Win10 19041 fail

[oxlwj]

1: kd> dt nt!_WMI_LOGGER_CONTEXT ffffcb03`f9b0c4c0
+0x000 LoggerId : 2
+0x004 BufferSize : 0x1000
+0x008 MaximumEventSize : 0xfb8
+0x00c LoggerMode : 0x2800480
+0x010 AcceptNewEvents : 0n0
+0x014 EventMarker : [2] 0xc0130000
+0x01c ErrorMarker : 0xc00d0000
+0x020 SizeMask : 0xffff
+0x028 GetCpuClock : 3 //is not function adress

[hzqst]

1: kd> dt nt!_WMI_LOGGER_CONTEXT ffffcb03`f9b0c4c0
+0x000 LoggerId : 2
+0x004 BufferSize : 0x1000
+0x008 MaximumEventSize : 0xfb8
+0x00c LoggerMode : 0x2800480
+0x010 AcceptNewEvents : 0n0
+0x014 EventMarker : [2] 0xc0130000
+0x01c ErrorMarker : 0xc00d0000
+0x020 SizeMask : 0xffff
+0x028 GetCpuClock : 3 //is not function adress

Microsoft has patched this hook. try ByePg or something else...

[FiYHer]

1: kd> dt nt!_WMI_LOGGER_CONTEXT ffffcb03`f9b0c4c0
+0x000 LoggerId : 2
+0x004 BufferSize : 0x1000
+0x008 MaximumEventSize : 0xfb8
+0x00c LoggerMode : 0x2800480
+0x010 AcceptNewEvents : 0n0
+0x014 EventMarker : [2] 0xc0130000
+0x01c ErrorMarker : 0xc00d0000
+0x020 SizeMask : 0xffff
+0x028 GetCpuClock : 3 //is not function adress

Microsoft has patched this hook. try ByePg or something else...

可以试试看这个,我也没有尝试过,不过应该可行 https://hub.fastgit.org/fIappy/infhook19041