Baldurs Gate 3 Honour Mode: Legendary Actions and Solo Tactician Builds

[Alex Bailey]

Hey everyone,

I’ve been looking into Windows Kernel Ring 0 Drivers recently and wanted to ask the community for real-world impressions.

Windows Kernel Architecture Driver Signing Policy PatchGuard Mechanics Hypervisor‑Protected Code Integrity Interrupt Request Levels Kernel Callback Mechanisms Memory Scanning Techniques Virtualization‑Based Security System Service Dispatch Table Kernel Mode Rootkit Detection

Has anyone tested this setup or experienced something similar? Any tips would be appreciated!

🎮 Battlestation & Rig: Ryzen 9 7950X3D | RTX 4090 ROG Strix | 64GB DDR5 6000 CL30 | Custom Water Loop | Alienware AW2725DF 27″ 360Hz QD-OLED | Fanatec Gran Turismo DD Pro (8Nm) + ClubSport V3 Load Cell Pedals | Sennheiser HD 560S Open-Back + Creative Sound BlasterX G6 DAC

📍 Toronto, ON (Canada)

"Direct drive torque changes how you feel every curb and apex."

[Daniel Watson]

You’re stepping into a minefield if you’re doing this for anti-cheat work, which for me is the only real-world reason to touch Ring 0. First thing that’ll bite you: HVCI with Virtualization-Based Security turned on in Windows Security > Device Security > Core Isolation will silently block any driver without a valid cross-signed certificate, and your test-signing loop (bcdedit /set testsigning on + sigcheck -v to verify the build) won’t help because HVCI demands Authenticode signing by a Microsoft-trusted chain, not just the test-signing shim. If you’re reverse-engineering or running unsigned kernel code for research, either disable HVCI in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnabledCodeIntegrity = 0) or boot into disabled-MSACPI mode.

PatchGuard (KPP) is what actually gets people in trouble — it monitors for mutations to the IDT, GDT, SSDT, and critical data structures, and if it detects a tamper it BSODs with KASAN or KPP_VIOLATION at PASSIVE_LEVEL. When you register callbacks (PsSetCreateProcessNotifyCallback, SeRegisterCallback), you must handle the SeCallbackInvalidated path or you’ll leak handles and crash on logout. Watch your IRQL discipline: anything touching paged memory at DISPATCH_LEVEL or above causes IRQL_NOT_LESS_OR_EQUAL. For memory scanning across processes, use MmMapIoSpace via the physical mapper rather than poking PsLookupProcessByProcessId pointers directly — reading another process’s pages needs proper MmCopyVirtualMemory with the right access mode. On the competitive side, that’s exactly the kind of kernel hooking that Vanguard and FACEIT’s AC hunt for, so if your intent is legitimate detection you’ll want to layer your scans under VBS to stay off the radar of userland rootkits, but you’ll pay a real latency cost — I’ve seen 3-5ms of added input latency on the 360Hz QD-OLED from aggressive polling in kernel callbacks that tanked my frame pacing during ranked sessions.

🎮 Battlestation & Rig: i5-13600K | RTX 4070 Super | 32GB DDR5 6000 CL32 | DeepCool LT720 | ASUS ROG Swift OLED PG27AQDM 27″ 240Hz 0.03ms | Moza R9 V2 Direct Drive + Moza FSR Formula Wheel + CRP Load Cell Pedals | Sennheiser HD 560S Open-Back + Creative Sound BlasterX G6 DAC

📍 Atlanta, GA (USA)

"0.03ms OLED response renders ghosting completely obsolete."

[Author]

Posts