# Patch-0xC0000022 > Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. The C++ program finds the service process, resolves the remote function address and applies a six-byte patch to study the effect on prefetch behavior. - Type: Tool - Targets: App - Category: Debugging and dynamic analysis - Relationship: Foundation tool - Sources reviewed: 2026-11-06 - Added to the catalog: 2026-11-06 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/patch-0xc0000022/index.md) ## Requirements & limits - **Prerequisites:** Windows 10 or 11 x64, Visual Studio C++ tools and administrator permission are required. - **Scope:** The source calls for a controlled test environment and says restarting Windows restores runtime state. - **Limits:** Restoring or removing the patch is listed as future work. - **License:** No licence file in the repository. ## Primary sources 1. ## More in Native binaries - [iMonitor](https://awesomerea.org/resources/imonitor-system-activity-monitor/index.md) · Tool - [m68kdasm](https://awesomerea.org/resources/m68kdasm/index.md) · Tool - [IR Lifting Benchmark](https://awesomerea.org/resources/ir-lifting-benchmark/index.md) · Tool - [Bin-Hunter](https://awesomerea.org/resources/bin-hunter/index.md) · Tool - [BinaryInsight](https://awesomerea.org/resources/binaryinsight/index.md) · Tool - [rust-sig-gen](https://awesomerea.org/resources/rust-sig-gen/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.