search

hfiref0x / VBoxHardenedLoader

VirtualBox VM detection mitigation loader
BSD 2-Clause "Simplified" License
919 stars 275 forks source link

load.exe -u is no longer working in 1.6 version #3

Closed univert closed 8 years ago

univert commented 8 years ago

Seems Tsugumi.sys is no longer be able to be unloaded because of TDL unless rebooted. Is there a way to add a new device control code to Tsugumi.sys so that patching can be disabled without a reboot.

hfiref0x commented 8 years ago

Yes since 1.6 behaviour have changed because of TDL and -u command is not supported anymore.

Currently loader.exe is only writes configuration data to registry and calls tsugumi.sys driver via IOCTL to force it re-read config from registry, so you can change patch data on the fly.

Since tsugumi.sys loaded by TDL, it can't be unloaded without system reboot.

I may consider additional control code that will disable patching, so -u parameter will work again.

hfiref0x commented 8 years ago

/s command added to stop monitoring in v1.6.1.

Usage loader.exe /s

To reenable monitoring run loader again without parameters or with params to custom tables.