breaker09 wrote:Is this still working in Windows 10? I seem to be getting PatchGuarded a lot... :(Yes it works. Do not want to trigger PatchGuard? Turn it off. Do not want to turn it off? Rewrite dsefix to map your target driver to the kernel memory using vbox loader task (basically doing windows loader job) and launch it execution via kernel mode shellcode that will be triggered by same SUP_IOCTL_FAST_DO_NOP. This will not trigger Patchguard as nothing will be patched and your driver will be loaded without touching MmLoadSystemImage so no digital signature checks will be performed. However you will be unable to unload your "loaded" driver normally as it will be not in list of loaded drivers. Everything else - creating devices, sending/receiving IOCTLs should be working.
Ring0 - the source of inspiration