != "ntoskrnl.exe":
                continue

            kb = entry.get("KB")
            version = entry.get("File Version")
            url = entry.get("Download Link")
            expected_hash = entry.get("Hash", "").lower()

            if not all([kb, version, url]):
                print("  [!] Incomplete entry, skipping.")
                continue

            sanitized_kb = sanitize_filename(kb)
            sanitized_version = sanitize_filename(version)
            filename = f"{sanitized_kb}-{sanitized_version}.exe"
            filepath = os.path.join(folder_name, filename)

            if os.path.exists(filepath):
                actual_hash = calculate_sha256(filepath)
                if actual_hash == expected_hash:
                    print(f"  [✓] Exists and verified: {filename}")
                    continue
                else:
                    print(f"  [↻] Hash mismatch for {filename}, re-downloading...")
                    
            # ADDED: Skip download for local files
            if url == "Local System Copy" or url == "Local File" or not url.startswith('http'):
                if os.path.exists(filepath):
                    print(f"  [x] Local file found: {filename}")
                else:
                    print(f"  [!] Local file missing: {filename}")
                    print(f"      Expected at: {filepath}")
                continue
            
            print(f"  [↓] Downloading: {filename}")
            success = download_file(url, filepath)

            if success:
                actual_hash = calculate_sha256(filepath)
                if actual_hash == expected_hash:
                    print(f"  [✔] Downloaded and verified: {filename}")
                else:
                    print(f"  [✗] Hash mismatch after download: {filename} (but file kept)")
            else:
                print(f"  [✗] Failed to download: {filename}")

if __name__ == "__main__":
    download_ntoskrnl_files()

Custom Script Generation file

# create_local_json_version.py
import hashlib
import json
import os
import re
import shutil

def calculate_sha256(filepath):
    """Calculate SHA256 hash of a file"""
    sha256 = hashlib.sha256()
    with open(filepath, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            sha256.update(chunk)
    return sha256.hexdigest()

def sanitize_filename(name):
    """Remove invalid Windows filename characters"""
    cleaned = re.sub(r'[<>:"/\\|?*+()]', '', name)
    cleaned = re.sub(r'\s+', '', cleaned)  # Remove extra spaces
    return cleaned

def parse_filename(filename):
    """
    Extract KB and version from filename
    Handles formats like:
    - KB5012345-10.0.19045.6691.exe
    - KB-19045.6691.exe
    - ntoskrnl-19045.6691.exe
    """
    # Remove .exe extension
    name = filename.replace('.exe', '')
    
    # Try to extract KB number
    kb_match = re.search(r'(KB\d+)', name, re.IGNORECASE)
    kb = kb_match.group(1) if kb_match else "KB-Manual"
    
    # Try to extract version (looks for pattern like 10.0.19045.6691 or 19045.6691)
    version_match = re.search(r'(\d+\.\d+\.\d+\.\d+)', name)
    if version_match:
        version = version_match.group(1)
        # Ensure it starts with 10.0.
        if not version.startswith('10.0.'):
            version = f"10.0.{version}"
    else:
        # Try short version (just build.revision like 19045.6691)
        short_version_match = re.search(r'(\d{5}\.\d+)', name)
        if short_version_match:
            version = f"10.0.{short_version_match.group(1)}"
        else:
            version = "Unknown"
    
    return kb, version

def create_json_from_folder(folder_path="Windows10-22H2", output_json="Windows10-22H2.json"):
    """
    Scans folder for all .exe files, renames them to standard format, and creates JSON
    
    Args:
        folder_path: Path to folder containing .exe files
        output_json: Output JSON filename
    """
    
    if not os.path.exists(folder_path):
        print(f"Error: Folder not found: {folder_path}")
        print(f"\nPlease create the folder and copy ntoskrnl.exe files:")
        print(f"  mkdir {folder_path}")
        print(f"  copy C:\\Windows\\System32\\ntoskrnl.exe {folder_path}\\KB-19045.6691.exe")
        return
    
    # Find all .exe files in the folder (not in subfolders like Gadgets/)
    exe_files = [f for f in os.listdir(folder_path) 
                 if f.endswith('.exe') and os.path.isfile(os.path.join(folder_path, f))]
    
    if not exe_files:
        print(f"Error: No .exe files found in {folder_path}")
        print(f"\nPlease copy your ntoskrnl.exe:")
        print(f"  copy C:\\Windows\\System32\\ntoskrnl.exe {folder_path}\\KB-19045.6691.exe")
        return
    
    print(f"Found {len(exe_files)} .exe file(s) in {folder_path}/")
    print(f"Processing files...\n")
    
    all_entries = []
    
    for filename in sorted(exe_files):
        old_path = os.path.join(folder_path, filename)
        
        print(f"Processing: {filename}")
        
        # Parse KB and version from filename
        kb, version = parse_filename(filename)
        print(f"  KB: {kb}")
        print(f"  Version: {version}")
        
        # Create standardized filename that download_ntoskrnl.py expects
        sanitized_kb = sanitize_filename(kb)
        sanitized_version = sanitize_filename(version)
        new_filename = f"{sanitized_kb}-{sanitized_version}.exe"
        new_path = os.path.join(folder_path, new_filename)
        
        # Rename file if needed
        if old_path != new_path:
            if os.path.exists(new_path):
                print(f"  [!] Target file already exists: {new_filename}")
            else:
                print(f"  [↻] Renaming to: {new_filename}")
                shutil.move(old_path, new_path)
        
        # Calculate hash on the final filename
        print(f"  Calculating SHA256...", end=' ')
        file_hash = calculate_sha256(new_path)
        print("done.")
        
        # Create entry
        entry = {
            "Name": "ntoskrnl.exe",
            "KB": kb,
            "Hash": file_hash,
            "File Version": version,
            "Download Link": "Local System Copy"
        }
        all_entries.append(entry)
        print()
    
    # Write JSON file
    with open(output_json, 'w', encoding='utf-8') as f:
        json.dump(all_entries, f, indent=4)
    
    print(f"✓ Created {output_json} with {len(all_entries)} entries")
    print(f"\nNext steps:")
    print(f"  python download_ntoskrnl.py  (will verify files exist)")
    print(f"  python generate_gadgets.py   (will generate gadgets)")

if __name__ == "__main__":
    # Automatically process Windows10-22H2 folder
    create_json_from_folder("Windows10-22H2", "Windows10-22H2.json")

This will generate Windows10-22H2.json and all files within the folder

[
    {
        "Name": "ntoskrnl.exe",
        "KB": "KB-Manual",
        "Hash": "0e44d8c90fbec261066898cd41a24d15b6cea5581ed4b7b1c67dd05b4c12e4bb",
        "File Version": "10.0.19041.6691",
        "Download Link": "Local System Copy"
    },
    {
        "Name": "ntoskrnl.exe",
        "KB": "KB-Manual",
        "Hash": "fb3347be01f878bd2a8d769020193a2d0cc1c45b265fe3f513a2784f096c0235",
        "File Version": "10.0.19041.6807",
        "Download Link": "Local System Copy"
    }
]

• You can now continue running ropper on your custom version folder. (Only currently supports 22H2 Win 10)

Warning

The folder name Windows10-22H2 is hard-coded. You will need to update this manually in the py.

[Windows10-22H2] Generating gadgets for 2 file(s). Output dir: Windows10-22H2\Gadgets
  - Running ropper on: KB-Manual-10.0.19041.6691.exe ... done.
  - Running ropper on: KB-Manual-10.0.19041.6807.exe ... done.