sapdragon/efiguard-detectedUsermode tool that detects EfiGuard's DSE bypass by querying the SetVariable backdoor to verify if PatchGuard is disabled on Windows systems.
dumbest possible way to check if EfiGuard killed your patchguard or not.
efiguard leaves a SetVariable backdoor at runtime - we just poke it from usermode asking to read 2 bytes at ntoskrnl base. if we get back MZ - the backdoor is alive, efiguard did its thing, pg is dead.
only works if the user picked the default dse bypass method (DSE_DISABLE_SETVARIABLE_HOOK) — which is the default. if DSE_DISABLE_AT_BOOT was chosen instead, the hook gets removed at ExitBootServices and there's nothing to detect from usermode.
requires admin + SeSystemEnvironmentPrivilege.
cl /EHsc src/main.cpp /link ntdll.lib psapi.lib
src/main.cpp