Hooking `win32k` functions causes BSOD

[bytethief]

I tried using DetoursX and observed the following behavior:

• Hooking ntoskrnl functions works correctly
• Hooking win32k functions causes BSOD (e.g., NtUserFindWindowEx with KeStackAttachProcess attaching to explorer.exe)

Could you please provide a working example of hooking NtUserFindWindowEx?

[MiroKaku]

你要先排除不是PatchGuard