ByePg - GitLite

KO | EN

gitlite — search

#security #awesome-list #gemini #nodejs #svg #postgresql #generative-ai #sql #awesome #rag

ByePg

(★ 914)

Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.

파일 탐색기

ZIP 다운로드

- - BugCheck.h
  - HAL.h
  - Internals.h
  - Processor.h
- ByePg.cpp
- ByePgLib.vcxproj
- ByePgLib.vcxproj.filters
- ByePgLib.vcxproj.user
- ByePgLibvcxproj.user
- ExceptionHandler.h
- HalCallbacks.h
- ExceptionHookingDemo.vcxproj
- ExceptionHookingDemo.vcxproj.filters
- ExceptionHookingDemo.vcxproj.user
- main.cpp
- - Internals.h
- ExHook.vcxproj
- ExHook.vcxproj.filters
- ExHook.vcxproj.user
- main.cpp
- - SEH.h
- FreeSeh.vcxproj
- FreeSeh.vcxproj.filters
- FreeSeh.vcxproj.user
- main.cpp
- ByePg.h
- IhFix.cpp
- IhFix.h
- InfinityHookFix.vcxproj
- InfinityHookFix.vcxproj.user
- ExHook.png
.gitignore
ByePg.sln
README.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

ByePg hijacks the HalPrivateDispatchTable table to create a early-bugcheck hook. Utilizing this early-bugcheck hook it collects information about the exception and basically provides a simple interface to register a high-level system-wide exception handler.

A variety of kernel hooks can be implemented using this method completely bypassing PatchGuard and HVCI as it creates an entirely new attack surface, exception-based hooking, which was previously not possible in Windows kernel.

## Writeup:
https://blog.can.ac/2019/10/19/byepg-defeating-patchguard-using-exception-hooking/

## Project Structure:
- `\ByePgLib` contains the base library
- `\ExHook` contains a standalone SYSCALL hooking example using ByePg
- `\ExceptionHookingDemo` demonstrates the exception handler 
- `\InfinityHookFix` contains a sample rendering the recent InfinityHook patch by Microsoft useless
- `\FreeSeh` contains a SEH-via-ByePg module letting you use SEH in manual mapped images bypassing PatchGuard's inverted function table checks

## Result:

![ExHook](https://raw.githubusercontent.com/can1357/ByePg/master/Resources/ExHook.png)

## P.S.
There are many other things that can be done using the base library and many things can be improved, be SEH handling or BugCheck parsing, so I would **really** appreciate any form of contribution to this repo.