diff --git a/inlineExecute/inlineExecute.o b/inlineExecute/inlineExecute.o
index 880d27d..da15b0b 100644
Binary files a/inlineExecute/inlineExecute.o and b/inlineExecute/inlineExecute.o differ
diff --git a/src/EtwBypass.cs b/src/EtwBypass.cs
index e4b6476..4c9ab2f 100644
--- a/src/EtwBypass.cs
+++ b/src/EtwBypass.cs
@@ -121,7 +121,7 @@ namespace EtwBypass {
 
         static void TurnOffETW(IntPtr DotNETRuntimeHandle_addr, out long DotNETRuntimeHandle_val) {
             DotNETRuntimeHandle_val = Marshal.ReadInt64(DotNETRuntimeHandle_addr);
-            Marshal.WriteInt64(DotNETRuntimeHandle_addr, 0);
+            Marshal.WriteInt64(DotNETRuntimeHandle_addr, 1);
             Console.WriteLine("DotNETRuntimeHandle: 0x" + DotNETRuntimeHandle_val.ToString("X"));
         }
 
diff --git a/src/inlineExecute.c b/src/inlineExecute.c
index 72895b4..db4995c 100644
--- a/src/inlineExecute.c
+++ b/src/inlineExecute.c
@@ -594,7 +594,7 @@ int* findDotNetRuntimeHandle() {
 
 void turnOffEtw(int* handleAddr, int* handleVal) {
     *handleVal = *handleAddr;
-    *handleAddr = 0;
+    *handleAddr = 1;
 }
 
 void turnOnEtw(int* handleAddr, int handleVal) {