64 bit drivers / process mangement

Hi there

i have a question about driver development on windows x64 systems.
i am pretty new in this topic (drivers generally) so please have patience with me
atm im playin a bit around with hooks and ofc i noticed that most stuff like ssdt and idt hooks or modifying the eprocess structure is forbidden
by the kpp on 64bit ;X
my question is: is there any kind of "legit" way of "hooking" functions (specialy process management)
and if not how do modern antivirus programms handle this.

Hi,
For hook functions in kernel-mode under Windows x64 systems, u will need bypass the Kernel Patch Protection (PatchGuard), since Windows XP x64 u need bypass this protection, but the most hard is Windows 7 -8 fully updated.

Wikipedia information about this.

Information to bypass PatchGuard old versions.

Regards!

[mm10121991]

Does the PatchGuard protect the IA32_SYSENTER_EIP msr ?

Covertness: Changing the value of the IA32_SYSENTER_EIP MSR can be detected. For example, PatchGuard currently checks to see if the equivalent AMD64 MSR has been modified as a part of its polling checks.

Source

Regards!