Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
kurasagi — Windows 11 24H2-25H2 Runtime PatchGuard Bypass | Kitploit
Tools/GitHubGitHub/neomaster831/kurasagi
ExploitationReverse EngineeringPapers & ResearchLearning & EducationRed TeamingAdversarial AttackBinary Exploitation
GitHubneomaster831/kurasagi

kurasagi

Windows 11 24H2-25H2 Runtime PatchGuard Bypass

View Repository
26636610 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

kurasagi

kurasagi is full POC of PatchGuard bypass for Windows 24H2 - 25H2.

For more information, please refer to the product branch, which contains the PDF paper detailing the bypass.

If any BSOD which is related to CRITICAL_STRUCTURE_CORRUPTION (PatchGuard) appears, please create issue with it!

Disclaimers

  1. PLEASE USE IT FOR ONLY EDUCATIONAL PURPOSES!
  2. Do not turn on hypervisor-based security factors when running! (It will BSOD!)
  3. Use kdmapper for driver loading.
  4. After kurasagi has been loaded, we just found there's some weird issue when you allocate pool with NonPagedPoolExecute (or NonPagedPool, it is same), it is not executable. I'll fix as soon as possible.

Images

proof

Credit

Download Tool

Here are the helpful resources I referred to in completing this project. I appreciate these works, ideas, and source codes. Thanks

  • https://blog.tetrane.com/downloads/Tetrane_PatchGuard_Analysis_RS4_v1.01.pdf
  • https://blog.can.ac/2024/06/28/pgc-garbage-collecting-patchguard/
  • https://shhoya.github.io/windows_pgintro.html