Microsoft added a new field, GuardMemcpyFunctionPointer, to the PE load config structure in Windows 22H2. I couldn’t find any documentation on this at all, either from Microsoft or from reverse engineers, so I thought I’d post my initial findings here. The field is a virtual address (VA) that typically points into the .rdata section. At… Read More What is GuardMemcpyFunctionPointer?