3 - Decryption process........................................................................................................................................36
4 - Post verification for this case only...............................................................................................................36
C - APC insertion........................................................................................................................................................37
D - Global variable call...............................................................................................................................................37
E - KiSwInterruptDispatch method..........................................................................................................................38
F - Breadcrumbs.........................................................................................................................................................38
IV - Verification routines.................................................................................................................................................39
A - Prologue................................................................................................................................................................39
1 - Checksum the pg_ctx part 1, 2 and 3, with comparison...........................................................................40
2 - Re-Encrypt part 1...........................................................................................................................................40
3 - Checksum of part 2 and 3.............................................................................................................................40
4 - Wait..................................................................................................................................................................40
5 - Decrypt back the first part of the context...................................................................................................42
6 - Checksum of part 2 and 3, with comparison..............................................................................................42
7 - Checksum of part 1, with comparison.........................................................................................................42
8 - Setting the Thread Affinity group.................................................................................................................42
B - Kernel Structure Integrity Checks......................................................................................................................43
1 - Main algorithm................................................................................................................................................43
2 - Practical use-case: IDT verification with timeless debugging...................................................................44
C - Epilogue.................................................................................................................................................................45
1 - Everything's fine, go home and be safe!......................................................................................................45
2 - Die you filthy wild patch................................................................................................................................46
a - Checksum, Encryption and verifications.................................................................................................46
b - Restore Sensitive data..............................................................................................................................47
i - PTE rewrite............................................................................................................................................47
ii - Critical Routines rewrite......................................................................................................................48
iii - One more anti-debug.........................................................................................................................48
iv - Clear some entries..............................................................................................................................48
v - KeBugCheckEx or SdpbCheckDll.......................................................................................................48
V - Disabling PatchGuard................................................................................................................................................50
A - Limitations.............................................................................................................................................................50
B - Disable already launched contexts.....................................................................................................................50
C - Disable Timers from method 0...........................................................................................................................51
D - Disable hidden DPC pointer from method 1 and 2.........................................................................................51
E - Disable the hook from method 5.......................................................................................................................51
F - Disable the global pointer from mssecflt.sys...................................................................................................51
G - Disable the KiSwInterruptDispatch method.....................................................................................................51
H - Disable Breadcrumbs – KeServiceDescriptorTable check..............................................................................52
I - Disable Breadcrumbs – IDT check.......................................................................................................................52
VI - Conclusion.................................................................................................................................................................53
A - Few words.............................................................................................................................................................53
B - Remarks about this work.....................................................................................................................................53
C - References............................................................................................................................................................53
VII - About Tetrane and REVEN technology..................................................................................................................55
A - TETRANE...............................................................................................................................................................55
B - TETRANE’s technology........................................................................................................................................55
1 - Example of workflow.....................................................................................................................................56
a - Identify the scenario you want analyzed................................................................................................56
b - Capture the full system execution..........................................................................................................56
c - Generate the trace....................................................................................................................................56
d - Analyze interactively or automatically....................................................................................................57
© 2019 Tetrane Updated Analysis of PatchGuard on MS Windows 10 RS4 v1.00 4/61
