search

adrianyy / kernelhook

Windows inline hooking tool.
205 stars 62 forks source link

Hooking inside windows 11 #1

Open behzad62 opened 1 year ago

behzad62 commented 1 year ago

Hi, thanks for this useful repo. When I try to hook a function inside a VM (win 11), it works fine, but when I test it outside the VM on win 11 it will result to System_Service_Exception with access violation bug check as soon as it tries to replace hooked functions bytes inside ReplaceCore16Bytes function (cppxchg16b instruct). Any idea why this might happen?

stevenjoezhang commented 1 month ago

@behzad62 Hello, I encountered exactly the same issue. It works fine on Windows 10, but on Windows 11, it throws an exception when executing cmpxchg16b. Have you found a solution? I’m not sure if this is caused by some new security mechanisms in Windows 11.

stevenjoezhang commented 1 month ago

I found that the issue was resolved after disabling memory integrity. Here are the steps I followed:

Open "Windows Security Center", and then go to "Privacy and Security", then go to "Device Security", click on "Kernel Isolation Details" on the right, and finally turn off "Memory Integrity"