PatchGuard bypass at runtime
Learn more: https://hexderef.com/patchguard-bypass
The source code of the driver (C/C++) that disables Kernel Patch Protection (KPP) at runtime is available for $2,499 USD as non-exclusive software work. The source code also includes a runtime DSE bypass (a manually mappable driver) with which you can load your unsigned driver using nt!_DRIVER_OBJECT. Use the contact form https://overlayhack.com/contact to place an order. Remember to include your Discord or Telegram. The source code requires signing a software work agreement by email.
Drivers compiled into executable form can be purchased for a one-time fee of $249 USD (PayPal or BTC) if you want to test their functionality before purchasing the source code. The included DSE bypass does not require a PatchGuard bypass. This allows analysis of kernel-level anti-cheat systems that block public analysis tools.
Note that there is no need to bypass PatchGuard (PG) if you only need a DSE bypass to load an unsigned driver. An incorrect DSE bypass will trigger a CRITICAL_STRUCTURE_CORRUPTION (109) bug check related to CI!g_CiOptions in CI.dll (0x109_0_CI!g_CiOptions).
In addition, an nt!PspNotifyEnableMask bypass is included. A single-byte modification in kernel memory disables all core functions of any endpoint protection solution. This effectively blinds the security product, meaning it can no longer see which processes are being launched, and so on. The implementation is available here: https://github.com/ByteWhite1x1/EDR-bypass-disable-PspNotifyEnableMask.
[+] Windows 10 (22H2) | Windows 11 (24H2/25H2) compatible
[+] Secure boot supported
[+] No reboot required
[+] Undetected (UD) in every kernel anti-cheat
[+] Source code available for purchase
[-] HVCI
To summarize what is included in the source code:
- The loader driver (manually mapped) that disables DSE at runtime.
- The driver containing the driver object (PatchGuard bypass driver).
- The following runtime bypasses: DSE, Windows core security, and PatchGuard.
- The loader driver unloads the PG bypass driver, making it undetectable to all kernel-level anti-cheat systems.
What happens under the hood? The code enumerates the kernel timer list (KTIMER) and decrypts the DPCs found within it. It also walks through specific system threads and performs stack walking to identify threads that are executing code outside of valid module regions.
On Windows 11 24H2: "Device Security->App & browser control->Check apps and files" must be turned off
1391:648
Terms of use for the compiled driver: You may not resell or share the driver to any 3rd party.
Bitcoin (BTC) is the only payment method for the source code. I use coinbase.com.
The project is a compilable VS2019+ project. The source code is intended for those who have previous experience in coding kernel drivers.
The PatchGuard routine initializes in many different ways and new methods may be added in the future. The driver and the source code is therefore provided AS IS with no warranty of any kind.
The author has however tested the driver for at least 12 hours on a bare metal and Hyper-V VM by applying DKOM such as unlinking the driver from the loaded modules list (PsLoadedModuleList). This kind of direct kernel object manipulation (DKOM) is subject to PatchGuard CRITICAL_STRUCTURE_CORRUPTION 0x109 BSDO. If you byte patch the kernel text section, let's say a routine with a RETN. It is also subject BAD_STACK_0x109 bug check. The bypass enables you also to patch the kernel according to your needs.
448:464
The driver disables PatchGuard integrity checks at runtime. Bypass methods that rely on EFI bootkits or Type‑1 hypervisors (HV) do not work when Secure Boot is enabled. Therefore, this solution is more convenient and easier to use.
Q: Do I need a code signing certificate (EV) to load the driver?
A: No you do not. You can use the KDU project https://github.com/hfiref0x/KDU to load the manually mapped driver that in turn loads an unsigned driver with nt!_DRIVER_OBJECT.
Q: There are free open source PatchGuard bypasses. Why would I pay for this?
A: Most of public ones are not supported, are out of date, are detected in anti-cheats, partially working or not working at all. A sophistication level in this private PatchGuard/DSE bypass is different to the public ones. It is also worth mentioning that kernel level anti-cheats can easily detect any EFI bootkit based bypasses for the fact that there is no PatchGuard context in the kernel memory at all if you bypass kernel patch protection at boot time.
The source code is the best solution because it allows you to modify the control flow and make the driver unique and undetectable in anti-cheats. In addition, the source code enables LLVM-EX virtualization, ensuring that every build becomes automatically unique.
