Bypassing PatchGuard 3

Christoph Husse

Rate me:

4.98/5 (26 votes)

20 Aug 2008MIT28 min read

190.7K

This article shows how to bypass PatchGuard 3 on the latest windows versions.

patchguard_3_source_code.zip
- DriverShared.h
- DriverShared
- Install
  - Debug
    - BuildLog.htm
    - Install.exe.embed.manifest
    - Install.exe.embed.manifest.res
    - Install.exe.intermediate.manifest
    - Install.obj
    - mt.dep
    - stdafx.obj
    - vc90.idb
    - vc90.pdb
  - Install.vcproj
  - main.cpp
  - x64
    - Debug
      - BuildLog.htm
      - Install.exe.embed.manifest
      - Install.exe.embed.manifest.res
      - Install.exe.intermediate.manifest
      - Install.obj
      - mt.dep
      - stdafx.obj
      - vc90.idb
      - vc90.pdb
- PatchGuard.sln
- PG2Disable
  - Asm
    - ILD_x64.asm
  - Pg
    - disable.c
    - init.c
    - scan.c
    - utils.c
  - PG2Disable.vcproj
- PG3Disable
  - Asm
    - hook.asm
  - Pg
    - disable.cpp
    - memdump.c
    - scan.c
    - VistaAll.c
    - VistaSp0.c
    - VistaSp1.c
  - PG3Disable.vcproj
- PGDisableCert.cer
- README.txt
patchguard_3_binaries.zip
- Install.exe
- PG3Disable.pdb
- PG3Disable.sys
- PGDisableCert.cer
- README.txt
patchguard_docnew_02.zip
- PatchGuard Documentation.pdf
patchguard_docnew.zip
- PatchGuard Documentation.pdf
PatchGuard_Documentation.zip
- PatchGuard Documentation.pdf


Microsoft Visual Studio Solution File, Format Version 10.00
# Visual Studio 2008
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Install", "Install\Install.vcproj", "{2EFC5733-9DE6-4804-9CD2-905780047BB4}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PG2Disable", "PG2Disable\PG2Disable.vcproj", "{0FA18A85-FA4C-409D-9FAE-480F07EE061B}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PG3Disable", "PG3Disable\PG3Disable.vcproj", "{FBD0F846-1AAE-4019-9ED2-11D725C99999}"
EndProject
Global
	GlobalSection(SolutionConfigurationPlatforms) = preSolution
		Debug|x64 = Debug|x64
		Release|x64 = Release|x64
	EndGlobalSection
	GlobalSection(ProjectConfigurationPlatforms) = postSolution
		{2EFC5733-9DE6-4804-9CD2-905780047BB4}.Debug|x64.ActiveCfg = Debug|x64
		{2EFC5733-9DE6-4804-9CD2-905780047BB4}.Debug|x64.Build.0 = Debug|x64
		{2EFC5733-9DE6-4804-9CD2-905780047BB4}.Release|x64.ActiveCfg = Release|x64
		{2EFC5733-9DE6-4804-9CD2-905780047BB4}.Release|x64.Build.0 = Release|x64
		{0FA18A85-FA4C-409D-9FAE-480F07EE061B}.Debug|x64.ActiveCfg = Debug|x64
		{0FA18A85-FA4C-409D-9FAE-480F07EE061B}.Release|x64.ActiveCfg = Release|x64
		{0FA18A85-FA4C-409D-9FAE-480F07EE061B}.Release|x64.Build.0 = Release|x64
		{FBD0F846-1AAE-4019-9ED2-11D725C99999}.Debug|x64.ActiveCfg = Debug|x64
		{FBD0F846-1AAE-4019-9ED2-11D725C99999}.Debug|x64.Build.0 = Debug|x64
		{FBD0F846-1AAE-4019-9ED2-11D725C99999}.Release|x64.ActiveCfg = Release|x64
		{FBD0F846-1AAE-4019-9ED2-11D725C99999}.Release|x64.Build.0 = Release|x64
	EndGlobalSection
	GlobalSection(SolutionProperties) = preSolution
		HideSolutionNode = FALSE
	EndGlobalSection
EndGlobal

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The MIT License

Written By

Christoph Husse

Software Developer SecurityRevolutions

Germany

This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Bypassing PatchGuard 3

License

Comments and Discussions