conceptually the driver is great (excluding the lack of exception handling everywhere, and hardcoded cr3), but im pretty sure the kep hooks and callbacks aren't patchguard compliant. results in a bluescreen when using communication / the hooked(kep) exports are called / possibly more.
however, the etw hooking is fine, and maybe the shadow mapping (create_hyperspace + remap_hyperspace) is fine, but that's about it.
anywhere where an "unused" region of memory is overwritten with shellcode will eventually cause a stack corruption with a bugcheck 4 code of 0 when patchguard checks the nt image. though, i might be wrong; i'm not like einstein with the windows kernel.
conceptually the driver is great (excluding the lack of exception handling everywhere, and hardcoded cr3), but im pretty sure the kep hooks and callbacks aren't patchguard compliant. results in a bluescreen when using communication / the hooked(kep) exports are called / possibly more.
however, the etw hooking is fine, and maybe the shadow mapping (create_hyperspace + remap_hyperspace) is fine, but that's about it.
anywhere where an "unused" region of memory is overwritten with shellcode will eventually cause a stack corruption with a bugcheck 4 code of 0 when patchguard checks the nt image. though, i might be wrong; i'm not like einstein with the windows kernel.