Possible to disabke patchguard as well?

[ibay613]

Thank you for making this. Possible to disable Patchguard as well with this or to add such a feature?

[wesmar]

Yes, disabling Patchguard is fully possible, but it requires operating at Ring -1/-2 (SMM/UEFI) to effectively bypass Windows kernel verification mechanisms.

Here are the technical details of the planned approach based on my current tools:

Self-Enrolling Mechanism: I plan to release a tool based on the architecture of my UnderVolter project, which features a built-in custom Root CA (4096-bit RSA). This tool can automatically enroll this certificate into the PK (Platform Key), KEK (Key Exchange Key), and db databases directly from the UEFI shell. Consequently, any subsequent module signed with this key becomes trusted by the firmware.

DeployedMode Bypass: Based on reverse engineering the DellInstrumentation.sys driver (March 2026 version), I have identified a way to manipulate the Secure Boot state. It is possible to force a transition from DeployedMode to AuditMode directly from User Mode. This allows for the modification of secure variables that are normally locked. I'll gradually roll this out to more laptops as I find bugs in the firmware—and there are already plenty of them

Firmware Analysis and Dumping: Using an enhanced version of UEFIExtract (https://kvc.pl/repositories/uefiextract) and integration with the Intel Flash Programming Tool (FPTW), it is possible to dump the BIOS/UEFI image and extract key information about the firmware structure. This allows for precise targeting of the procedures responsible for kernel integrity.

Publication Strategy: Since this technique completely bypasses the Chain of Trust, it will not be published on GitHub. Documentation and tools will be made available on my website: https://kvc.pl/. The release is planned for after June 2026 to wait for Microsoft's announced full update of trusted boot certificates (Secure Boot DBX/CA update), minimizing the risk of these techniques being blocked prematurely.

This feature is currently under development and will be part of a broader ecosystem of firmware-level privilege escalation tools.