NotCapengeR
NotCapengeR
Starting from Windows 11 24H2, Microsoft has implemented a new [Control Flow Guard or CFG](https://ynwarcs.github.io/Win11-24H2-CFG) system, which should limit the places where the application can execute code. You can read...
So, I did get an Ntdll sample from Windows 11 24H2. The `RtlpInsertOrRemoveScpCfgFunctionTable` function is not exported, so patching it by offset is not a good idea, but I found...
> @NotCapengeR I have, too, realized, that Windows 24H2 broke RunPE, so I stumbled upon your suggestion. I tried it (with `VirtualProtectEx` before `WriteProcessMemory`), but without success, yet. I will...
> Hi, finally I've got some time, and access to Windows 11 24H2, and started to check it. > > First of all, in this variant of RunPE, there is...
> RtlpInsertOrRemoveScpCfgFunctionTable has no effect on the enablement of CFG. The only thing it does is to add exception handlers to handle any exception happening in the CFG function, if...
> > [@harunkocacaliskan](https://github.com/harunkocacaliskan) - I tested it on [Windows 11 24H2](https://support.microsoft.com/en-us/topic/windows-11-version-24h2-update-history-0929c747-1815-4543-8461-0160d16f15e5), [Build 26100.2894](https://support.microsoft.com/en-us/topic/january-14-2025-kb5050009-os-build-26100-2894-d78f27bc-6405-461f-a525-2d1dc4e45759), which is the latest up to date (excluding the Preview), and both 32 and 64-bit versions worked...
@hasherezade well, looks like both functions, `NtManageHotPatch` and `NtQueryVirtualMemory` are required a patch (32-/64-bits). I still can't figure it out: is Microsoft doing this intentionally or is it a side-effect...
> I see where exactly it is coming from, indeed the simplest way to get rid of it is to patch `NtManagePatch`. > > 1. `LdrpQueryCurrentPatch` is called on the...
You need to hook `GetCommandLineW` & `GetCommandLineA` functions; CRT uses them for initialize the globals: `__p___argc`, `__p___argv` and `__p___wargv`:  Btw, some programs prefer not to use CRT, but to...
You can try to use `NtCurrentPeb` macro: ```cpp inline PPEB get_peb() { return NtCurrentPeb(); } ```