Disable PatchGuard & Driver Signing

[Fyyre]

Hello,

This patch is for Windows 7 X64 RTM & Windows 7 SP1. It directly modifies ntoskrnl.exe & winload.exe to remove Microsoft's "PatchGuard" and requirement of driver signing.

This is accomplished by patching 6 bytes inside ntoskrnl.exe and four bytes inside of winload.exe ... it is file patch version of my existing bootkit

I originally made this for myself... wanting to again be able to hook inside of ntoskrnl like with X86 Windows.

Hope that someone find this useful,

-Fyyre

p.s. attachment updated for SP1 -- new attachment added on 8 March, 2011

[Pansemuckl]

Tested on my Win x64. Works perfectly.

[metr0]

Seems like I got not enough permission to access the file, probably due to my different user group. Just some minor setting in the board panel I guess.

Thanks anyway, I guess I already read about it on your page.

[JMI]

metr0:

You should be able to download the attachment to Fyyre's post. Your usergroup has permission to download from this forum.

Regards,

[quosego]

Same here actually JMI.. I also get a permission denied.

[ahmadmansoor]

@quosego & metr0 : I have fix the problem .pls try it now .
Thanks for replay

[metr0]

Thanks JMI and ahmadmansoor for the fix, it works fine now. Time to boot into 7 x64!

[bball0002]

I can't seem to download this attachment either. Is there a certain amount of posts I'm supposed to have before I can download attachments?

[JMI]

Promotion is a manual process and does not get done on a set schedule. However, your post count qualifies you for promotion to "Trial Member", and they have upload and download privileges.

Please give it a try again.

Regards,

[nulli]

This is exactly what I've been looking for! Thanks for this Fyyre!

[bball0002]

JMI: Works now. Thanks a bunch.

[ahmadmansoor]

@Fyyre : my friend could we see some useful tut in win x64 if that possible ??!!
if u have some time ..of course .
Thanks in adv

[Fyyre]

Hi Ahmadmansoor,

A tutorial to disable the PatchGuard and Driver Signing? Or did you have something else in mind?

-Fyyre

Originally Posted by ahmadmansoor

@Fyyre : my friend could we see some useful tut in win x64 if that possible ??!!
if u have some time ..of course .
Thanks in adv

[yogi_saw]

hi fyyre
I am new to win7 and 64bit os
this is first time I installed it
now I tried with ur tool but as I see some of the commands were not successful and I am not able to install unsigned drivers
I am attaching rar file which contains the error pls chk and tell me if I am doing something wrong, or I need something else

[Kerlingen]

The one command which shows an error is not important. Everything else looks ok. Was there some error with the patch? Did you reboot?

Does your event log contain several "Service Control Manager Event-ID 7000" entries or how did you notice that the driver couldn't be loaded?

Does the driver work in testsigning mode?