Running a kernel driver I wrote. The driver includes:
mov rax, cr0
btr rax, 10h
mov cr0, rax
to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, KMODE_EXCEPTION_NOT_HANDLED, with the code 0xC0000096 (STATUS_PRIVILEGED_INSTRUCTION). This shouldn't be happening as the code is being executed in ring zero, and especially since the read from cr0 succeeds. Even more curiously this function succeeds when being run on my VM but not on bare metal. Anyone have any idea what's up with this?