What is bugchecksuppressor?

BugcheckSuppressor is a proof-of-concept Windows kernel driver, tagged "poc" and "rootkit" in its topics, that catches kernel crashes, the kind that normally cause a Blue Screen of Death, and lets the system keep running instead of rebooting. It targets a specific technical challenge: doing this without triggering HVCI, short for Hypervisor-Protected Code Integrity, a modern Windows security feature that prevents any software from writing new code into the kernel at runtime. The core problem it explores is that HVCI makes the traditional approach, patching a few bytes of kernel code to intercept a crash, impossible. BugcheckSuppressor works around this by using only data-only hooks: it modifies pointers in a writable data table, HalPrivateDispatchTable, rather than touching any executable kernel code. HVCI only guards code pages, not data pages, so this swap goes undetected. When a crash fires, the hook intercepts it before the blue screen appears. It then uses the kernel's own built-in error-recovery mechanism, called SEH unwind, via RtlUnwindEx, to cleanly walk back up the call stack, run all the cleanup code along the way, and land the system in a safe state. From the perspective of the rest of the OS, the bad driver that caused the crash simply failed to load and returned an error, as if nothing catastrophic happened. The README describes this as a thought experiment: the authors' stated motivation is exploring whether a full PatchGuard suppressor, PatchGuard being Windows' own kernel self-protection, is possible under HVCI. Tested on Windows 11 24H2 build 26200 with HVCI and kCET enabled. Written in C++.