Exetools  

Go Back   Exetools > General > x64 OS

Notices

Reply
 
Thread Tools Display Modes
  #46  
Old 10-29-2012, 02:18
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
What Fyyre said was that Fyyre is no longer using "new" Microsoft products, so there is no method for Fyyre to develop the product for use on Windows 8.

Someone using Windows 8 will have to develop it for the group.

Regards,
__________________
JMI
Reply With Quote
The Following User Gave Reputation+1 to JMI For This Useful Post:
chessgod101 (10-29-2012)
  #47  
Old 10-29-2012, 15:07
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,661
Rept. Given: 802
Rept. Rcvd 1,283 Times in 561 Posts
Thanks Given: 227
Thanks Rcvd at 562 Times in 240 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
Quote:
Originally Posted by Pansemuckl View Post
So you can't bypass the NEW patchguard? Too hard this time? Hoepfuly someone else can do it.
Be more kind here mate.
Watch your language.
This kind of attitude will get you nowhere.
Reply With Quote
  #48  
Old 10-29-2012, 22:17
Fyyre's Avatar
Fyyre Fyyre is offline
Fyyre
 
Join Date: Dec 2009
Location: 0°N 0°E / 0°N 0°E / 0; 0
Posts: 272
Rept. Given: 89
Rept. Rcvd 86 Times in 39 Posts
Thanks Given: 167
Thanks Rcvd at 340 Times in 118 Posts
Fyyre Reputation: 86
Quote:
Originally Posted by Pansemuckl View Post
So you can't bypass the NEW patchguard? Too hard this time? Hoepfuly someone else can do it.
Already I did this, during RC0 of Windows 8.

Today mostly I working with Linux. My own personal need and interest is no longer, making this a project now for someone else.

-Fyyre
__________________
Best Wishes,

Fyyre

--

https://github.com/Fyyre
Reply With Quote
The Following User Gave Reputation+1 to Fyyre For This Useful Post:
chessgod101 (10-30-2012)
  #49  
Old 10-30-2012, 13:26
Av0id Av0id is offline
VIP
 
Join Date: Jan 2006
Posts: 399
Rept. Given: 112
Rept. Rcvd 111 Times in 69 Posts
Thanks Given: 0
Thanks Rcvd at 15 Times in 15 Posts
Av0id Reputation: 100-199 Av0id Reputation: 100-199
sorry for small offtopic, but...

Quote:
Today mostly I working with Linux
which one?
Reply With Quote
  #50  
Old 11-03-2012, 09:04
Fyyre's Avatar
Fyyre Fyyre is offline
Fyyre
 
Join Date: Dec 2009
Location: 0°N 0°E / 0°N 0°E / 0; 0
Posts: 272
Rept. Given: 89
Rept. Rcvd 86 Times in 39 Posts
Thanks Given: 167
Thanks Rcvd at 340 Times in 118 Posts
Fyyre Reputation: 86
Quote:
Originally Posted by Av0id View Post
sorry for small offtopic, but...



which one?
CentOS, this one is hands down my favorite.
__________________
Best Wishes,

Fyyre

--

https://github.com/Fyyre
Reply With Quote
  #51  
Old 01-02-2013, 02:20
exeu
 
Posts: n/a
Quote:
Originally Posted by Fyyre View Post
Already I did this, during RC0 of Windows 8.

Today mostly I working with Linux. My own personal need and interest is no longer, making this a project now for someone else.

-Fyyre
What a pity!
Reply With Quote
  #52  
Old 01-03-2013, 14:20
Fyyre's Avatar
Fyyre Fyyre is offline
Fyyre
 
Join Date: Dec 2009
Location: 0°N 0°E / 0°N 0°E / 0; 0
Posts: 272
Rept. Given: 89
Rept. Rcvd 86 Times in 39 Posts
Thanks Given: 167
Thanks Rcvd at 340 Times in 118 Posts
Fyyre Reputation: 86
I change my mind; if someone can provide me with a link to Windows 8 x64 ntoskrnl.exe -- I will add support of Win 8 to Disable PG/DS, when free time permits.

