Tracing every usermode call on Windows-on-ARM. Clean install, no breakpoints, no hooks, memory not modified in any way. Virtually undetectable. Purely from hypervisor.

how? and how does this differ from x86? nobody bothered to make something like riot vanguard for arm yet, or?

Sick😎😎😎

hi, nice, question is why; I ditched win11 because his hypervisor killed my loved virtualbox; not friend of any kind of even so-called """ethical""" hacking; cheers; ;-)

This works with any guest OS with minimal changes. I chose Windows since I'm most familiar with its internals.

... and as for why: because nobody else has done it yet :)

What hardware is this running on? I've been thinking about learning some ARM64.

Mac mini M2

really cool!

@drProct0r O wow I know I'm behind on windows internals because I still don't recognize the _o__ functions