Running a kernel driver I wrote. The driver includes:

mov rax, cr0
btr rax, 10h
mov cr0, rax

to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, KMODE_EXCEPTION_NOT_HANDLED, with the code 0xC0000096 (STATUS_PRIVILEGED_INSTRUCTION). This shouldn't be happening as the code is being executed in ring zero, and especially since the read from cr0 succeeds. Even more curiously this function succeeds when being run on my VM but not on bare metal. Anyone have any idea what's up with this?


1 Answer 1


Found it in the intel dev manual. CR4.CET bit is set which prevents clearing of WP bit

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.