Blessed GhostHook, Who Slipped Past the Kernel Guard

Patron of PatchGuard, processor tracing, and guards who never look the right way.

Life

In June 2017 CyberArk described GhostHook, a technique to bypass PatchGuard, the mechanism 64-bit Windows uses to defend its own kernel. Using Intel Processor Trace, meant for performance debugging, it could hijack kernel execution without touching the structures the guard watches. Not a way in, but a way to stay invisible once inside: a ghost with a hook.

Prayer

O Blessed GhostHook, who passes where the guard is not looking, keep an eye on the features built for good as well. Amen.

How to celebrate

Celebrated by keeping Windows updated and remembering that diagnostic tools can become hooks too.

The guard who watches one door misses the open window.