aboutsummaryrefslogtreecommitdiff
path: root/EfiGuardDxe
Commit message (Collapse)AuthorAge
* Changed gEfiGuardDriverProtocolGuid, EFIGUARD_BACKDOOR_VARIABLE_NAME and ↵testmyToni Uhlig2025-05-21
| | | | | | | | EFIGUARD_BACKDOOR_COOKIE_VALUE * added some measurements that will get used later Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added partial PatchGuard disable at compile time with `-D EAC_COMPAT_MODE=1`.Toni Uhlig2025-04-23
| | | | | | | | * runtime DSE disabling still possible * compatible with EasyAntiCheat * no bsod so far Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Disable PatchGuard at compile time with `-D DO_NOT_DISABLE_PATCHGUARD=1`.Toni Uhlig2025-04-23
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Changed EfiGaurd title to something more "neutral" ;)Toni Uhlig2025-04-23
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Add VeraCrypt support (#136)worldwidefuckfest2025-02-24
|
* Fix build with current EDK2 masterMatthijs Lavrijsen2025-01-17
| | | | | | | | Override the unwanted /GS flag addition (MSVC) and -fno-stack-protector removal (GCC) introduced in https://github.com/tianocore/edk2/commit/f53f029122d4493e9db95e2424dd8f067f247661 Additionally remove some other (less harmful but still unwanted) build flags that have been made the default in MSVC in the .vcxproj/.props files as well. Fixes #134
* Misc. minor warning fixesMatthijs Lavrijsen2025-01-17
|
* Use case-insensitive string comparison when checking file namesMatthijs Lavrijsen2024-01-21
|
* Pedantic assert fix in SetVariable hookMatthijs Lavrijsen2024-01-20
|
* KiSwInterrupt patch: reuse INIT section as PG contextMatthijs Lavrijsen2023-10-15
| | | | INIT is already discardable (and exists in all NT kernels), no need to obtain INITDATA separately.
* Fix build with GCC toolchainMatthijs Lavrijsen2023-10-14
|
* Always use CopyWpMem in SetVariable hookMatthijs Lavrijsen2023-10-14
|
* Check CR4_CET.SH_STK_EN before adjusting shadow stackMatthijs Lavrijsen2023-10-14
|
* Use EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL if availableMatthijs Lavrijsen2023-10-12
|
* Fix KiVerifyScopesExecute signature for LA57 kernelMatthijs Lavrijsen2023-10-03
| | | | ntkrla57.exe uses AND with r/m32 here rather than r/m64, which the signature was needlessly specific about by including a REX prefix
* Add updated decode search for OslFwpKernelSetupPhase1Matthijs Lavrijsen2023-10-03
|
* KiSwInterrupt patch: change the PG context address instead if possibleMatthijs Lavrijsen2023-10-01
| | | | Reference: #101
* Disable CET when clearing CR0.WPMatthijs Lavrijsen2023-09-27
|
* EfiGuardDxe: delay driver unload when a non-Windows OS is bootedMatthijs Lavrijsen2023-09-26
| | | | Fixes #91
* Fix build with current EDK2 masterMatthijs Lavrijsen2023-06-22
| | | | Rename RUNTIME_FUNCTION to resolve a conflict with edk2's incomplete redefinition added in https://github.com/tianocore/edk2/commit/ff52068d9261b9391d75b83a2a4e40e040f3b6eb
* Handle 5-level paging when checking canonical address bitsMatthijs Lavrijsen2023-04-26
|
* EfiGuardDxe: distinguish between winload and kernel build numbersMatthijs Lavrijsen2023-04-03
|
* Clean up linker optionsv1.3Matthijs Lavrijsen2023-03-26
|
* RtlSleep: wait for a timer event instead of stallingMatthijs Lavrijsen2023-03-26
|
* EfiGuardDxe: clear and restore CR0.WP when copyingMatthijs Lavrijsen2023-03-26
| | | | This is intended to deal with the UEFI memory protection protocol (EFI_MEMORY_ATTRIBUTE_PROTOCOL) introduced in the UEFI 2.10 specification.
* Add CopyWpMem and SetWpMem routinesMatthijs Lavrijsen2023-03-26
| | | | Additionally make SetServicePointer also clear and restore CR0.WP if needed
* Update Zydis to v4Matthijs Lavrijsen2023-03-26
|
* EfiGuardDxe: disable VBS for the current bootMatthijs Lavrijsen2023-03-16
| | | | | | | This prevents a bugcheck on Windows 10 and later when VBS is enabled, which was made the default setting in Windows 11. Additionally, EfiDSEFix will not proceed if it detects that VBS is still unexpectedly running (meaning either EfiGuardDxe was never loaded, or it failed to disable VBS). Fixes #59
* Misc. warning fixesMatthijs Lavrijsen2023-03-13
|
* Macro sanitizationMatthijs Lavrijsen2023-02-27
|
* Add StrniCmp implementationMatthijs Lavrijsen2022-08-24
|
* Misc. warning fixesMatthijs Lavrijsen2022-08-17
|
* DXE driver: store the full kernel build number in global contextMatthijs Lavrijsen2022-08-17
|
* EfiGuardDxe: add VisualUefi support for recent versions of edk2Matthijs Lavrijsen2022-08-17
|
* Fix warnings when compiling with GCCMatthijs Lavrijsen2022-04-21
|
* Update arc.hv1.2Matthijs Lavrijsen2021-05-12
|
* Fix Resharper warningsMatthijs Lavrijsen2021-05-12
|
* Use PE runtime function tables for finding function start addressesv1.1.1Matthijs Lavrijsen2021-01-30
|
* Update Zydis submoduleMatthijs Lavrijsen2021-01-30
|
* Patch nt!KiMcaDeferredRecoveryService on Windows >= 8.1Mattiwatti2020-05-07
|
* Patch nt!KiVerifyScopesExecute on Windows >= 8.1Mattiwatti2020-05-07
|
* Disable PatchGuard verification call in KiSwInterruptMattiwatti2020-05-03
| | | | KiSwInterrupt is present since Windows 10 and is the interrupt handler for int 20h. This interrupt is a spurious interrupt on older versions of Windows, and does nothing useful on Windows 10. If int 20h is issued from kernel mode, the PatchGuard verification routine KiSwInterruptDispatch is called. This leads to a bugcheck if PatchGuard has not been initialized.
* Update SeCodeIntegrityQueryInformation signatureMattiwatti2019-12-04
| | | | This makes this optional pattern scan work on the current Windows 10 20H1 preview release
* Compile as UTF-8Mattiwatti2019-12-04
|
* Update Zydis submodulev1.0.2Mattiwatti2019-10-07
|
* Disable Spectre mitigation crapMattiwatti2019-10-07
|
* Call driver unload if a non-Windows OS is being bootedMattiwatti2019-05-06
|
* Update arc.hMattiwatti2019-05-06
|
* Minor fixesMattiwatti2019-05-06
|
* Fix two dumb mistakes that were cancelling each other outMattiwatti2019-05-06
| | | | PE section names must be null terminated because they are not guaranteed to be. However they must be null terminated at 8 characters, not at the length of the string that happens to be relevant for whatever reason. This would have led to false positives when finding sections, were it not for the off-by-one error that was keeping an additional character in the buffer
Powered by cgit, Themed by Ted Yin.