PATCHGUARD INTERNALS

Summary from the TLDR InfoSec newsletter

PatchGuard (Kernel Patch Protection) is a Windows kernel mitigation introduced in 2005 that monitors critical kernel structures like IDT, GDT, MSRs, and SSDT, triggering a BSOD with error code 0x109 for unauthorized modifications. It employs randomized activation methods, such as timers and hidden DPCs, making its behavior unpredictable and hard to reverse engineer. Bypasses exist through boot-time patches and hypervisor-based rootkits that use Extended Page Tables (EPT) to hide changes, but both require disabling Secure Boot.