-Fyyre
__________________
Best Wishes,

Fyyre

--

https://github.com/Fyyre
Reply With Quote
  #53  
Old 01-04-2013, 11:23
chessgod101's Avatar
chessgod101 chessgod101 is offline
Co-Administrator
 
Join Date: Jan 2011
Location: United States
Posts: 535
Rept. Given: 2,226
Rept. Rcvd 692 Times in 220 Posts
Thanks Given: 709
Thanks Rcvd at 945 Times in 186 Posts
chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699
Here is the latest version of the Windows 8 x64 ntoskrnl.exe:
Code:
http://rghost.net/42719504
Thank you for your efforts, Fyyre.
__________________
"As the island of our knowledge grows, so does the shore of our ignorance." John Wheeler
Reply With Quote
  #54  
Old 05-15-2024, 01:06
Gelip Gelip is offline
Friend
 
Join Date: Jun 2022
Posts: 7
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Gelip Reputation: 0
How patch winload.efi instead winload.exe from Win7 SP1 ?

Edited
=====
OK, I make second mk_bcdentry_UEFI.cmd script for UEFI:
Code:
ECHO OFF

ECHO.
ECHO Copy of required files...
ECHO.

set PATCHTEMP=%CD%
cd %PATCHTEMP%
echo y | copy %WINDIR%\SYSTEM32\winload.efi %PATCHTEMP%\osloader.efi
echo y | copy %WINDIR%\SYSTEM32\ntoskrnl.exe %PATCHTEMP%\ntkrnlmp.exe

set OLD_GUID={46595952-454E-4F50-4747-554944FFFFFF}
set ENTRY_GUID={46595952-454E-4F50-4747-554944FEEEEE}

ECHO.
ECHO Delete BCD Entries, if existing...
bcdedit -delete %ENTRY_GUID%
bcdedit -delete %OLD_GUID%
ECHO.

ECHO.
ECHO Creating BCD Entry...
ECHO.

bcdedit -create %ENTRY_GUID% -d "PatchGuard Disabled v3" -application OSLOADER
bcdedit -set %ENTRY_GUID% device partition=%SYSTEMDRIVE%
bcdedit -set %ENTRY_GUID% osdevice partition=%SYSTEMDRIVE%
bcdedit -set %ENTRY_GUID% systemroot \Windows
bcdedit -set %ENTRY_GUID% path \Windows\system32\osloader.efi
bcdedit -set %ENTRY_GUID% kernel ntkrnlmp.exe
bcdedit -set %ENTRY_GUID% recoveryenabled 0
bcdedit -set %ENTRY_GUID% nx OptIn
bcdedit -set %ENTRY_GUID% nointegritychecks 1
bcdedit -set %ENTRY_GUID% inherit {bootloadersettings}

bcdedit -displayorder %ENTRY_GUID% -addlast
bcdedit -timeout 10

ECHO.
ECHO Setting PEAUTH service to manual... (avoid BSOD at login screen)
ECHO.
sc config peauth start= demand

ECHO.
ECHO Calling patcher!  Please press "Patch", next "Exit" before continue here...
ECHO.
%PATCHTEMP%\no_ds_pg.exe
ECHO.
ECHO.

ECHO.
ECHO Copy of required files...
ECHO.
echo y | copy %PATCHTEMP%\osloader.efi %WINDIR%\SYSTEM32\osloader.efi
echo y | copy %PATCHTEMP%\ntkrnlmp.exe %WINDIR%\SYSTEM32\ntkrnlmp.exe
ECHO.

ECHO.
ECHO Process complete.  Upon reboot system and select "PatchGuard Disabled v3".
ECHO.

pause
You need select file osloader.efi to patch manually. Tested on Win7 SP1 17514
Attached Images
File Type: png osloader.efi.png (6.7 KB, 4 views)

Last edited by Gelip; 05-15-2024 at 06:37.
Reply With Quote
  #55  
Old 05-15-2024, 11:31
Fyyre's Avatar
Fyyre Fyyre is offline
Fyyre
 
Join Date: Dec 2009
Location: 0°N 0°E / 0°N 0°E / 0; 0
Posts: 272
Rept. Given: 89
Rept. Rcvd 86 Times in 39 Posts
Thanks Given: 167
Thanks Rcvd at 340 Times in 118 Posts
Fyyre Reputation: 86
Hi Gelip!

