admin/zer0condition-Demystifying-PatchGuard
1
0
Fork 0
mirror of https://github.com/zer0condition/Demystifying-PatchGuard synced 2026-08-09 13:17:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
ZeroCondition
2023-04-13 16:15:19 +05:30
committed by GitHub
parent b2a8fec147
commit 756f1f456c
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -1
View File
@@ -2,7 +2,9 @@
This repository contains some information for PatchGuard for Windows 11 (build 22000.xxx), to potentially help researchers, security professionals, and enthusiasts looking into PatchGuard for Windows 11.
<h2>KiFilterFiberContext/PatchGuardTVCallback.h</h2>
<p>This header file contains the decompiled notification callback function (a PatchGuard check routine) registered at the entry of 'KiFilterFiberContext' if 'PsIntegrityCheckEnabled' is greater than zero. It is similar to the historical and well-known huge 'FsRtlMdlReadCompleteDevEx'</p>
<p>This header file contains the decompiled notification callback function (a PatchGuard check routine) found at the entry of 'KiFilterFiberContext' if 'PsIntegrityCheckEnabled' is greater than zero. <br>
'ExCreateCallback' opens an existing callback object 'TV' which is registered at boot-time by an external binary.
It is similar to the historical and well-known huge 'FsRtlMdlReadCompleteDevEx'.</p>
<img src="https://i.imgur.com/ypKeYLd.png" alt="TVCallbackRegister">
---