A proof-of-concept Windows kernel driver that spoofs the current thread, machine frame and consequently the call stack for NMI callbacks on x86-64.
By hooking HalPreprocessNmi from the HAL private dispatch table, we can swap the current thread in the KPRCB for the core's idle thread, as well as swap the RIP and RSP from the machine frame to appropriate values for the idle thread.
To restore the original machine frame and current thread, we can manually traverse the NMI callback linked list and add our restoration function to the end.
A full writeup with detailed explanation can be found here: https://lxkast.github.io/posts/Thread-and-call-stack-spoofing-for-NMI-callbacks-on-Windows/
