http://valinet6l6tq6d5yohaa6gdsf2ho4qcqcxyj2nahp5kd4z7nsa6ycdqd.onion/2021/11/18/Functional-Windows-10-flyouts-on-Windows-11.html
So, I just have to neuter that, and then set it myself and immediatly return from my CoCreateInstance hook. Like this: //globals: char mov_edx_val [ 6 ] = { 0xBA , 0x00 , 0x00 , 0x00 , 0x00 , 0xC3 }; char * ep_pf = NULL ; //... // in CoCreateInstance hook: char pattern [ 2 ] = { 0x33 , 0xD2 }; DWORD dwOldProtect ; char * p_mov_edx_val = mov_edx_val ; if ( !