Tool
Patch-0xC0000022
Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. The C++ program finds the service process, resolves the remote function address and applies a six-byte patch to study the effect on prefetch behavior.
- Targets
- App
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Windows 10 or 11 x64, Visual Studio C++ tools and administrator permission are required.
- Scope: The source calls for a controlled test environment and says restarting Windows restores runtime state.
- Limits: Restoring or removing the patch is listed as future work.
- License: No licence file in the repository.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · Harryson3001/Patch-0xC0000022 · Revision fdce6b2
More in Native binaries
- iMonitor · Tool
- m68kdasm · Tool
- IR Lifting Benchmark · Tool
- Bin-Hunter · Tool
- BinaryInsight · Tool
- rust-sig-gen · Tool