PatchGuard in Windows 8.1

MrBrian · Nov 24, 2014

From The Windows 8.1 Kernel Patch Protection:

It seems that the new implementation of this technology can defeat all known attacks. Microsoft engineers have done a great amount of work to try to mitigate a class of attacks. Because of the fact that the Kernel Patch Protection is not hardware-assisted, and the fact that its code runs at kernel-mode privilege level (the same of all kernel drivers), it is not perfect. At an upcoming conference, I will demonstrate that a clever researcher can still disarm this new version, even if it’s a task that is more difficult to accomplish. The researcher can furthermore use the original Microsoft Patchguard code even to protect his own hooks….
Click to expand...

From Microsoft Windows 8.1 Kernel Patch Protection Analysis & Attack Vectors:

A quality of Windows 8.1 kernel patch protection mechanism is extremely high. There are a lot
of interesting anti-debugging tricks used again dynamic analysis, f.e. resetting IDT before accessing debug registers (which leads you to hanging if you set break on debug registers access), overall obfuscation like using macroses for generating pseudo-random values, loop unrolling etc. It is also extremely difficult to do a static analysis since a lot of indirect function calls are used including the usage of exception handlers.
Click to expand...

From Malicious Utility Can Defeat Windows PatchGuard:

Malware developers found ways to bypass PatchGuard for Windows 7, and now with this program we can see it is also possible to automate the job under Windows 8.
Click to expand...

Rasheed187 · Nov 27, 2014

Interesting stuff. Seems like it isn't that easy to disable PatchGuard, but the KPP-Destroyer tool is still a bit worrying. Like I said in some other thread, I think it's best to implement PatchGuard as a hypervisor.

Log in or Sign up

PatchGuard in Windows 8.1

MrBrian Registered Member

Rasheed187 Registered Member

Log in or Sign up

PatchGuard in Windows 8.1

MrBrian Registered Member

Rasheed187 Registered Member

Useful Searches