If PatchGuard (PG) is disabled at boot, an anti-cheat can detect it because the global context is missing. This makes it clear that PG was bypassed during system startup.
A proof of uptime:
454:457
Terms for the source code:
The origin of the source code must not be misrepresented. The original author of the source code is White Byte at overlayhack.com
The source code is sold unconditionally for private or internal company use. In no event you or the company who bought the source code may not distribute or resell the source code in any form or distribute information obtained from the source code to third parties. You may only distribute the code in a compiled form.
No author or distributor accepts responsibility to anyone for the consequences of using the source code.
The source code of the driver (C/C++) that disables Kernel Patch Protection (KPP) at runtime is available for $2,499 USD as non-exclusive software work. The source code also includes a runtime DSE bypass (a manually mappable driver) with which you can load your unsigned driver using nt!_DRIVER_OBJECT. Use the contact form https://overlayhack.com/contact to place an order. Remember to include your Discord or Telegram. The source code requires signing a software work agreement by email.
Drivers compiled into executable form can be purchased for a one-time fee of $249 USD (PayPal or BTC) if you want to test their functionality before purchasing the source code. The included DSE bypass does not require a PatchGuard bypass. This allows analysis of kernel-level anti-cheat systems that block public analysis tools.
Note that there is no need to bypass PatchGuard (PG) if you only need a DSE bypass to load an unsigned driver. An incorrect DSE bypass will trigger a CRITICAL_STRUCTURE_CORRUPTION (109) bug check related to CI!g_CiOptions in CI.dll (0x109_0_CI!g_CiOptions).
In addition, an nt!PspNotifyEnableMask bypass is included. A single-byte modification in kernel memory disables all core functions of any endpoint protection solution. This effectively blinds the security product, meaning it can no longer see which processes are being launched, and so on. The implementation is available here: https://github.com/ByteWhite1x1/EDR-bypass-disable-PspNotifyEnableMask.
[+] Windows 10 (22H2) | Windows 11 (24H2/25H2) compatible
[+] Secure boot supported
[+] No reboot required
[+] Undetected (UD) in every kernel anti-cheat
[+] Source code available for purchase
[-] HVCI
To summarize what is included in the source code:
- The loader driver (manually mapped) that disables DSE at runtime.
- The driver containing the driver object (PatchGuard bypass driver).
- The following runtime bypasses: DSE, Windows core security, and PatchGuard.
- The loader driver unloads the PG bypass driver, making it undetectable to all kernel-level anti-cheat systems.
What happens under the hood? The code enumerates the kernel timer list (KTIMER) and decrypts the DPCs found within it. It also walks through specific system threads and performs stack walking to identify threads that are executing code outside of valid module regions.
On Windows 11 24H2: "Device Security->App & browser control->Check apps and files" must be turned off
1391:648
Terms of use for the compiled driver: You may not resell or share the driver to any 3rd party.
Bitcoin (BTC) is the only payment method for the source code. I use coinbase.com.
The project is a compilable VS2019+ project. The source code is intended for those who have previous experience in coding kernel drivers.
The PatchGuard routine initializes in many different ways and new methods may be added in the future. The driver and the source code is therefore provided AS IS with no warranty of any kind.
The author has however tested the driver for at least 12 hours on a bare metal and Hyper-V VM by applying DKOM such as unlinking the driver from the loaded modules list (PsLoadedModuleList). This kind of direct kernel object manipulation (DKOM) is subject to PatchGuard CRITICAL_STRUCTURE_CORRUPTION 0x109 BSDO. If you byte patch the kernel text section, let's say a routine with a RETN. It is also subject BAD_STACK_0x109 bug check. The bypass enables you also to patch the kernel according to your needs.
448:464
The driver disables PatchGuard integrity checks at runtime. Bypass methods that rely on EFI bootkits or Type‑1 hypervisors (HV) do not work when Secure Boot is enabled. Therefore, this solution is more convenient and easier to use.
Q: Do I need a code signing certificate (EV) to load the driver?
A: No you do not. You can use the KDU project https://github.com/hfiref0x/KDU to load the manually mapped driver that in turn loads an unsigned driver with nt!_DRIVER_OBJECT.
Q: There are free open source PatchGuard bypasses. Why would I pay for this?
A: Most of public ones are not supported, are out of date, are detected in anti-cheats, partially working or not working at all. A sophistication level in this private PatchGuard/DSE bypass is different to the public ones. It is also worth mentioning that kernel level anti-cheats can easily detect any EFI bootkit based bypasses for the fact that there is no PatchGuard context in the kernel memory at all if you bypass kernel patch protection at boot time.
The source code is the best solution because it allows you to modify the control flow and make the driver unique and undetectable in anti-cheats. In addition, the source code enables LLVM-EX virtualization, ensuring that every build becomes automatically unique.
If PatchGuard (PG) is disabled at boot, an anti-cheat can detect it because the global context is missing. This makes it clear that PG was bypassed during system startup.
A proof of uptime:
454:457
Terms for the source code:
The origin of the source code must not be misrepresented. The original author of the source code is White Byte at overlayhack.com
The source code is sold unconditionally for private or internal company use. In no event you or the company who bought the source code may not distribute or resell the source code in any form or distribute information obtained from the source code to third parties. You may only distribute the code in a compiled form.
No author or distributor accepts responsibility to anyone for the consequences of using the source code.
| #992 Title: Administrator |
07/25/2023 01:33 - 1144 days 4 hours 47 minutes #992 |
The recent windows kernel update broke the DSE bypass on Windows 10 22H2 Build: 19045.3208. I've adapted the update and it works in the latest version at the time of this post.
| #1010 Title: Administrator |
01/17/2024 20:29 - 967 days 8 hours 51 minutes #1010 |
I've just verified both DSE and PatchGuard bypass at runtime on:
Windows 10 Pro 22H2 19045.3208
Windows 11 Pro 22H2 22621.3007
Windows 10 Pro 22H2 19045.3208
Windows 11 Pro 22H2 22621.3007
| #1014 Title: Administrator |
04/07/2024 18:19 - 886 days 12 hours 0 minutes #1014 |
The bypass has been verified on Windows 11 Pro 23H2 (Build: 22631)
| #1018 Title: diegobt wrote: |
09/09/2024 20:07 - 731 days 10 hours 12 minutes #1018 |
Hi I am interested in the PatchGuard bypass source code. I would like more information
Thank you
/diego
Thank you
/diego
| #1025 Title: jwahirtibbles5 wrote: |
10/21/2024 11:59 - 689 days 18 hours 20 minutes #1025 |
Hi I am interested in the PatchGuard bypass source code.
Thanks you
Thanks you
| #1032 Title: Recent Windows OS compatibility A visitor wrote: |
02/19/2025 18:25 - 568 days 10 hours 55 minutes #1032 |
Does this bypass work on Windows 11 24H2?
| #1033 Title: Administrator |
02/26/2025 21:11 - 561 days 8 hours 8 minutes #1033 |
#1032 Originally posted by A visitor : https://overlayhack.com/patchguard-bypass#1032
Yes. I've just adapted the bypass. There were many changes. Also DSE bypass works as described in the first post. To summarize what's included:
- A manually mapped loader driver with DSE bypass at runtime that loads a PatchGuard bypass driver directly from the kernel
- A shared memory communication between the two drivers
- The code itself is very informative in terms of learning Windows internals
Post your Telegram in a comment and I'll add you if you're interested to purchase the source code. 2,499 USD in BTC. Thanks.
Yes. I've just adapted the bypass. There were many changes. Also DSE bypass works as described in the first post. To summarize what's included:
- A manually mapped loader driver with DSE bypass at runtime that loads a PatchGuard bypass driver directly from the kernel
- A shared memory communication between the two drivers
- The code itself is very informative in terms of learning Windows internals
Post your Telegram in a comment and I'll add you if you're interested to purchase the source code. 2,499 USD in BTC. Thanks.
| #1037 Title: PatchGuard bypass Windows 11 Pro Administrator |
11/06/2025 18:40 - 308 days 10 hours 40 minutes #1037 |
I've just added Windows 11 25H2 support. As of 11/2025. The following versions were tested:
Windows 10 Pro 22H2 Build: 19045.6456
Windows 11 Pro 24H2 Build: 26100.6899
Windows 11 Pro 25H2 Build: 26200.6899
Windows 10 Pro 22H2 Build: 19045.6456
Windows 11 Pro 24H2 Build: 26100.6899
Windows 11 Pro 25H2 Build: 26200.6899
Post a comment
