Windows Kernel Patch Protection - Achilles Heel: PatchGuard

on YouTube ↗40m

" summary

Claims a reproducible design flaw in Windows Kernel Patch Protection that lets kernel code disable PatchGuard’s crash response by hooking kernel memset and intercepting the bugcheck path. The PoC uses memset hook via DR0/DR7 plus IDT hooking and IPI calls to set per‑CPU debug registers, detects KeBugCheckEx→KeBugCheck2 with code 0x109, decrements KiHardwareTrigger and stalls the reporting thread forever. A working driver demo suppresses the BSOD and restores the IDT; DPC hangs and some race cases remain.

AI-written summary · about

" chapters (21)

1. 0:00Introduction
2. 0:16About Me
3. 0:46Agenda
4. 1:44Objective
5. 2:28What is PatchGuard
6. 3:19What does PatchGuard check
7. 4:14Response analysis of PatchGuard
8. 5:42What happens after a crash
9. 7:29Flaws
10. 10:16Nonsense
11. 12:51CPU Debug registers
12. 14:09Code
13. 16:56Servicing Routine
14. 24:22Creating the Hook
15. 25:23Stall Routine
16. 25:54Log File Entry
17. 26:40Kernel Address
18. 28:26Demo
19. 32:08Problems and Improvements
20. 32:54What to Do Now
21. 33:44What to Do Next

" related talks

• 56mWindows Kernel Graphics Driver Attack SurfaceIlja van Sprundel · Black Hat USA 2014
• 49mBypassing KPTI Using the Speculative Behavior of the SWAPGS InstructionAndrei Lutas, Dan Lutas · Black Hat Europe 2019
• 52mA New CVE-2015-0057 Exploit TechnologyYu Wang · Black Hat Asia 2016
• 43mDefeating Windows Anti-Exploit & Security Features with WHQL Kernel DriversArush Agarampur · RSAC 2022
• 48mNext Level Cheating and Leveling Up MitigationsJoel St. John, Nicolas Guigo · Black Hat Asia 2015
• 32mIntroduction to Windows Kernel Mode DebuggingYamin Tian · BSidesSF 2018
• 25mData-Only Pwning Microsoft Windows KernelNikita Tarakanov · Black Hat USA 2014
• 33mExploring a New Class of Kernel Exploit PrimitiveRohit Mothe, Andrew Ruddick · Black Hat Europe 2022