I released a small proof-of-concept called *timerflip* that demonstrates a technique to partially desynchronize Windows PatchGuard by modifying internal kernel validation timers via physical memory access.
It works by scanning physical memory to locate the relevant PatchGuard timer variables in ntoskrnl and overwriting them to prevent certain scheduled checks from running.
Any feedback or discussion on the approach, pattern scanning, or Windows kernel timer internals is welcome.
I released a small proof-of-concept called *timerflip* that demonstrates a technique to partially desynchronize Windows PatchGuard by modifying internal kernel validation timers via physical memory access.
It works by scanning physical memory to locate the relevant PatchGuard timer variables in ntoskrnl and overwriting them to prevent certain scheduled checks from running. Any feedback or discussion on the approach, pattern scanning, or Windows kernel timer internals is welcome.