{
  "added_at": "2026-11-06",
  "category": "dynamic-analysis",
  "description_en": "Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. The C++ program finds the service process, resolves the remote function address and applies a six-byte patch to study the effect on prefetch behavior.",
  "description_zh": "Patch-0xC0000022 修改运行中的 Windows SysMain 服务，使 NtCreateFile 返回 STATUS_ACCESS_DENIED。该 C++ 程序定位服务进程和远程函数地址，再应用六字节补丁，以研究预取行为的变化。",
  "entry_url": "https://awesomerea.org/resources/patch-0xc0000022/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/patch-0xc0000022/",
  "evidence_url": "https://github.com/Harryson3001/Patch-0xC0000022/blob/fdce6b22c293cba15d6cc991018f4bbf285d8f7d/README.md",
  "group": "tools",
  "id": "patch-0xc0000022",
  "json_url": "https://awesomerea.org/resources/patch-0xc0000022/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/patch-0xc0000022/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/patch-0xc0000022/index.md",
  "name": "Patch-0xC0000022",
  "name_zh": "Patch-0xC0000022 SysMain 运行时研究工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "scope",
    "limits",
    "license"
  ],
  "requirements": [
    "Windows 10 or 11 x64, Visual Studio C++ tools and administrator permission are required.",
    "The source calls for a controlled test environment and says restarting Windows restores runtime state.",
    "Restoring or removing the patch is listed as future work.",
    "No licence file in the repository."
  ],
  "requirements_zh": [
    "需要 Windows 10 或 11 x64、Visual Studio C++ 工具和管理员权限。",
    "文档要求在受控测试环境中使用，并说明重启 Windows 可恢复运行时状态。",
    "恢复或移除补丁仍列在后续计划中。",
    "仓库中没有许可证文件。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/Harryson3001/Patch-0xC0000022",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}