Silverfox Group are now using AppDomainManager configs to hijack execution flow.

Rewrite github.com/rxOred/process… for 64-bit version... Finally worked. So why PAGE_EXECUTE_READWRITE is required in current situation (Win64) but the original project isn't?

While the Vulnerable Driver Block List shown below learn.microsoft.com/en-us/windows/… includes the driver hash of RTCore64.sys (CVE-2019-16098), but it's still not merged into the default block list in latest Win11, which provides a way to remove callbacks of AV.

Confirmed: the two drivers with CVE-2025-52915 CVE-2025-1055 is still available on latest Win11 at present.