Did this work for you? If so -- wonderful! =)

I will note:

hFiref0x and I created UPGDSED based on my "disable PG/DS" idea and research.

I'm not sure if you tried using it... it should still work fine, although the project is no longer updated.

Perhaps someone released a more modern way to disable DSE and PatchGuard? However I am unfamiliar with what alternatives are.

Be well!
-Fyyre

Quote:
Originally Posted by Gelip View Post
How patch winload.efi instead winload.exe from Win7 SP1 ?

Edited
=====
OK, I make second mk_bcdentry_UEFI.cmd script for UEFI:
Code:
ECHO OFF

ECHO.
ECHO Copy of required files...
ECHO.

set PATCHTEMP=%CD%
cd %PATCHTEMP%
echo y | copy %WINDIR%\SYSTEM32\winload.efi %PATCHTEMP%\osloader.efi
echo y | copy %WINDIR%\SYSTEM32\ntoskrnl.exe %PATCHTEMP%\ntkrnlmp.exe

set OLD_GUID={46595952-454E-4F50-4747-554944FFFFFF}
set ENTRY_GUID={46595952-454E-4F50-4747-554944FEEEEE}

ECHO.
ECHO Delete BCD Entries, if existing...
bcdedit -delete %ENTRY_GUID%
bcdedit -delete %OLD_GUID%
ECHO.

ECHO.
ECHO Creating BCD Entry...
ECHO.

bcdedit -create %ENTRY_GUID% -d "PatchGuard Disabled v3" -application OSLOADER
bcdedit -set %ENTRY_GUID% device partition=%SYSTEMDRIVE%
bcdedit -set %ENTRY_GUID% osdevice partition=%SYSTEMDRIVE%
bcdedit -set %ENTRY_GUID% systemroot \Windows
bcdedit -set %ENTRY_GUID% path \Windows\system32\osloader.efi
bcdedit -set %ENTRY_GUID% kernel ntkrnlmp.exe
bcdedit -set %ENTRY_GUID% recoveryenabled 0
bcdedit -set %ENTRY_GUID% nx OptIn
bcdedit -set %ENTRY_GUID% nointegritychecks 1
bcdedit -set %ENTRY_GUID% inherit {bootloadersettings}

bcdedit -displayorder %ENTRY_GUID% -addlast
bcdedit -timeout 10

ECHO.
ECHO Setting PEAUTH service to manual... (avoid BSOD at login screen)
ECHO.
sc config peauth start= demand

ECHO.
ECHO Calling patcher!  Please press "Patch", next "Exit" before continue here...
ECHO.
%PATCHTEMP%\no_ds_pg.exe
ECHO.
ECHO.

ECHO.
ECHO Copy of required files...
ECHO.
echo y | copy %PATCHTEMP%\osloader.efi %WINDIR%\SYSTEM32\osloader.efi
echo y | copy %PATCHTEMP%\ntkrnlmp.exe %WINDIR%\SYSTEM32\ntkrnlmp.exe
ECHO.

ECHO.
ECHO Process complete.  Upon reboot system and select "PatchGuard Disabled v3".
ECHO.

pause
You need select file osloader.efi to patch manually. Tested on Win7 SP1 17514
__________________
Best Wishes,

Fyyre

--

https://github.com/Fyyre
Reply With Quote
  #56  
Old 05-15-2024, 13:00
Gelip Gelip is offline
Friend
 
Join Date: Jun 2022
Posts: 7
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Gelip Reputation: 0
Quote:
Originally Posted by Fyyre View Post
Hi Gelip!
Did this work for you? If so -- wonderful! =)
Yes, but Win7 must be activate or work only 30 day from fresh install OS. I test driver signing BeepXP:

Normal boot - digital signature error (service beepxp not running)
https://i.ibb.co/YpYgg7z/normal-boot.png
PatchGuard Disabled v3 - service beepxp running, driver works :
https://i.ibb.co/XtvmbdG/patch-works.png
https://i.ibb.co/6Dj1vSz/UEFI.png

How test PatchGuard?

