Skip to content
This repository was archived by the owner on Dec 5, 2024. It is now read-only.

Latest commit

 

History

History
13 lines (9 loc) · 1.14 KB

README.md

File metadata and controls

13 lines (9 loc) · 1.14 KB

Declipt is now defunct. There is a fork of Declipt called Debird where development has continued.

Declipt

Special Thanks

…to WitherOrNot for researching and cracking Warbird.

Usage

To use Declipt, clone the Git repository, create a folder called emu64 in the project root, and put ClipSp.sys into emu64. Make sure you adjust the addresses in declipt::constants to match your version of ClipSp.sys.

Important

For ClipSp.sys

You must patch ClipSp.sys's true main entrypoint (you can find this in IDA Pro using CTRL+E) to return 1. The patched bytes are available in declipt::hook::CANCEL_DRIVER_ENTRY. Then, you need to create fake kernel imports for NTOSKRNL.EXE, FLTMGR.SYS, HAL.DLL, and KSECDD.SYS. Next, put the fake kernel imports in emu64. Finally, set the 0x2000 (File is a DLL) flag in ClipSp.sys. You can use PE Bear for this.