Undetected [Source] Windows Kernel — Complete Monitor HWID Spoofing via WMI & Registry EDID Hooking (C++)

[byte_corvus]

Been seeing a lot of P2C loaders pulling "monitor spoofing" lately, but most of them are incomplete pastes. If you’re only hooking WMI, you’re missing the EDID stored in the registry, and any half-decent anti-cheat check will compare the two and flag the discrepancy.

Found this build in a private group and figured I’d drop the proper implementation. It handles both WMI and EDID in the registry to ensure your spoofed data is actually consistent across the system.

Technical Breakdown:

1. WMI Hooking: Hooks \Driver\monitor, intercepts IRP_MJ_SYSTEM_CONTROL, and manages IRP_MN_QUERY_ALL_DATA. It edits WmiMonitorID in-place.
2. Registry Patching: Iterates through HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY and modifies the EDID binary data directly.
3. Integrity: It fixes the EDID checksum after patching, so the spoofed display parameters remain valid and don't trigger monitor handshake issues.
4. Persistence: Uses seeded randomness so the spoofed hardware ID stays consistent per system, rather than changing every time you reload the driver.

#define WNODE_FLAG_FIXED_INSTANCE_SIZE 0x00000010
 typedef struct _WNODE_HEADER {
    ULONG   BufferSize;
    ULONG   ProviderId;
    union {
        ULONG64 HistoricalContext;
        struct { ULONG Version; ULONG Linkage; };
    };
    union {
        ULONG         CountLost;
        HANDLE        KernelHandle;
        LARGE_INTEGER TimeStamp;
    };
    GUID  Guid;
    ULONG ClientContext;
    ULONG Flags;
} WNODE_HEADER, *PWNODE_HEADER;

 typedef struct {
    ULONG OffsetInstanceData;
    ULONG LengthInstanceData;
} OFFSETINSTANCEDATAANDLENGTH, *POFFSETINSTANCEDATAANDLENGTH;

 typedef struct _WNODE_ALL_DATA {
    WNODE_HEADER WnodeHeader;
    ULONG        DataBlockOffset;
    ULONG        InstanceCount;
    ULONG        OffsetInstanceNameOffsets;
    union {
        ULONG                        FixedInstanceSize;
        OFFSETINSTANCEDATAANDLENGTH  OffsetInstanceDataAndLength [ 1 ];
    };
} WNODE_ALL_DATA, *PWNODE_ALL_DATA;

 typedef struct _WmiMonitorID {
    USHORT ProductCodeID       [ 16 ];
    USHORT SerialNumberID      [ 16 ];
    USHORT ManufacturerName    [ 16 ];
    UCHAR  WeekOfManufacture;
    USHORT YearOfManufacture;
    USHORT UserFriendlyNameLength;
    USHORT UserFriendlyName    [ 1 ];
} WmiMonitorID, *PWmiMonitorID;

Key Considerations:
This relies on emulated_settings::hwid_seed for consistency. If you're building this into your own driver, ensure your caching logic is solid—I've included basic cache handling for the device objects in the snippet above to prevent constant string recalculation.

Discussion:
Anyone else running into issues with specific monitor EDID structures failing to re-checksum? I've seen some ultra-wide displays with non-standard descriptors that can be picky. Drop your fixes or improvements below if you've poked at this further.

Use this on alts or testing rigs first; detection is always a possibility depending on how your main driver handles process communication.