This should work! It's just writing zero into a place holder in TEB
but it throws a exception and kills boot!
Index: win32k/ntuser/misc.c
===================================================================
--- win32k/ntuser/misc.c (revision 40892)
+++ win32k/ntuser/misc.c (working copy)
@@ -550,6 +550,7 @@
// ci->pClientThreadInfo = &ti->ClientThreadInfo; // FIXME!
ci->pClientThreadInfo = NULL;
ci->ppi = ti->ppi;
+ ci->pDeskInfo = NULL;
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{