Guide Windows 11 — Bypassing win32k.sys Kernel Guard via Pointer Hooking

[byte_corvus]

Anyone else digging into the win32k.sys pointer shifts for the newer Windows builds? Been messing with this for a while since the old .data ptr methods are practically dead on Win11.

For those still stuck trying to hook NtUserQueryDisplayConfig or similar functions, the game has changed. You can't rely on static .data ptr offsets anymore because everything is residing in kernel structures now. I have been looking into the call-chaining logic used by W32GetSessionStateForSession to navigate to the target function pointers.

The Technical Breakdown:

1. The Logic: Instead of a fixed offset in .data, you are looking at a structure chain. The target function implementation address is essentially buried under a nested pointer structure: W32GetSessionStateForSession(CurrentProcessSessionId) + 0x88 + 0x288 + 0x48.
2. Implementation: You need to resolve W32GetSessionState first, then manually traverse the chain to find that guard slot. I have found that using InterlockedExchange64 is the most stable way to swap the pointer once you have resolved the address of your hook handler.
3. Caveats: These offsets are volatile across different OS builds. Hardcoding them is a one-way ticket to a BSOD. You need to implement signature scanning to identify these displacements dynamically if you want your driver to stay stable across updates.

__int64 __fastcall NtUserQueryDisplayConfig(unsigned int a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5)
{
  unsigned int CurrentProcessSessionId; // eax
  __int64 (__fastcall *v10)(_QWORD, __int64, __int64, __int64, __int64); // rax

  CurrentProcessSessionId = GetCurrentProcessSessionId();
  v10 = *(__int64 (__fastcall **)(_QWORD, __int64, __int64, __int64, __int64))(*(_QWORD *)(*(_QWORD *)(W32GetSessionStateForSession(CurrentProcessSessionId) + 136) + 648LL) + 72LL);

  if ( v10 )
    return v10(a1, a2, a3, a4, a5);
  else
    return 3221225500LL;
}

The provided patch logic above demonstrates how to perform the swap safely within a __try/__except block to avoid any potential access violations while touching those memory regions.

Bottom line: If you are building a kernel-mode driver, stop chasing the old .data symbols. Start walking the session state structures.

static void* resolve_w32_get_session_state()
{
    void* mod = tools::get_kmodule(L"win32k.sys");
    if (!mod || !MmIsAddressValid(mod))
        return nullptr;

    void* exported = tools::get_exported_func(mod, "W32GetSessionState");
    if (exported && MmIsAddressValid(exported))
        return exported;

    return nullptr;
}


NTSTATUS ReplaceGuardPointer(
    PUCHAR guardAddr,
    UINT64 NewValue
)
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;

    __try {
        if (guardAddr == nullptr) {
            status = STATUS_INVALID_PARAMETER;
            __leave;
        }

        // Atomically replace 64-bit value at guardAddr
        InterlockedExchange64(reinterpret_cast<volatile LONG64*>(guardAddr),
            static_cast<LONG64>(NewValue));

        status = STATUS_SUCCESS;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        status = STATUS_ACCESS_VIOLATION;
    }

    return status;
}



bool patch_ptr () {
    typedef PVOID(*W32GetSessionState_t)();
    auto pW32GetSessionState = reinterpret_cast<W32GetSessionState_t>(resolve_w32_get_session_state());
    if (!pW32GetSessionState) {
            debug_print("[driver] failed to resolve W32GetSessionState (export + call-target fallback)\n");
        return false;
    }

    debug_print("[driver] W32GetSessionState=0x%p\n", pW32GetSessionState);

    debug_print("[driver] calling W32GetSessionState()\n");
    auto patch_current_session = [&](bool set_original) -> bool {
        PVOID SessionPtr = pW32GetSessionState();
        if (!SessionPtr)
            return false;

        volatile UINT64* guard_slot = nullptr;
        __try {
            const auto guard_chain_1 = *reinterpret_cast<PUCHAR*>(reinterpret_cast<PUCHAR>(SessionPtr) + 0x88);
            if (!guard_chain_1)
                return false;

            const auto guard_chain_2 = *reinterpret_cast<PUCHAR*>(guard_chain_1 + 0x288);
            if (!guard_chain_2)
                return false;

            guard_slot = reinterpret_cast<volatile UINT64*>(guard_chain_2 + 0x48);
            if (!guard_slot)
                return false;

            if (set_original && *original == nullptr)
                *original = reinterpret_cast<void*>(*guard_slot);
        }
        __except (EXCEPTION_EXECUTE_HANDLER) {
            return false;
        }

        NTSTATUS repl = ReplaceGuardPointer(reinterpret_cast<PUCHAR>(guard_slot), reinterpret_cast<UINT64>(hook_handler));
        if (!NT_SUCCESS(repl))
            return false;

        auto swapped = *guard_slot;
        return swapped == reinterpret_cast<UINT64>(hook_handler);
    };

    if (!patch_current_session(true))
    {
    debug_print("[driver] Win11: failed to patch current session guard slot\n");
        return false;
    }

    debug_print("[driver] Win11: guard slot patched successfully\n");
    return true;

}

Has anyone had success automating the sig scanning for the specific offsets (0x88, 0x288, 0x48) across different major builds? I am working on a more robust mapper for this and would be interested to see how you guys are handling the variation in these structures. Let me know if you hit any walls with the newer builds.