GuardMon is a hypervisor based tool for monitoring system register accesses. GuardMon is capable of logging read and write activities on CR0, CR4, debug registers, GDT, IDT and MSRs from kernel memory not backed by any images.
This tool is particularly useful for analyzing the Windows built-in kernel patch protection, a.k.a. PatchGuard as it runs on non-image regions most of time. A demo movie can be found in Youtube:
GuardMon is implemented on the top of HyperPlatform and primarily designed for a demo purpose. See a project page for more details of HyperPlatform:
Clone full source code from Github with a below command and compile it on Visual Studio.
$ git clone --recursive https://github.com/tandasat/GuardMon.git
On the x64 platform, you have to enable test signing to install the driver. To do that, open the command prompt with the administrator privilege and type the following command, and then restart the system to activate the change:
>bcdedit /set testsigning on
To install and uninstall the driver, use the 'sc' command. For installation:
>sc create GuardMon type= kernel binPath= C:\Users\user\Desktop\GuardMon.sys
>sc start GuardMon
For uninstallation:
>sc stop GuardMon
>sc delete GuardMon
>bcdedit /deletevalue testsigning
Note that the system must support the Intel VT-x and EPT technology to successfully install the driver.
To install the driver on a virtual machine on VMware Workstation, see an "Using VMware Workstation" section in the HyperPlatform User Document.
All logs are printed out to DbgView and saved in C:\Windows\GuardMon.log.
- x64 Windows 7, 8.1 and 10
- The system must support the Intel VT-x and EPT technology
This software is released under the MIT License, see LICENSE.