Contact person: Windows 11 Driver Hook Adaptation -- 2

Phone:Show

Email:Show

Location: Toronto, Canada

Budget: Recommended by industry experts

Time to start: As soon as possible

Project description:
"Project Overview:
I have a working Windows kernel driver that uses function pointer hooking in [login to view URL], specifically targeting NtGdiPolyPolyDraw+0x366. The driver works perfectly on Windows 10 but fails on Windows 11 due to structural changes in [login to view URL] that make the hardcoded offset invalid.
Current Implementation:

Hooks a function pointer at NtGdiPolyPolyDraw+0x366 in [login to view URL]
Uses .data pointer hooking technique for kernel-usermode communication
Full source code available at: [login to view URL]

What I Need:

Research and locate the equivalent hook point in Windows 11's [login to view URL]
Implement dynamic offset detection or version-specific offsets to maintain Windows 10 compatibility
Ensure the hook mechanism functions identically on both OS versions

Technical Requirements:

The hook point must be a reliable function pointer in [login to view URL] .data section
Should maintain the same calling convention and behavior as the Windows 10 implementation
Must work with Memory Integrity/HVCI disabled

Required Skills & Tools:

Reverse Engineering: IDA Pro, Ghidra, or x64dbg experience
Windows Kernel Development: WDK, kernel debugging, driver development
Binary Analysis: Pattern recognition, signature scanning, offset calculation
Windows Internals: Understanding of win32k subsystem and kernel structures

Deliverables:

Updated driver source code supporting both Windows 10 and Windows 11
Brief documentation explaining the new hook point location" (client-provided description)