ByePg - GitLite

KO | EN

gitlite — search

#c #list #ai #pdf #mcp #go #generative-ai #codex #monitoring #java

ByePg

(★ 914)

Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.

File Explorer

ZIP Download

- - BugCheck.h
  - HAL.h
  - Internals.h
  - Processor.h
- ByePg.cpp
- ByePgLib.vcxproj
- ByePgLib.vcxproj.filters
- ByePgLib.vcxproj.user
- ByePgLibvcxproj.user
- ExceptionHandler.h
- HalCallbacks.h
- ExceptionHookingDemo.vcxproj
- ExceptionHookingDemo.vcxproj.filters
- ExceptionHookingDemo.vcxproj.user
- main.cpp
- - Internals.h
- ExHook.vcxproj
- ExHook.vcxproj.filters
- ExHook.vcxproj.user
- main.cpp
- - SEH.h
- FreeSeh.vcxproj
- FreeSeh.vcxproj.filters
- FreeSeh.vcxproj.user
- main.cpp
- ByePg.h
- IhFix.cpp
- IhFix.h
- InfinityHookFix.vcxproj
- InfinityHookFix.vcxproj.user
- ExHook.png
.gitignore
ByePg.sln
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

ByePg hijacks the HalPrivateDispatchTable table to create a early-bugcheck hook. Utilizing this early-bugcheck hook it collects information about the exception and basically provides a simple interface to register a high-level system-wide exception handler.

A variety of kernel hooks can be implemented using this method completely bypassing PatchGuard and HVCI as it creates an entirely new attack surface, exception-based hooking, which was previously not possible in Windows kernel.

## Writeup:
https://blog.can.ac/2019/10/19/byepg-defeating-patchguard-using-exception-hooking/

## Project Structure:
- `\ByePgLib` contains the base library
- `\ExHook` contains a standalone SYSCALL hooking example using ByePg
- `\ExceptionHookingDemo` demonstrates the exception handler 
- `\InfinityHookFix` contains a sample rendering the recent InfinityHook patch by Microsoft useless
- `\FreeSeh` contains a SEH-via-ByePg module letting you use SEH in manual mapped images bypassing PatchGuard's inverted function table checks

## Result:

![ExHook](https://raw.githubusercontent.com/can1357/ByePg/master/Resources/ExHook.png)

## P.S.
There are many other things that can be done using the base library and many things can be improved, be SEH handling or BugCheck parsing, so I would **really** appreciate any form of contribution to this repo.