Skip to content

Instantly share code, notes, and snippets.

@kuh4it
Last active February 4, 2024 15:32
Show Gist options
  • Save kuh4it/2decb39acd0f084504af355bb77b05c1 to your computer and use it in GitHub Desktop.
Save kuh4it/2decb39acd0f084504af355bb77b05c1 to your computer and use it in GitHub Desktop.
PatchNotGuard
// you can hook syscalls without triggering KPP or PG, that's just a project for fun
PVOID DisgustingPatchGuard = Utils::FindPatternImage( KBase, "\x40\x53\x48\x83\xEC\x30\x8B\x41\x18" );
if ( !DisgustingPatchGuard )
{
Utils::ThrowException( _( "C4GE: FAILED TO FIND PATCHGUARD INITIALIZATION CONTEXT" ) );
return STATUS_INVALID_ADDRESS;
}
DisgustingPatchGuard = RVA( DisgustingPatchGuard, 7 );
if ( !DisgustingPatchGuard )
{
Utils::ThrowException( _( "C4GE: FAILED TO CALCULATE RVA FOR PATCHGUARD INITIALIZATION CONTEXT" ) );
return STATUS_INVALID_ADDRESS;
}
Cagevisor::Core::PlaceNPTHook<PVOID>( DisgustingPatchGuard, Hooks::ExtendedFrame );
if ( !Globals::ExtendedFramePtr )
{
Utils::ThrowException( _( "C4GE: FRAME INVALID. KPP ENABLED?" ) );
return STATUS_INVALID_ADDRESS;
}
//
// Hardcoded using WinDbg, find your own shit buddy ;)
//
Utils::AllocLocally( Core::FindFrameSize( 0xffffffff`7ff4c3aa`a810c89 ) );
if ( !Utils::IsBadReadPtr( Globals::GetLastIndependentPageAllocation( ) ) || !Globals::ExtendedFramePtr )
{
Utils::ThrowException( _( "C4GE: CANNOT FIND EXTENDED PAGE FRAME." ) );
return STATUS_INVALID_ADDRESS;
}
BYTE JmpStub[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00 }; // no need to use that since we NOP and not JMP anymore lmfao idk why i kept this:skull:
Cagevisor::Core::OverlapMemory( FileAllocationInformation::IndependentPages, Globals::ExtendedFramePtr );
Cagevisor::Core::SetLastMode( AddressRanges::KPPLess_CTX_test /* 0x0 */, false, false, true, 8 /* BitSet max page enumeration index */ );
Cagevisor::Core::ExecuteCPL0Function<BOOLEAN>( MmSetAddressRangeModified, IA32_APERF /* Clock Counter */ )( Globals::ExtendedFramePtr, Globals::ExtendedFramePtrLength );
for(INT32 FunctionLength = 0; FunctionLength <= Globals::ExtendedFramePtrLength; i++ )
*( PVOID* ) ( Globals::ExtendedFramePtr + FunctionLength ) = Cagevisor::Routines::PlaceNOPWithoutKPPTrigger( );
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment