Inventário do que o PatchGuard monitoriza

ntoskrnl.exe 10.0.26100.9168 (Win11 24H2) · dump mem09.elf · 3 contextos (global, ExpTimeZoneDpcRoutine, ExpTimerDpcRoutine) · 1126 descritores · 861/861 verificados · 34 tipos instanciados dos 49 que o dispatcher reconhece.

---

1. Módulos

27 dos 168 carregados.

Módulo	0x00 EXPORT	0x00 .xdata	0x01 .pdata	0x1E preenchimento	0x0D IAT	0x23 LOAD_CONFIG	0x2C cabeçalho PE	0x30 retpoline	0x21 hash de página
ntoskrnl.exe	✓	✓	✓	✓	✓	✓	✓	·	✓
hal.dll	✓	·	·	·	·	·	✓	·	✓
win32k.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
CI.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
ndis.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
tcpip.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
Ntfs.sys	·	✓	✓	✓	✓	✓	✓	✓	✓
FLTMGR.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
msrpc.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
ksecdd.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
cng.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
clipsp.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
dxgkrnl.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
watchdog.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
PSHED.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
BOOTVID.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
kdcom.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
CLFS.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
tm.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
WMILIB.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
werkernel.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
ntosext.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
cmimcext.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
symcryptk.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
winaccel.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
globmerger.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
msseccore.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓

Intervalos de hash de página (tipo 0x21, 20 bytes por página de 4 KB, amostrados aleatoriamente acima de 16 páginas):

Módulo	Comprimento	Páginas
ntoskrnl.exe	0x1604000	5636
dxgkrnl.sys	0x4fc000	1276
Ntfs.sys	0x36e000	878
tcpip.sys	0x35c000	860
ndis.sys	0x1c2000	450
CI.dll	0x11e000	286
clipsp.sys	0x11b000	283
cng.sys	0xed000	237
win32k.sys	0xcb000	203
FLTMGR.SYS	0x99000	153
CLFS.SYS	0x90000	144
msrpc.sys	0x69000	105
ksecdd.sys	0x3a000	58
tm.sys	0x2e000	46
watchdog.sys	0x24000	36
globmerger.sys	0x24000	36
PSHED.dll	0x21000	33
werkernel.sys	0x1b000	27
winaccel.sys	0x19000	25
cmimcext.sys	0x16000	22
msseccore.sys	0x13000	19
symcryptk.dll	0x11000	17
BOOTVID.dll	0x11000	17
ntosext.sys	0x11000	17
WMILIB.SYS	0x11000	17
kdcom.dll	0xf000	15
hal.dll	0xa000	10

---

2. Globais nomeados

Tipo 0x20 no contexto global, 0x00 nos convencionais.

