Repository navigation
PatchGuard
NeverSightAI edited this page Jul 16, 2026
·
2 revisions
Windows Kernel Patch Protection: periodic integrity checks over critical kernel structures; tampering can trigger a BSOD. Constrains SSDT/global hook styles and pushes hostile code toward less-monitored or below-OS techniques.
AC kernel components coexist with PatchGuard rather than replacing it. Research often studies timing/context/hypervisor evasions of PG alongside AC callback integrity and HVCI.
PG1903 demonstrates a Win10 1903-era approach: locate PatchGuard context pages, clear NX, and neutralize checks in real time (Demo NX).
HVCI · Kernel Callbacks · BYOVD · PG1903 · Windows Kernel
awesome-game-security · gs.awesome.rip · Wiki mirrors the in-repo knowledge layer under wiki/