Home
Blog
Extended Kernel













































































Windows 7 Extended Kernel

The Windows 7 Extended Kernel is a project to modify the older Windows 7 operating system for improved software & game compatibility, support for newer drivers, security fixes, and more.

Downloads

Windows 7 Extended Kernel v2 (2024-01-24)
Windows 7 Extended Kernel v2.1 Hotfix (2024-01-25)
Windows 7 Extended Kernel v3 (2024-01-25)
Windows 7 Extended Kernel v3.1 Hotfix (2024-01-25)
Windows 7 Extended Kernel v4 (2024-01-28)

Changelog

  • 2023/08/17: Fixed instability bug
  • 2023/09/19: Released wintrust.dll patch to allow anticheat games & DRM to work on my extended kernel -- spoofs WinVerifyTrust to always return successful
  • 2023/10/10: Released beta version of the 64-bit (System32) Kernel32 version spoofer. Has some minor known bugs, use at your own risk.
  • 2024/01/21: Released the first official version of Windows 7 Extended Kernel. No longer uses wrapper technology, should be 100% stable.
  • 2024/01/24: Released v2 of the Windows 7 Extended Kernel. Adds SysWOW64 kernel32.dll and extended winhttp.dll for SysWOW64 and System32
  • 2024/01/25: Released v2.1 hotfix to fix a crash bug caused by SysWOW64 winhttp.dll
  • 2024/01/25: Released v3 of the extended kernel: SysWOW winhttp rebuilt, bcdedit settings, ci.dll, winload.exe and winload.efi for code integrity bypass included, new dll's added: xinput1_4.dll, dplay.dll (SysWOW64 only), api-ms-win-core-libraryloader-l1-2-0.dll, api-ms-win-core-realtime-l1-1-1.dll, api-ms-win-core-winrt-error-l1-1-0.dll, api-ms-win-core-winrt-l1-1-0.dll, api-ms-win-core-winrt-string-l1-1-0.dll, api-ms-win-power-base-l1-1-0.dll, api-ms-win-shcore-scaling-l1-1-1.dll
  • 2024/01/25: Released v3.1 hotfix. The only change is that this version fixes the install.bat for users with spaces in their Windows username (spaces were not escaped properly before)
  • 2024/01/28: Released v4: Fixed install.bat failing to copy the files when ran from explorer, fixed osver.ini spoofer not working in local application mode on 64-bit, added functions to kernel32: GetSystemWow64Directory2A, GetSystemWow64Directory2W, GetSystemWindowsDirectory2A, GetSystemWindowsDirectory2W, IsWow64Process2

    PatchGuard bypass

    PatchGuard can be bypassed by making simple patches to ci.dll, winload.exe & winload.efi You must change all instructions such as: 
    /* original: */ mov xxx, 0xc0000428
    /* change to: */ mov xxx, 0x0
    Currently, you must also set your BCD settings as follows: 
    bcdedit /set NOINTEGRITYCHECKS ON
    bcdedit /set RECOVERYENABLED OFF
    bcdedit /set TESTSIGNING ON
    However, this may be fixed soon with some additional patches.

    NOTE: PatchGuard really only protects a small number of binaries such as NTOSKRNL.EXE. Thus, the PatchGuard bypass isn't really needed currently, but it is good to future-proof.

    Fix for DRM/Anti-Cheat programs

    DRM and video game Anti-Cheat programs may detect that the system has been modified and prevent the software from running. This can be easily bypassed by spoofing WinVerifyTrust: 
    WINBASEAPI LONG WinVerifyTrust(HWND hwnd, GUID *pgActionID, LPVOID pWVTData) {
    WinVerifyTrust_orig(hwnd, pgActionID, pWVTData);
    return ERROR_SUCCESS;
}
    * WinVerifyTrust_orig is the Win7 built-in WinVerifyTrust function, imported as WinVerifyTrust_orig in .DEF file.

    Fix for Internet Explorer security popup when version spoofing

    The build of Internet Explorer in the updated versions of Windows 7 was also released for Windows 8.x, so the system version number is checked in IERTUTIL.DLL using GetVersionExA. Since Windows 98, the system shell/explorer has ran on top of IE, so this will cause many applications to not launch when ran with version spoofing. This can be fixed by simply patching GetVersionExA to return the real system major & minor version (MajorVersion = 6, MinorVersion = 1) when called from IERTUTIL.DLL