A forum for reverse engineering, OS internals and malware analysis
You can safely assume that PG is running on all of x64 platforms. :mrgreen:
PG is not in effect if the system runs in Debug mode and a kernel debugger is attached to it (I am not sure whether the Debug mode alone is sufficient).
Hello. Thank you for your posts. I think I did not put my question right.
What I mean is that I am looking for a way to tell if PatchGuard was initialized on boot and is running right now. Software such as UPGDSED makes patches to ntoskrnl that skip initialization of PG, and right now I'm checking for these patches. I'm curious if there is more elegant way.
Thanks!
What I mean is that I am looking for a way to tell if PatchGuard was initialized on boot and is running right now. Software such as UPGDSED makes patches to ntoskrnl that skip initialization of PG, and right now I'm checking for these patches. I'm curious if there is more elegant way.
Thanks!
Whether PatchGuard is disabled or not can not be detected if malware has done manipulation.
You cannot check by files because you cannot be sure if you are checking the manipulated one or the backup. In most cases, you are checking backup.
You cannot check by dumping memory because the initialization codes are in ".init" section, where memory would be released after execution.
You cannot check by files because you cannot be sure if you are checking the manipulated one or the backup. In most cases, you are checking backup.
You cannot check by dumping memory because the initialization codes are in ".init" section, where memory would be released after execution.
At long last, the jumping hands of time will be halted by a weakling cast in eternal solitude.
