[pointer]

I already saw in several Questions/Answers in some foruns that says that not is possible write to any SSDT tables no Windows x64 here, are some:

* Hook ZwTerminateProcess in x64 Driver (Without SSDT)

* Is there a kernel-mode callback for LdrLoadDll?

* Kernel Patch Protection

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

Already in others places i saw that is used a "bypasser" on KPP, here are one:

* What is PatchGuard?

Then based in these diferents versions of facts, what is really what antivirus software developers make to write on SSDT tables on Win x64 with success without any lock by KPP? How they are able to this really?

I think that this is a question that many kernel developers want know, how this happens truly. :)

Thx :D

[EP_X0FF]

This was discussed previously http://www.kernelmode.info/forum/viewto ... =13&t=3769

[pointer]

Today i saw that Kaspersky Antivirus still hooks SSSDT (Shadow Table) on Windows x64.

Tested: Kaspersky Total Security 2018
Enviroment: Windows 7 Ultimate x64

How this is possible? Is a special bypass? or simply Microsoft created a exception to make this (they)?

[EP_X0FF]

Patchguard in win7 doesn't check some areas. As far as I remember inline hooking of win32k table was used by sandboxie before. Microsoft closed this in Win8. http://www.kernelmode.info/forum/viewto ... =14&t=2416

As for your links:

1) https://stackoverflow.com/questions/205 ... thout-ssdt
Answer is ObRegisterCallbacks.

2) https://stackoverflow.com/questions/256 ... ldrloaddll
Answer posted in that thread.

Everything else is useless spam.

[pointer]

Patchguard in win7 doesn't check some areas. As far as I remember inline hooking of win32k table was used by sandboxie before. Microsoft closed this in Win8. http://www.kernelmode.info/forum/viewto ... =14&t=2416

As for your links:

1) https://stackoverflow.com/questions/205 ... thout-ssdt
Answer is ObRegisterCallbacks.

2) https://stackoverflow.com/questions/256 ... ldrloaddll
Answer posted in that thread.

Everything else is useless spam.

@EP_X0FF, thank you by point me a direction logical and truly. Doubt solved! :D

[dim]

some anti-malware software use hypervisors and EPT to hide their hooks

[pointer]

some anti-malware software use hypervisors and EPT to hide their hooks

at least on Win 10 x64, i still not saw none antivirus product hooking the SSDT tables.
Instead, they are using dll injection by monitoring process creation.
Sincerely i think that SSDT/SSSDT Hooking (to x64 Windows) today not is viable anymore , because of PatchGuard and Windows < 10.0 extinction.