Hooking inside windows 11

[behzad62]

Hi, thanks for this useful repo. When I try to hook a function inside a VM (win 11), it works fine, but when I test it outside the VM on win 11 it will result to System_Service_Exception with access violation bug check as soon as it tries to replace hooked functions bytes inside ReplaceCore16Bytes function (cppxchg16b instruct).
Any idea why this might happen?

[stevenjoezhang]

@behzad62 Hello, I encountered exactly the same issue. It works fine on Windows 10, but on Windows 11, it throws an exception when executing cmpxchg16b. Have you found a solution? I’m not sure if this is caused by some new security mechanisms in Windows 11.

[stevenjoezhang]

I found that the issue was resolved after disabling memory integrity. Here are the steps I followed:

Open "Windows Security Center", and then go to "Privacy and Security", then go to "Device Security", click on "Kernel Isolation Details" on the right, and finally turn off "Memory Integrity"