osu!rise kernel — decompiled source

Reconstructed source from osurise-kernel.exe — a native x64 osu! cheat with an embedded kernel driver. Decompiled using Ghidra 12.0.4 headless (osurise_kernel_decompile.txt, 12,420 functions, 22 MB).

---

Architecture

osurise-kernel.exe  (native x64, ~5 MB)
├── Embedded PE #1  (offset 0x43C580, ~45 KB)   → iqvw64e.sys  [NAL kernel driver]
├── Embedded PE #2  (offset 0x54CAD0, ~100 KB)  → OTD hook DLL [OpenTabletDriver payload]
└── Embedded PE #3  (offset 0x565ED0)            → unknown payload

The binary is a standalone .exe (not a DLL injector). It runs alongside osu!, overlays the game window via D3D11 + DComposition, and interacts with the game process through kernel memory reads.

---

Folder structure

osurise_kernel/
├── types.h                     shared types (Vec2, HitObject, ParsedBeatmap, NalRequest, enums)
├── globals.h                   extern declarations for all shared globals
│
├── driver/
│   ├── README.txt              full IOCTL reference for the NAL driver
│   └── nal_driver.c            kernel driver — DriverEntry, IOCTL dispatcher, all sub-functions
│
├── anticheat/
│   ├── README.txt              bypass technique descriptions + decompile line references
│   ├── syscall_bypass.c        ntdll disk-map + 8 NT stub backup (FN #2217)
│   ├── kernel_patcher.c        kernel pattern scan + patch via NAL IOCTL (FN #3617)
│   ├── otd_injector.c          OpenTabletDriver DLL injection (FN #2815)
│   └── driver_loader.c         NtLoadDriver / NtUnloadDriver wrapper
│
├── features/
│   ├── README.txt
│   ├── aim_assist.c            v4-style aim assist → SetCursorPos output (FN #1453 area)
│   └── beatmap.c               .osu file parser reading from \osu\exports\
│
├── gamestate/
│   ├── README.txt
│   ├── memory_reader.h
│   └── memory_reader.c         kernel R/W via NAL IOCTL 0x33, process R/W via NtReadVirtualMemory
│
├── network/
│   ├── README.txt
│   └── comms.c                 WebSocket client (IXWebSocket-based C&C)
│
├── ui/
│   ├── README.txt
│   └── overlay.c               D3D11 + DComposition transparent overlay window
│
└── startup/
    ├── README.txt
    └── init.c                  3x TLS callbacks + WinMain sequencing

---

Key techniques

Technique	File	Decompile ref
BYOVD — load signed vulnerable iqvw64e.sys	driver/nal_driver.c	NtLoadDriver at line 637303
Syscall stub backup — map ntdll from disk, save original NT stubs	anticheat/syscall_bypass.c	FN #2217, lines 171311–171477
Kernel patch — byte-sig scan ntoskrnl, patch via NAL	anticheat/kernel_patcher.c	FN #3617, lines 281481–281600
OTD injection — remote LoadLibraryW into OpenTabletDriver	anticheat/otd_injector.c	FN #2815, lines 207724–207922
NAL IOCTL — kernel R/W via DeviceIoControl(0x80862007)	gamestate/memory_reader.c	line 281579
Aim assist — SetCursorPos after field-space correction	features/aim_assist.c	FN #1453, line 122744
Beatmap parser — reads ParsedBeatmap::Data from \osu\exports	features/beatmap.c	lines 209644, 230404
D3D11 + DComp overlay	ui/overlay.c	D3D11CreateDeviceAndSwapChain, DCompositionCreateDevice
IXWebSocket C&C	network/comms.c	ix::WebSocket, ix::HttpClient strings
Lua scripting	(not translated)	embedded Lua VM found in binary
Crypto++	(not translated)	ECDSA/SHA-256/AES for auth + packet signing

---

Embedded driver: NAL (iqvw64e.sys)

The driver is a clone of Intel's Network Adapter Diagnostic driver — a known BYOVD target. It provides a kernel-mode R/W primitive to the user-mode cheat through:

• IOCTL_NAL_MEMORY (0x80860007) — virtual memory R/W, atomics, pool alloc, MDL mapping
• IOCTL_NAL_PORT (0x8086000f) — I/O port access
• IOCTL_NAL_PCIBUS (0x8086000b) — PCI bus config read/write

The main binary uses a variant IOCTL 0x80862007 suggesting a modified driver version.

---

Anti-cheat bypass chain

TlsCallback0 fires before any managed code runs
    │
    ├─ SyscallBypass_Init()
    │    Maps ntdll.dll from disk → saves original syscall stubs for 8 NT functions
    │    Any usermode hooks by anti-cheat on NtReadVirtualMemory etc. are bypassed
    │
    ├─ DriverLoader_Load()
    │    Drops iqvw64e.sys → NtLoadDriver → opens \\.\Nal device
    │
    ├─ KernelPatcher_Apply()
    │    NtQuerySystemInformation → find ntoskrnl base
    │    NAL IOCTL 0x33 → read kernel image into heap
    │    Pattern scan across 4 OS-version byte signatures → locate target function
    │    NAL IOCTL 0x33 → write 3-byte patch (xor eax,eax; ret) into kernel
    │
    └─ OtdInjector_Run()
         FindProcess(OpenTabletDriver.Daemon.exe)
         Extract DLL from resources → %TEMP%\<random>.tmp
         CreateRemoteThread(LoadLibraryW) → hooks tablet input

---

Dependencies (embedded in binary)

• IXWebSocket — WebSocket + HTTP client
• Crypto++ — cryptography (AES, ECDSA, SHA-256, Rijndael)
• ImGui — immediate-mode GUI for overlay
• Lua VM — scriptable cheat logic
• D3D11 / DXGI / DComp — overlay rendering pipeline