OmenMon v1.4.1-reborn: v1.4.1-reborn — Microsoft Defender cleared, VirusTotal 0/76, first-week field-report sweep

First-week-after-v1.4.0 field-report sweep. Patch release addressing the cluster of issues that arrived once the Auto-Calibration Wizard reached users on entry-level Victus 15/16 SKUs whose physical fan ceiling sits below the BIOS rate-limiter's threshold — plus a CLI redirection fix, a GpuMode-detection fix and a Battery-glitch-guard hardening pass surfaced while triaging issue #37 and Copilot's review on PR #60.

---

🛡️ Independently verified — clean on every engine surveyed

Check	Result	Reference
Microsoft Defender	✅ Cleared by Microsoft analyst — "do not meet our criteria for malware or potentially unwanted applications. The detection has been removed."	Submission ID 504e5120-8e6f-46c6-bf5f-da34a0176fca
VirusTotal	✅ 0 / 71 detections across all engines queried	view full report
Kernel access	Microsoft-signed PawnIO driver only — no proprietary .sys shipped	Resources/PAWN_BUILD.md

If Defender still flags it on your machine

The detection is already cleared on Microsoft's end — your locallient may just be holding a cached signature. From an elevatedommand prompt:

cd "C:\Program Files\Windows Defender"
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate

Expected output: Dynamic Signature removal — Done! followed bySignature update finished. Full background in
SECURITY.md.

How to verify your download

This release ships a SHA256SUMS.txt asset (auto-generated by CI)alongside the .zip. Verify the integrity of your download:

# Windows / PowerShell
Get-FileHash -Algorithm SHA256 .\OmenMon-v1.4.1-reborn-Release.zip

# Linux / WSL / Git Bash
sha256sum -c SHA256SUMS.txt

A new build always produces a new hash (AssemblyFileVersion is stamped per build). The SHA256SUMS.txt is the single source of truth for this release — verify against it, not against an older release's hash.

---

Fixed

• Defensive 100 %-fan safety entry for HP Omen 16-wf1012nl (8C77)
  (issue #50, @stf1o). 8C77 added to FanArray.HasMaxFanFreeze. Raw EC dumps show the rate-limiter footprint at EC[0xD2] (PeriodEncoded8): the period byte goes 0xB2 → 0xD0 → 0x99 → 0xEC across 0/30/70/100 % — 100 % reads slower than idle, matching 8C30 / 8D07 / 8BAD / 8E35. Sidecar-supported, not native — the shipped <Model> schema only supports LE16, so a native entry would silently override the sidecar with junk LE16 readouts.

• Auto-Calibration Wizard misidentified CPU/GPU RPM on HP Omen(8D87, 2025)
  (issue #61, @snowfallhateall). 8D87 added natively with the real 16-bit LE registers (0x70 / 0x9F).

• Auto-Calibration Wizard misidentified CPU/GPU RPM on HP Omen 17(8600, 2019)
  (issue #42, @duskw4lker). 8600 added natively with the real 16-bit LE registers (0x45 / 0x47, revealed only under stress-test load).

• EC freeze on 8D07 and 8BAD during the wizard's 100 % step
  (issues #56 @ghend-oss, #58 @MartinSalg818). Both boards share the firmware rate-limiter signature of 8C30 — now in the safety list.

• Auto-Calibration Wizard misidentified CPU RPM at 0x30 on 8E35
  (issue #57, @ClockworkNirvana). 8E35 added natively (0xB0 / 0xB2 LE16) and included in HasMaxFanFreeze.

• GPU fan speed followed CPU temperature in custom fan curves
  (issue #62, @Bart82). FanProgram.Update() now performs two independent per-tick curve lookups using Platform.GetCpuTemperature() / GetGpuTemperature() instead of feeding GetMaxTemperature() to both fans. GPU falls back to CPU temp if its sensor returns 0.

• OmenMon.exe -Probe > probe.txt produced an empty file
  (issue #37, @Byteme-dot). App/Cli/Cli.cs now skips AttachConsole / AllocConsole when stdout or stderr is redirected, preserving OS-provided handles. Symmetric IsAttached tracking on the Close() path.

• GetGpuMode() always returned Discrete on newer boards
  (issue #37, @Byteme-dot). Hardware/BiosCtl.cs now tries Cmd.GpuMode / 0x52 first (matching the SetGpuMode side) and falls back to Cmd.Legacy only if the modern call fails.

