NMI-Blocker

KO | EN

gitlite — search

#css #bash #gpt #ui #mysql #redis #python #c #tensorflow #dotnet

(★ 9)

Kernel-mode IDT hook that blocks NMIs on every active processor at hardware level.

File Explorer

ZIP Download

blocker.hxx
exports.hxx
memory.hxx
paging.hxx
README.md
structs.h

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

The NMI Blocker **intercepts Non-Maskable Interrupts (NMI) by patching IDT** on **every active processor**. 
Our IDT patch reads the current processor, checks the allocated array of allowed processors, and **let's it continue or blocks it with a IRETQ instruction**. 
The IDT patch blocks NMIs via a IRETQ instruction, **any driver that acquires a lock or handle inside its NMI handler** and waits for the NMI to release it **could deadlock**.

# What is an NMI?
A Non-Maskable Interrupt (NMI) is a hardware interrupt that **cannot be disabled** by software using ```CLI``` or ```STI```. 
The Windows kernel uses NMIs for:
* **Watchdog timers** - Detecting hung processors
* **Anti-cheat / Patch-Guard** - Stack walking and thread observation on all processors
* **Hypervisor communication** - Inter-processor signaling in virtualized environments

# What does it do?
The NMI Blocker **hooks the IDT entry on every active processor**, replacing it with a **stub allocated in ntoskrnl**. 
The **stub intercepts every NMI before PoIdle** processes it, **PoIdle is the default NMI handler** on idle processors. 
Commonly **Anti-cheat software ( EasyAntiCheat, e.g.. ) bypasses PoIdle** by registering callbacks **directly to KiNmiCallbackHeadList**.

#### Allocated stub flow:
```
NMI fires
 └── stub executes
      ├── RDMSR 0xC0000103  → get processor index
      ├── load &disabled_processors  → load the allocated array of processors 
      ├── MOVZX [disabled_processors + processor_index]  → check if the processor is disabled 
      ├── TEST eax, eax
      │    ├── ZF=0 (disabled) → IRETQ → block the NMI
      │    └── ZF=1 (enabled)  → JMP original_handler → send to the original handler
```

# Practical usage
Below are the best case scenarios to apply selective NMI blocking: 
* **Kernel Debugging** — Block NMIs on specific processors while debugging kernel architecture. 
* **Driver Development** — See how your driver reacts to an emulated environment without NMIs. 
* **NMI Research** — Study the Windows NMI dispatch flow by observing which callbacks in KiNmiCallbackHeadList fire.

# Conclusion
The NMI Blocker provides a **lightweight mechanism** for **per-processor NMI blocking** by **patching the IDT directly**. 
The **stub is allocated inside ntoskrnl** and **intercepts NMIs before PoIdle or any KiNmiCallbackHeadList callback** can process them. 
Be aware that **blocking NMIs** on a processor that **holds a lock inside** its NMI handler **will deadlock that processor indefinitely**. 
If you find **errors** or have **improvements**, create a issue or contact me on Discord (see profile).

NMI-Blocker

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

NMI-Blocker

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README