HalPrivateDispatchTableHook

Hooking syscall with nt!HalPrivateDispatchTable->HalpCollectPmcCounters and Circular Kernel Context Logger ETW provider.

Hardcoded with Windows 23H2 but may be compatible with Windows 11 24H2, 25H2.

nt!HalPrivateDispatchTable is not protected by PG and R/W memory page. But may be trigger PG in the future.

Reference

Name		Name	Last commit message	Last commit date
Latest commit History 5 Commits
.gitattributes		.gitattributes
.gitignore		.gitignore
HalPrivateDispatchTableHook.sln		HalPrivateDispatchTableHook.sln
HalPrivateDispatchTableHook.vcxproj		HalPrivateDispatchTableHook.vcxproj
HalPrivateDispatchTableHook.vcxproj.filters		HalPrivateDispatchTableHook.vcxproj.filters
LICENSE.txt		LICENSE.txt
README.md		README.md
etw.cpp		etw.cpp
etw.h		etw.h
hal.cpp		hal.cpp
hal.h		hal.h
hook.cpp		hook.cpp
hook.h		hook.h
main.cpp		main.cpp
pmc.cpp		pmc.cpp
pmc.h		pmc.h
stdafx.cpp		stdafx.cpp
stdafx.h		stdafx.h
utility.cpp		utility.cpp
utility.h		utility.h