%PDF-1.4 5 0 obj << /S /GoTo /D (chapter.1) >> endobj 8 0 obj (Introduction) endobj 9 0 obj << /S /GoTo /D (chapter.2) >> endobj 12 0 obj (Protection Improvements) endobj 13 0 obj << /S /GoTo /D (section.2.1) >> endobj 16 0 obj (Multiple Concurrent PatchGuard Check Contexts) endobj 17 0 obj << /S /GoTo /D (section.2.2) >> endobj 20 0 obj (Filtering of Exception Codes Used to Trigger PatchGuard Execution) endobj 21 0 obj << /S /GoTo /D (section.2.3) >> endobj 24 0 obj (Executing PatchGuard Without SEH) endobj 25 0 obj << /S /GoTo /D (section.2.4) >> endobj 28 0 obj (Randomized Call Frames in Repurposed DPC Routine Exception Paths) endobj 29 0 obj << /S /GoTo /D (section.2.5) >> endobj 32 0 obj (Expanded Set of Protected Regions) endobj 33 0 obj << /S /GoTo /D (chapter.3) >> endobj 36 0 obj (Additional Protection Mechanisms) endobj 37 0 obj << /S /GoTo /D (section.3.1) >> endobj 40 0 obj (Timer List Obfuscation) endobj 41 0 obj << /S /GoTo /D (section.3.2) >> endobj 44 0 obj (Anti-Debugging Code at PatchGuard Initialization Time) endobj 45 0 obj << /S /GoTo /D (section.3.3) >> endobj 48 0 obj (KeBugCheckEx Protection) endobj 49 0 obj << /S /GoTo /D (section.3.4) >> endobj 52 0 obj (Two-Stage Code Deobfuscation) endobj 53 0 obj << /S /GoTo /D (section.3.5) >> endobj 56 0 obj (Code Patching Support) endobj 57 0 obj << /S /GoTo /D (chapter.4) >> endobj 60 0 obj (Bypass Mechanisms and Countermeasures) endobj 61 0 obj << /S /GoTo /D (section.4.1) >> endobj 64 0 obj (Hybrid Exception Interception and Memory Searching) endobj 65 0 obj << /S /GoTo /D (section.4.2) >> endobj 68 0 obj (Timer DPC Dispatcher and DPC Dispatching) endobj 69 0 obj << /S /GoTo /D (section.4.3) >> endobj 72 0 obj (Canceling the PatchGuard Timer\(s\)) endobj 73 0 obj << /S /GoTo /D (section.4.4) >> endobj 76 0 obj (Page-Table Swap) endobj 77 0 obj << /S /GoTo /D (section.4.5) >> endobj 80 0 obj (DPC Exception Handler Patching) endobj 81 0 obj << /S /GoTo /D (section.4.6) >> endobj 84 0 obj (System Call MSR Swap) endobj 85 0 obj << /S /GoTo /D (chapter.5) >> endobj 88 0 obj (Conclusion) endobj 89 0 obj << /S /GoTo /D [90 0 R /Fit ] >> endobj 92 0 obj << /Length 494 /Filter /FlateDecode >> stream xڍSMo0Wh3#R;=mKуIP钬Fk2o6%>=?>R($?(P)pkaJm|SHM#Hi!_5YȈZ c~-$!:$uS>$Z&jIkl鳺U$w۶X[CV':\?)TҨT^T|˫?mӮ*c pkmw̶`Q6"AzSߋG)m!! :xB!O獮/сֆ+# N{ &yK~ǗC|qDJltq?I|x>2~XtB9ʍ]?38k';}HklS*m¶/rv3c%eRbwFet} ?Dxiӄ3_/ga?m|l*GDд_d `ܝ٭endstream endobj 90 0 obj << /Type /Page /Contents 92 0 R /Resources 91 0 R /MediaBox [0 0 612 792] /Parent 111 0 R /Annots [ 107 0 R ] >> endobj 107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [250.4938 147.5714 360.754 157.7831] /Subtype/Link/A<> >> endobj 93 0 obj << /D [90 0 R /XYZ 133.7684 692.1046 null] >> endobj 94 0 obj << /D [90 0 R /XYZ 133.7684 667.198 null] >> endobj 91 0 obj << /Font << /F17 97 0 R /F18 100 0 R /F19 103 0 R /F20 106 0 R /F21 110 0 R >> /ProcSet [ /PDF /Text ] >> endobj 114 0 obj << /Length 1386 /Filter /FlateDecode >> stream xڍWKoFW"._Ǥhn}{X+iTUg%);43fv,b%DuzW:uŎWIPR3UR"QY.T^tʔ^