POP4.2

This is an experimental patcher that allows CPUs with POPCNT, but without SSE4.2 (such as the AMD Phenom and K10 lines of CPUs) to boot Windows 11 24H2 and beyond. It has been tested on Windows 11 25H2 v2 and 26H2. Other builds have not been tested, but should work.

Yes and no. While Windows 11 checks for both POPCNT and SSE4.2, it does not actually need SSE4.2 for 99% of its files, with only a few exceptions that can be worked around (read on). To enforce this, Microsoft uses the undocumented RtlDetectProcessorFeatures function and checks for requirements by reading data from .rdata. In kernel 26100.7171, this is at offset 00000001400088C0 and has the bytes 01 00 00 00 00 00 00 00 00 00 10 00 02 00 00 00 0D 00 00 00 in IDA. To defeat this, we simply flip that 0D to a 0C, telling Windows to effectively skip the check and continue booting.

• Windows 8 or newer
• Python 3.7+ with pefile:

  pip install pefile

• Windows ADK (Deployment Tools) for oscdimg.exe. It will be automatically downloaded if missing.
• A copy of WindowsCodecs.dll (64-bit) and msxml6.dll (both 64-bit and 32-bit) extracted from Windows 11 23H2 placed into the blobs/ directory (see "Why do I need DLLs?" below). The 32-bit WOW64 variant of msxml6.dll must be renamed to "msxml6_wow64.dll".

You can build a bootable dual-boot (UEFI + BIOS) patched ISO from your original Windows 11 ISO with a single command:

python pop42.py build -i Win11_24H2_English_x64.iso -o Win11_Patched.iso --clean --index <index_number>

If you only need to patch individual binaries directly (e.g. for testing or Windows PE):

• Patch the NT Kernel (ntoskrnl.exe):

  python pop42.py patch kernel_sse42 -i path\to\ntoskrnl.exe -o path\to\ntoskrnl_patched.exe

• Patch the Boot Loader (winload.efi / winload.exe):

  python pop42.py patch winload -i path\to\winload.exe -o path\to\winload_patched.exe

• Patch the Provisioning Tool (provtool.exe):

  python pop42.py patch provtool_exit -i path\to\provtool.exe -o path\to\provtool_patched.exe

This can be found in the patcher_legacy folder of this repository. It's a standard Win32 app that should execute on basically anything that can run a Win32 executable.

For some reason, Microsoft compiled WindowsCodecs.dll and msxml6.dll with SSE4.1 instructions (PMOVSXBW and PMOVZXBW). If you do not replace WindowsCodecs.dll, Windows Setup will crash and restart when attempting to execute it. Even if you deploy the WIM manually, Windows will later enter Automatic Recovery as it tries to execute setup.exe again to finish installing. Likewise, skipping msxml6.dll will cause Windows to appear to install, but later fail to register any AppX package, resulting in "Why did my PC restart?" and a very broken install that can't even start explorer. For these reasons, replacing these files with their 23H2 versions in blobs/ is required.

POP4.2 tracks problematic binaries using badblobs.xml. Each entry defines target paths and actions (patch, replace, ignore). You can customize or add replacement blobs by editing badblobs.xml.

• Certain Nvidia nForce chipsets hang on boot. Needs further investigation.
• Intel Core 2 CPUs are not currently supported. These lack POPCNT, which is used heavily.
• This whole thing is experimental. Please file any bugs or quirks you find in the Issues tab.

• Bob Pony, for letting me test on his machine.
• QEMU, for making a great emulator and debugger.
• Google, for making Gemini, a great model that helped me figure this out.
• IDA, for their invaluable disassembler.
• Microsoft, for Windows 11.

This program, its accompanying files, and all files otherwise included in this repository are licensed under the MIT License. Consult the LICENSE file for details.