Hooking WMI (.NET Application)

[aldente]

So why doesn't it work for me?

I tried to run it on Windows XP x86, as the Administrator user... No luck!

What's your version of the .NET Framework? Maybe that's the difference...

[Ember]

You are hooking a non-framework native module. I do not know what to tell you if it does not work on XP (unless you are lacking runtimes for VS2010 or something, even though it does not import it). I am on Windows 7 Ultimate x64 SP1 with all updates and it works fine, and it worked when I was on XP SP3 as well.

When I compile modules like that I link against the latest WDK libs and headers to cut down on size and importing anything from the new runtimes. It will link against msvcrt.dll instead.

Perhaps you can PM me and tell me what you want to spoof your processor ID to and I can compile one in my environment and you can try it.

[aldente]

I tested the exact same binaries on a third machine, and these are the results:

Win7 SP1 x64: Does not work
WinXP SP3 x86: Does not work
Win7 SP1 x86: Works

Strange, but now I have at least one working system. I'll do some testing to find out why it doesn't work on the other ones.

Thanks for all your help!