admin/zer0condition-Demystifying-PatchGuard
1
0
Fork 0
mirror of https://github.com/zer0condition/Demystifying-PatchGuard synced 2026-08-09 13:17:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
17 Commits 1 Branch 0 Tags
756f1f456cf0776aac8260d6700cf75baf2c4a23
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE
ZeroCondition 756f1f456c Update README.md
2023-04-13 16:15:19 +05:30
KiFilterFiberContext
Rename PatchGuardTVCallback to PatchGuardTVCallback.h
2023-04-13 15:19:56 +05:30
LICENSE
Create PatchGuardTVCallback
2023-04-13 15:19:46 +05:30
README.md
Update README.md
2023-04-13 16:15:19 +05:30

README.md

PatchGuard-Win11

This repository contains some information for PatchGuard for Windows 11 (build 22000.xxx), to potentially help researchers, security professionals, and enthusiasts looking into PatchGuard for Windows 11.

KiFilterFiberContext/PatchGuardTVCallback.h

This header file contains the decompiled notification callback function (a PatchGuard check routine) found at the entry of 'KiFilterFiberContext' if 'PsIntegrityCheckEnabled' is greater than zero.
'ExCreateCallback' opens an existing callback object 'TV' which is registered at boot-time by an external binary. It is similar to the historical and well-known huge 'FsRtlMdlReadCompleteDevEx'.

TVCallbackRegister

Disclaimer

For educational and authorized security research only. Don't use on systems you don't own or have explicit permission to test. I'm not responsible for misuse. Use at your own risk.

Reference in New Issue View Git Blame Copy Permalink
S
Description
Automated archival mirror of github.com/zer0condition/Demystifying-PatchGuard
Readme MIT
114 KiB
Languages
C 100%