Skip to content

rhaym-tech/Win11PtrSwap

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

NtUserHook

Minimal kernel-usermode communication framework using a Win32k syscall hook (NtUserXxx).

Syscall

In our case we're hooking (NtUserGetPointerProprietaryId), and the reason is that I liked the signature that takes only 2 params and this syscall is not a hotpath (not being called often by original Windows components which means no performance impact on the system).

You can change the syscall to any NtUserXxx you like by simply changing the pointers chain offsets and call type in both of usermode and kernel mode.

Contribution

Feel free to open a PR if you wish to add/modify something

About

Windows 11 compatible NtUserXxx syscall hook inside Win32k with PoC implementation and Usermode framework in both of C and C++

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors