blair1922

	//
	// <function>
	// VgmCtx::BlockSwapContextHooks()
	// </function>
	// <purpose>
	// Prevent all vanguard TLB flushing and PML4 page remapping/copying routines in 9 lines
	// by setting a thermal sensor interrupt, not registered within the IDT directly
	// </purpose>
	//
	VOID BlockSwapContextHooks()

blair1922

// We Break VM (ring3)
NTSTATUS FilterMachineCallbacks( )
{
	PTP_CALLBACK_INSTANCE CallInst;
	PULONG_PTR PageNum, Pages;
	DisassociateCurrentThreadFromCallback( CallInst );
	if ( AllocateUserPhysicalPages( GetCurrentProcess( ), PageNum, Pages ) )
	{
		if ( Pages[ 8771 ] == NVMeDataTypeLogPage ) // Always NVMe data type on real NVMe drivers and not VM drives. All systems.
		{

typcn

VOID DrvObjHide(_In_ PVOID Context) {
	// Wait the driver fully loaded
	NTSTATUS status = STATUS_SUCCESS;
	INT64    interval = 1000 * -10000i64;
	status = KeDelayExecutionThread(KernelMode,FALSE,(PLARGE_INTEGER)&interval);
	PDRIVER_OBJECT driver_object = (PDRIVER_OBJECT)Context;
	
	tMiProcessLoaderEntry fun = (tMiProcessLoaderEntry)FindMiProcessLoaderEntry();
	// MiProcessLoaderEntry will remove your driver from PsLoadedModuleList, and the patchguard moniting context.
	// So it won't trigger a BSOD

Cr4sh

/*
 *********************************************************************

  Part of UEFI DXE driver code that injects Hyper-V VM exit handler
  backdoor into the Device Guard enabled Windows 10 Enterprise.
  
  Execution starts from new_ExitBootServices() -- a hook handler 
  for EFI_BOOT_SERVICES.ExitBootServices() which being called by
  winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
  transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)