Notable Protection Mechanisms

PatchGuard version 2 implements a variety of anti-debug, anti-analysis, and obfuscation mechanisms that are worth covering. Not all of PatchGuard's defenses are covered in detail in this paper, and those mechanisms (such as the obfuscation of PatchGuard's internal data structures) that are at least the same in principle as the previous PatchGuard release (and were already disclosed by Uninformed's previous article [2] on PatchGuard) are additionally not covered by this paper.

• Anti-Debug Code During Initialization
• Expanded Set of DPC Routines
• Self-Decrypting and Mutating System Integrity Check Routine
• Obfuscation of System Integrity Check Calls via Structured Exception Handling
• Disruption of Debug Register-Based Breakpoints
• Misleading Symbol Names
• Integrity Checks Performed During System Initialization
• Overwriting PatchGuard Initialization Code Post-Boot