Hello,

due to my development with EasyHook, I discovered that PatchGuard seems to be disabled if "bcdedit -set TESTSIGNING ON" and/or "bcdedit /debug ON" is set as boot option. Can anyone confirm this statement?

I checked it by hooking KeCancelTimer() which should actually be in the scope of PatchGuard, shouldn't it? Actually nothing happend...

regards
chris

Hi!!! CodeBreakers-Journal - Portal for IT-Security & IT-Anti-Security - Secure Window’s Kernel with TPM This talks about breaking patchguard.......

__________________
Celestra

Hi,

I don't see the point where they are talking about breaking patchguard. But okay this was not my question. I solved it myself now. debugging will disable it according to the microsoft homepage:

bcdedit /debug on
bcdedit /dbgsettings serial /start Autoenable /noumex

and you are done..


regards
chris