Last edited by Gelip; 05-15-2024 at 13:07.
Reply With Quote
  #57  
Old 06-07-2024, 21:25
Fyyre's Avatar
Fyyre Fyyre is offline
Fyyre
 
Join Date: Dec 2009
Location: 0°N 0°E / 0°N 0°E / 0; 0
Posts: 272
Rept. Given: 89
Rept. Rcvd 86 Times in 39 Posts
Thanks Given: 167
Thanks Rcvd at 340 Times in 118 Posts
Fyyre Reputation: 86
Quote:
Originally Posted by Gelip View Post
Yes, but Win7 must be activate or work only 30 day from fresh install OS. I test driver signing BeepXP:

Normal boot - digital signature error (service beepxp not running)
https://i.ibb.co/YpYgg7z/normal-boot.png
PatchGuard Disabled v3 - service beepxp running, driver works :):
https://i.ibb.co/XtvmbdG/patch-works.png
https://i.ibb.co/6Dj1vSz/UEFI.png

How test PatchGuard?
Do something Microsoft doesn't like such as modify the SSDT or Shadow SSDT. Better yet, I can send you some ancient source for a x64 process hider I made, that also does the trick.
__________________
Best Wishes,

Fyyre

--

https://github.com/Fyyre
Reply With Quote
The Following User Says Thank You to Fyyre For This Useful Post:
ahmadmansoor (06-09-2024)
  #58  
Old 06-09-2024, 01:26
ahmadmansoor's Avatar
ahmadmansoor ahmadmansoor is offline
Coder
 
Join Date: Feb 2006
Location: Syria
Posts: 1,047
Rept. Given: 514
Rept. Rcvd 374 Times in 142 Posts
Thanks Given: 375
Thanks Rcvd at 410 Times in 119 Posts
ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399
Quote:
Originally Posted by Fyyre View Post
Do something Microsoft doesn't like such as modify the SSDT or Shadow SSDT. Better yet, I can send you some ancient source for a x64 process hider I made, that also does the trick.
Maybe u can share it with all of us
Thanks
__________________
Ur Best Friend Ahmadmansoor
Always My Best Friend: Aaron & JMI & ZeNiX
Reply With Quote
  #59  
Old 06-09-2024, 04:19
Fyyre's Avatar
Fyyre Fyyre is offline
Fyyre
 
Join Date: Dec 2009
Location: 0°N 0°E / 0°N 0°E / 0; 0
Posts: 272
Rept. Given: 89
Rept. Rcvd 86 Times in 39 Posts
Thanks Given: 167
Thanks Rcvd at 340 Times in 118 Posts
Fyyre Reputation: 86
Quote:
Originally Posted by ahmadmansoor View Post
Maybe u can share it with all of us :D
Thanks
Certainly, I will :) let me clean it up and see that it still loads
__________________
Best Wishes,

Fyyre

--

https://github.com/Fyyre
Reply With Quote
The Following User Says Thank You to Fyyre For This Useful Post:
ahmadmansoor (06-10-2024)
  #60  
Old 06-16-2024, 04:53
Gelip Gelip is offline
Friend
 
Join Date: Jun 2022
Posts: 7
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Gelip Reputation: 0
Quote:
Originally Posted by Fyyre View Post
Do something Microsoft doesn't like such as modify the SSDT or Shadow SSDT. Better yet, I can send you some ancient source for a x64 process hider I made, that also does the trick.
Yes, please.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Universal PatchGuard and Driver Signature Enforcement Disable Fyyre x64 OS 5 06-20-2022 14:12
Driver Signing on x64 Windows _MAX_ x64 OS 7 10-22-2012 15:47
Defeating patchguard and 64bit kernel-mode protections chaboyd General Discussion 1 02-05-2006 07:36


All times are GMT +8. The time now is 03:48.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )