Kernel Patch Protection

The kernel connects the application software to the hardware of a computer.

Kernel Patch Protection (KPP), informally known as PatchGuard, is a feature of 64-bit (x64) editions of Microsoft Windows that prevents patching the kernel. It was first introduced in 2005 with the x64 editions of Windows Vista and Windows Server 2003 Service Pack 1.

"Patching the kernel" refers to unsupported modification of the central component or kernel of the Windows operating system. Such modification has never been supported by Microsoft because, according to Microsoft, it can greatly reduce system security, reliability, and performance. Although Microsoft does not recommend it, it is possible to patch the kernel on x86 editions of Windows; however, with the x64 editions of Windows, Microsoft chose to implement additional protection and technical barriers to kernel patching.

Since patching the kernel is possible in 32-bit (x86) editions of Windows, several antivirus software developers use kernel patching to implement antivirus and other security services. These techniques will not work on computers running x64 editions of Windows. Because of this, Kernel Patch Protection resulted in antivirus makers having to redesign their software to not use kernel patching techniques.

However, because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching. This has led to criticism that since KPP is an imperfect defense, the problems caused to antivirus vendors outweigh the benefits because authors of malicious software will simply find ways around its defenses. Nevertheless, Kernel Patch Protection can still prevent problems of system stability, reliability, and performance caused by legitimate software patching the kernel in unsupported ways.

1 2 3 dushane (2023-04-03), PatchGuardBypass, retrieved 2023-04-03

1 2 3 Schofield, Jack (28 September 2006). "Antivirus vendors raise threats over Vista in Europe". The Guardian. Retrieved 20 September 2007. "This has never been supported and has never been endorsed by us. It introduces insecurity, instability, and performance issues, and every time we change something in the kernel, their product breaks." —Ben Fathi, corporate vice president of Microsoft's security technology unit

1 2 3 Skywing (January 2007). "Conclusion". Subverting PatchGuard Version 2. Uninformed. Archived from the original on 4 March 2016. Retrieved 21 September 2007.

↑ Microsoft (August 2007). "Update to Improve Kernel Patch Protection". Microsoft Security Advisory (932596). Microsoft. Retrieved 21 September 2007.

1 2 Skywing (June 2006). "Patching non-exported, non-system-service kernel functions". What Were They Thinking? Anti-Virus Software Gone Wrong. Uninformed. Retrieved 21 September 2007.

↑ "Symantec Internet Security product page". Symantec. 2011. Retrieved 26 January 2011.

↑ "AVG Anti-Virus and Internet Security - Supported Platforms". Grisoft. Archived from the original on 27 August 2007. Retrieved 5 October 2007.

↑ "Notable Changes in Windows Vista Service Pack 1". Microsoft. 2008. Archived from the original on 3 May 2008. Retrieved 20 March 2008.

↑ Skywing (September 2007). "PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3". Uninformed. Retrieved 2 June 2008.

↑ Espiner, Tom (25 October 2006). "EC Vista antitrust concerns fleshed out". silicon.com. Archived from the original on 2 February 2007. Retrieved 30 November 2006.

↑