The simplest of all possible modifications to the original RoguePlanet.cpp (literally interchanging two letters in the source code) defeats the detection and re-enables the exploit in current, fully patched Windows 11 with Definition Update 1.453.20.0 installed.

My version also works with 1.453.21.0, as far as I can tell. EDIT: Or maybe not as reliably anymore - while it's not quarantined, it currently doesn't seem to win the race anymore (stuck on "MpCleanCallbackFunction called."). But this might have to do with the contaminated state of my test machine (which already has 6 or 7 volume shadow copies for the attacked volume).

Yup, here we go.

@christopherkunz what is the version of your mpengine.dll?

@buherator 1.1.26050.11, I think.

@buherator So MS has been busy during the day, I'm now at definition version 1.453.25.0. And now we've gone full circle back to the earliest RedSun mitigations, it seems. During the Defender race (after accessing the Volume Shadow Copy), a defender popup tells me that " a threat could not be fully remediated", then after about another minute, the NT_AUTHORITY shell pops back up.

It could be, though, that my testing environment is contaminated from this morning's experiments, like with RedSun.

@christopherkunz That's it thx! Based on the Update Guide this should fix the problem independently from the definition updates, so if you can repro on a clean system with this DLL version that's bad.

@buherator I can verify that the exploit still works with that mpengine.dll version and the 1.453.28.0 definition update that got released 6/10/2026 6:29:20 PM. It takes more than one attempt, sometimes up to 6-7 now, where it used to be almost always one shot, but it still works.
I'm waiting for my other VM to fully update and then I'll retry there, too.

@christopherkunz Damn that sounds like a major burn for MS!

@christopherkunz "nt-autorität" Wann wird microsoft verstehen, dass man die command line einfach nicht übersetzt

@moti Und dann noch inkonsistent.

Na, das wärs noch

@moti Verspüre Wordmakro-Vibes ("ENDEWENN").