admin/zer0condition-Demystifying-PatchGuard
1
0
Fork 0
mirror of https://github.com/zer0condition/Demystifying-PatchGuard synced 2026-08-09 13:17:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
14 Commits 1 Branch 0 Tags
c0b6ebcfed46c2daf3394365ebc8bb6de1efa9fb
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE
ZeroCondition c0b6ebcfed Update README.md
2023-04-13 15:59:43 +05:30
KiFilterFiberContext
Rename PatchGuardTVCallback to PatchGuardTVCallback.h
2023-04-13 15:19:56 +05:30
LICENSE
Create PatchGuardTVCallback
2023-04-13 15:19:46 +05:30
README.md
Update README.md
2023-04-13 15:59:43 +05:30

README.md

PatchGuard-Win11-22000.xxx

This repository contains some information for PatchGuard for Windows 11 (build 22000), to potentially help researchers, security professionals, and enthusiasts looking into PatchGuard for Windows 11.

KiFilterFiberContext/PatchGuardTVCallback.h

This header file contains the decompiled notification callback function (a PatchGuard check routine) registered at the entry of 'KiFilterFiberContext' if 'PsIntegrityCheckEnabled' is greater than zero. It is very similar to the historical and well-known huge verification routine 'FsRtlMdlReadCompleteDevEx' with some subtle differences

TVCallbackRegister

Disclaimer

For educational and authorized security research only. Don't use on systems you don't own or have explicit permission to test. I'm not responsible for misuse. Use at your own risk.

Reference in New Issue View Git Blame Copy Permalink
S
Description
Automated archival mirror of github.com/zer0condition/Demystifying-PatchGuard
Readme MIT
114 KiB
Languages
C 100%