KiFilterFiberContext/warbird-hook

This is stars and forks stats for /KiFilterFiberContext/warbird-hook repository. As of 29 Apr, 2024 this repository has 198 stars and 27 forks.

Warbird Hook On Windows 10 21H2, ntoskrnl.exe contains a table of pointers named g_kernelCallbacks used for licensing checks (called from nt!SPCall2ServerInternal). The callback table contains pointers to functions in an image named ClipSp.sys, which is a signed driver protected by Microsoft Warbird . The interesting thing about it is that PatchGuard does not verify the integrity of several image sections, including PAGEwx, which the driver contains in order to decrypt and re-encrypt its own code...