Skip to content

README.md

Latest commit

 

History

History
118 lines (87 loc) · 4.13 KB

README.md

File metadata and controls

118 lines (87 loc) · 4.13 KB

Patchwork

Windows PatchGuard (Kernel Patch Protection) Analysis and Research Toolkit

Patchwork is a research toolkit for analyzing Windows Kernel Patch Protection (PatchGuard/KPP). It provides tools for understanding KPP's verification mechanisms, timer-based checks, exception handler chains, and the protected structures it monitors.

Disclaimer: This toolkit is intended for educational and security research purposes only. Understanding kernel protection mechanisms is essential for advancing operating system security.

Features

  • Context Discovery - Scan kernel memory for PatchGuard context structures
  • Timer Analysis - Enumerate and identify PG-related kernel timers with heuristic scoring
  • Integrity Checking - Verify kernel structures (SSDT, IDT, GDT, MSRs) against baselines
  • Decryption Engine - Recover XOR keys and decrypt PG context data (single, rolling, multi-key, AES-lite)
  • Exception Chain Analysis - Walk and analyze kernel exception handlers for PG identification
  • DPC Analysis - Inspect DPC queues and correlate with timer entries
  • Pool Scanner - Find PG-related pool allocations by tag and heuristic matching
  • Activity Monitor - Detect PG check execution via timing analysis and performance counters
  • Kernel Driver - WDM driver providing privileged access for kernel-level analysis
  • CLI Interface - Usermode command-line tool with IOCTL-based driver communication

Supported Windows Versions

Version KPP Version Support Level
Vista/7 v1.x Full
8/8.1 v2.0-2.1 Full
10 (all builds) v2.5-2.10 Full
11 21H2 v3.0 Full
11 22H2 v3.1 Full
11 23H2 v3.2 Full
11 24H2 v3.3 Partial (VBS limitations)

Building

Usermode Tools (CMake)

mkdir build && cd build
cmake .. -G "Visual Studio 17 2022" -A x64
cmake --build . --config Release

Kernel Driver (WDK)

The kernel driver requires the Windows Driver Kit (WDK):

# Using Visual Studio with WDK integration
# Open the driver project and build for x64 Release

Usage

Loading the Driver

sc create patchwork type=kernel binPath=C:\path\to\patchwork.sys
sc start patchwork

Note: The driver must be test-signed or loaded with test signing enabled.

CLI Commands

patchwork_cli version     - Show driver and system version info
patchwork_cli scan        - Scan for PatchGuard context in memory
patchwork_cli timers      - Enumerate and analyze kernel timers
patchwork_cli integrity   - Run kernel integrity checks
patchwork_cli pool        - Scan kernel pool for PG allocations
patchwork_cli monitor     - Show KPP monitoring status

Project Structure

src/
  core/           - KPP context, timer, and integrity check analysis
  analysis/       - Decryption, exception chain, and DPC analysis
  monitor/        - Activity monitoring and self-integrity checking
  driver/         - Kernel driver and pool scanner
  usermode/       - CLI interface
  common/         - Shared type definitions
tests/            - Unit tests
docs/             - Technical documentation
driver/           - WDK build configuration

Documentation

License

MIT License - Copyright (c) 2019-2026 BypassCore Labs

Contact

Support

Help keep BypassCore open-source and independent.

Network Address
Polygon 0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Ethereum 0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
BSC 0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Arbitrum 0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Optimism 0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Avalanche 0xd0f38b51496bee61ea5e9e56e2c414b607ab011a

USDT / USDC / ETH / BNB accepted on all networks.