Added

• HP Omen (8D87, 2025), HP Omen 17 (8600, 2019), HP Victus 15 (8E35) in the native model database.

• Wizard plateau detection (App/Cli/CliOpCalibration.cs).
  Generic detector: after each commanded fan step, the wizard reads
  live tachometer RPM. When both fans show <150 RPM gain compared
  to the highest prior step (and the latest reading is ≥ 1500 RPM),
  the wizard aborts higher steps. Catches future SKUs with the
  same firmware signature without needing a hardcoded
  HasMaxFanFreeze entry. Markdown report includes a "PLATEAU
  DETECTED — please report so <ProductId> can be added" callout.

• Battery-glitch hibernation guard (Library/PowerGuard.cs,
  issue #59). Watches SystemInformation.PowerStatus per GUI tick.
  If Windows reports a ≥ BatteryGlitchDropPercent battery drop
  within BatteryGlitchWindowMs while on AC, OmenMon tells
  Windows to skip the Critical Battery Action via
  SetThreadExecutionState(ES_CONTINUOUS | ES_SYSTEM_REQUIRED) for
  BatteryGlitchHoldMs, with a balloon tip showing before/after.
  AC-only by hard invariant — releases the held wake-lock
  immediately if AC is unplugged mid-glitch so a real
  critical-battery transition can still hibernate. Configurable via
  BatteryGlitchGuard, BatteryGlitchDropPercent,
  BatteryGlitchWindowMs, BatteryGlitchHoldMs in OmenMon.xml.

Hardened

• AutoCal.Prime() skips zero-register placeholder mappings.
  New guard requires either a non-zero CPU/GPU register or the
  BiosLevelMirror mode (which legitimately uses Reg = 0).
  Forward-protection for any future KnownBoards entry that uses a
  sentinel zero for one fan while configuring the other.

• Config.BatteryGlitchHoldMs bounds aligned with the ushort
  parser. Documented and enforced upper bound lowered to 60000 ms
  (was inconsistently documented as 600000 but loaded via
  GetWord / ushort). All three battery-glitch knobs now have
  matching, documented [1, 60000] (or [1, 100]) checks.

• CI auto-generates SHA256SUMS.txt as a release asset, so
  every release ships with a verifiable digest of the published
  .zip and the inner OmenMon.exe.

Deferred

• HP Omen 8BCD native database entry (issue #37, @Byteme-dot).
  Two independent reports against the same ProductId disagree on
  the fan-register layout — shipping either natively would put
  garbage RPM on the other user's machine. Both users'
  Auto-Calibration sidecars (OmenMon-AutoCal.xml) keep their
  installs working in the meantime. Resolution waits on
  independent confirmation of either layout from a third 8BCD
  owner.

Known issues (no actionable code fix yet)

• Random fan spikes during light browsing on 8DCD (issue #49,
  @LightningFang). Diagnosed as an EC polling collision between
  OmenMon and a concurrent EC consumer (MSI Afterburner with an
  active overclock was the confirmed culprit in the reported case).
  Mitigation is environmental: close any third-party software
  polling the EC at sub-second cadence (HWiNFO, Afterburner / RTSS,
  AIDA64, Armoury Crate, G HUB, iCUE), and stop
  OMEN.CommandCenter.Service / OMEN.AI if HP Omen Gaming Hub is
  installed.

Documentation

• SECURITY.md: new "Windows Defender false positives" section
  with the cleared Microsoft submission ID, the analyst quote, the
  VirusTotal cross-reference, the local cache-flush procedure, and
  the new "How to verify your downloaded binary" section.
• INSTRUCTION.md: outdated WinRing0.sys references replaced
  with PawnIO-current guidance; added Defender cache-flush block
  and per-release hash verification instructions.
• README.md: "Microsoft Defender — Cleared" and "VirusTotal
  0 / 76" badges in the header row.
• docs/RELEASING.md: updated to document the new CI-side
  SHA-256 automation.

Compatibility & upgrade notes

• Drop-in replacement for v1.4.0-reborn. No config-file changes.
• Still PawnIO via Resources/LpcACPIEC.bin — no driver bundle
  changes.
• Windows 10/11 x64, .NET Framework 4.8.

Closes

#42, #50, #56, #57, #58, #59, #61, #62

---

Full changelog: see CHANGELOG.md.