valinet

Case study: Get dark command windows all the time in Windows

TL;DR

1. Make a copy conhost.exe from System32.
2. Open it with a hex editor (I use HxD).
3. In HxD, go to Search - Find - Hex-values.
4. Search for 881d9e530a004885c07477ff15b32e08009084c0.
5. In Windows 10 version 2004, replace ff15b32e0800 with 909090909090. If using Windows 10 version 20H2, replace ff15b32e08009084 with 9090909090909090.
6. Save file and copy it back to System32 (take ownership of original conhost.exe in order to replace it).
7. Profit!