v2.4

Patching no longer runs with permanent administrator rights, and the app now targets .NET 10.

What changes for you

No more admin prompt on startup. The app opens unelevated. It asks for elevation only when a protected file actually needs it, and only after you approve that one operation.
Ownership changes are off by default. The Ownership option starts unchecked, and the app never restores a saved ownership preference. Your consent applies only to the operation you are running.
This release runs on .NET 10. Which download you need depends on whether the .NET Desktop Runtime is already installed. See the next section.
Downloads are unsigned. Use SHA256SUMS to check integrity. There is no Authenticode signature.

Which ZIP do I download?

Both ZIPs contain the same application. The difference is whether the .NET runtime is inside the ZIP or expected on your machine.

ZIP	Size	Pick it when
`Win_1337_Patch-v2.4-win-x64-framework-dependent.zip`	about 150 KB	The .NET Desktop Runtime 10.0.12 or newer (x64) is already installed, or you are willing to install it. Small download.
`Win_1337_Patch-v2.4-win-x64-self-contained.zip`	about 49 MB	You want the app to run with nothing else installed. Large download, no runtime install.

Not sure? Take the self-contained ZIP. It always runs on x64 Windows and costs only download size. Choose the framework-dependent ZIP only if you have the runtime installed or want the small download.

To check whether the runtime is installed, run this in PowerShell:

dotnet --list-runtimes

If you see a Microsoft.WindowsDesktop.App 10.0.x line, the framework-dependent ZIP works. If the command is missing or shows no 10.0 line, take the self-contained ZIP or install the runtime from the .NET 10 download page.

Installing

Download the ZIP you picked from the table above.
Extract the whole folder. Keep the .exe inside it.
Run Win_1337_Patch.exe.
Optional: check the download against SHA256SUMS.

New command-line options

Option	What it does
`-elevate`, `--elevate`	Allows one UAC administrator operation when normal access fails before anything is written. Without this flag, scripted runs fail instead of prompting.
`-takeownership`, `--takeownership`, `-take-ownership`, `--take-ownership`	Allows a target-only `takeown` and `icacls` fallback after elevated access fails. Does not grant elevation by itself. Use it with `-elevate` or from an administrator prompt.
`-elevatedworker`, `--elevated-worker`	Internal marker for the approved one-shot helper process. It grants nothing and cannot schedule work. You do not need to pass it.

# Apply a patch
.\Win_1337_Patch.exe -patch .\patch.1337 .\target.dll

# Apply a patch and keep a backup
.\Win_1337_Patch.exe -patch .\patch.1337 .\target.dll -backup

# Allow one administrator operation for a protected target
.\Win_1337_Patch.exe -patch .\patch.1337 .\target.dll -elevate -backup

# Allow ownership fallback only if elevated access still fails
.\Win_1337_Patch.exe -patch .\patch.1337 .\target.dll -elevate -takeownership -backup

# Schedule the patch for your next login
.\Win_1337_Patch.exe -patch .\patch.1337 .\target.dll -schedule -backup

Existing options (-patch, -backup, -fileoffset) and exit codes are unchanged.

Other changes

The app and its tests now build on .NET 10 instead of .NET Framework 4.8.
A scheduled patch writes one RunOnce entry for the current user. If you also request elevation, UAC consent is still needed when the task runs.
The GUI layout is unchanged.
Patch validation happens before the app touches the target, so an invalid patch cannot start an ownership change or a write.
A failure after patching starts tells you whether the target may have changed and names the backup to restore. The app does not retry or elevate again.
Help text is available with -h, --help, or /?. Bare -help is no longer accepted.

Upgrading from 2.3

Your saved preferences are not imported from the old .NET Framework build. Set your backup and offset options again.
If you used a framework-dependent build before, install the .NET Desktop Runtime 10.0.12 or newer. The self-contained build needs no runtime install.
Supported Windows versions follow the .NET 10 support policy. Older Windows versions that .NET 10 does not support are no longer supported.

Verifying the download

SHA256SUMS contains the SHA-256 hash of each ZIP. provenance.json records the source commit, the toolchain, and the ZIP hashes for this build.

These binaries are unsigned. SHA-256 is integrity data, not a signature and not an antivirus guarantee.

Full Changelog: v2.3...v2.4

ramhaidar/Win_1337_Apply_Patch v2.4 on GitHub