Hooking WMI (.NET Application)

[Ember]

You are hooking a non-framework native module. I do not know what to tell you if it does not work on XP (unless you are lacking runtimes for VS2010 or something, even though it does not import it). I am on Windows 7 Ultimate x64 SP1 with all updates and it works fine, and it worked when I was on XP SP3 as well.

When I compile modules like that I link against the latest WDK libs and headers to cut down on size and importing anything from the new runtimes. It will link against msvcrt.dll instead.

Perhaps you can PM me and tell me what you want to spoof your processor ID to and I can compile one in my environment and you can try it.