Símbolo	Tamanho
nt!KiServiceTable	0x7a4
nt!KeServiceDescriptorTable	0x20
nt!KeServiceDescriptorTable+0x20	0x20
nt!KeServiceDescriptorTableShadow	0x20
nt!KeServiceDescriptorTableShadow+0x20	0x20
nt!KeServiceDescriptorTableFilter	0x20
nt!KeServiceDescriptorTableFilter+0x20	0x20
nt!PsAltSystemCallHandlers	0x10
win32k.sys!TABLERO+0x0	0x1764
win32k.sys!TABLERO+0x2330	0x1764
nt!HalDispatchTable+0x8	0x8
nt!HalPrivateDispatchTable+0x450	0x8
nt!HalPerformEndOfInterruptAtController	0x8
nt!HalpProfileInterface	0x8
nt!HalpProfileFeatures	0x4
nt!SeCiCallbacks	0x110
nt!SeCiDebugOptions	0x4
nt!SeILSigningPolicy	0x1
nt!SeProtectedMapping	0x12
nt!SeMsMinTCBList	0x198
nt!g_SecureBootPolicyBlobHeader	0x18
CI.dll!CiPolicy+0x0	0x4
CI.dll!CiPolicy+0x4	0x4
CI.dll!CiPolicy+0x8	0x1
CI.dll!CiPolicy+0xc	0x4
CI.dll!CiPolicy+0x10	0x4
CI.dll!.data+0x1588	0x8
CI.dll!.data+0x15a0	0x70
CI.dll!.data+0x1640	0x40
nt!HvcallCodeVa	0x8
nt!HvlpHypercallCodeVa	0x8
nt!HvlpVsmVtlCallVa	0x8
nt!HvlpInterruptCallback	0x28
nt!MiState+0xca0	0x8
nt!MiState+0xca8	0x8
nt!MmBadPointer	0x8
nt!MmHighestUserAddress	0x8
nt!MmUserProbeAddress	0x8
nt!MmSystemRangeStart	0x8
nt!KiKvaShadow	0x1
nt!KiIsrThunkShadow	0x800
nt!KiDebugTraps	0x40
nt!KiDynamicTraceEnabled	0x4
nt!KiDynamicTraceCallouts	0x58
nt!ObpObjectTypes	0x1d0
nt!ExpInitializeCallback	0x80
nt!PsWin32NullCallBack	0x8
nt!PspPicoProviderRoutines	0x58
nt!PspSystemMitigationOptions	0x18
nt!PsInvertedFunctionTable+0x10	0x18
nt!RtlpUnwindHistoryTable	0xd8
nt!RtlProtectedAccess	0x6c
nt!InitSafeBootMode	0x4
nt!KdpBootedNodebug	0x1
nt!__ti_a	0x158
KUSER_SHARED_DATA+0x274	0x40
KUSER_SHARED_DATA+0x308	0x4
KUSER_SHARED_DATA+0xa80	0x580
msseccore.sys!.rdata+0x0	0x10
msseccore.sys!SecKdpSe+0x8	0x8

---

3. Tipos de objeto

Tipo 0x08 (duplicado como 0x20): os 0x40 bytes de _OBJECT_TYPE_INITIALIZER de todos os 58 tipos de objeto do sistema, sem exceção.

ALPC Port            ActivationObject     ActivityReference    Adapter
Callback             Composition          Controller           CoreMessaging
CoverageSampler      CpuPartition         DebugObject          Desktop
Device               Directory            DmaAdapter           Driver
EnergyTracker        EtwConsumer          EtwRegistration      EtwSessionDemuxEntry
Event                File                 IRTimer              IoCompletion
IoCompletionReserve  IoRing               Job                  Key
KeyedEvent           Mutant               Partition            PowerRequest
Process              ProcessStateChange   Profile              PsSiloContextNonPaged
PsSiloContextPaged   RawInputManager      RegistryTransaction  SchedulerSharedData
Section              Semaphore            Session              SymbolicLink
Thread               ThreadStateChange    Timer                TmEn
TmRm                 TmTm                 TmTx                 Token
TpWorkerFactory      Type                 UserApcReserve       WaitCompletionPacket
WindowStation        WmiGuid

4. Por processador

13 regiões mais IDT e GDT por CPU (2 CPUs nesta inicialização).

Tipo	Região	Tamanho
0x02	IDT — os primeiros 53 vetores	0x350
0x03	GDT	0x50
0x03	registradores de segmento LDTR, SS, TR (KiGetLdtr/KiGetSs/KiGetTr)	—
0x20/0x00	KPCR+0x00 — GdtBase	0x8
0x20/0x00	KPCR+0x08 — TssBase	0x8
0x20/0x00	KPCR+0x38 — IdtBase	0x8
0x20/0x00	KPCR+0x108	0x8
0x20/0x00	o _KTSS64 inteiro até IoMapBase	0x68
0x20/0x00	TSS.Ist[1] … TSS.Ist[4] (passo 0x200)	0x10 ×4
0x20/0x00	palavra de ponteiro reverso no final de 4 blocos de 32 KB (passo 0x8000)	0x8 ×4

Compartilhado por todos os processadores:

Tipo	Região	Tamanho
0x20/0x00	tabela de 32 registros {ntoskrnl RVA, address}, dois blocos contíguos	0x200 ×2

---

5. MSRs

Tipo 0x07, um descritor por processador, 11 MSRs cada.