Introducing Windhawk, the customization marketplace for Windows programs! Windhawk is a platform for developing and sharing mods (customization modules) for Windows. Each mod is a C++ snippet which is injected into other programs. ramensoftware.com/windhawk windhawk.net/

NtDoc features integration with Gabriela Cristei’s Benowin Blanc project! It is now possible to inspect the following directly within the NtDoc tab: • Struct layouts and field offsets • Enum values and constants • #​define macros • Function declarations with ABI breakdowns

Mystery: The Opera UI process (not sandboxed) is unable to call SendInput, which fails with ERROR_ACCESS_DENIED. The error is returned in win32kfull!xxxInternalKeyEventDirect: RtlAreAllAccessesGranted(thread_info->amdesk, DESKTOP_JOURNALPLAYBACK) Any idea what mitigation is that?

Check out the KUSER_SHARED_DATA docs that were submitted to NtDoc by @sixtyvividtails, and are probably the most comprehensive source of information about this struct known to humanity. ntdoc.m417z.com/kuser_shared… Also featured on @pagedout_zine, issue #7, page 33, check it out!

Quiz: What will happen when this program is run with these gflags?

NtDoc has been updated with definitions from the official Windows Driver Kit DDI reference and portions of the Win32 API reference. This update reduces the need to switch between NtDoc and Microsoft Docs, addressing one of the most common suggestions. ntdoc.m417z.com/

NtDoc has been updated with definitions and documentation from the official Windows Driver Kit DDI reference and portions of the Win32 API reference. This update reduces the need to switch between NtDoc and Microsoft Docs, addressing one of the most common suggestions for NtDoc.

Another gap with waiting for all threads is that by having my extra thread exit last, it determines the process exit code, which would otherwise be determined by the last thread. This may have side effects, and I can't think of a simple way for the extra thread to fake it.

Problem: I create a thread in a program and wait for events. Usually, a program exits with ExitProcess. But in rare cases, ExitThread is called, explicitly or by returning from the native entry point. What's the best way to detect that and exit? i.e. I want a "weak thread".

Quiz: Paste this command in Win+R and run it, what will happen? gist.github.com/m417z/4ba3bb… I was debugging some batch script which cleans up temp files. I grabbed a line, pasted it in Win+R for testing, and something unexpected happened. Luckily in a VM. WTF Microsoft?

I had to adjust the stack walking code for ARM64. Luckily, I found an implementation in the Chromium codebase. Surely it must be solid and well-tested, right? Well, turns out that the case of a syscall returning back to user mode wasn't supported. The fix: chromium-review.googlesource…

Good to know I'm absolutely right, thanks ChatGPT!

Suppose you injected/loaded a DLL and hooked some functions. At some point you remove the hooks to unload the DLL. How can you be sure it's safe? I didn't see any hooking library or any written material that discusses this. Here's my take on the subject: github.com/m417z/thread-call…

Process initialization question: Why would console creation (specifically, NtDeviceIoControlFile in ConsoleLaunchServerProcess) dispatch pending APCs? I expected my APC to be dispatched in NtTestAlert, not earlier.