Day: May 1, 2022

How to Use EfiGuard to Disable PatchGuard

Here is a cool video demonstrating how to use EfiGuard: This post will condense the information into a non-video format, and is explicitly for vmware VMs. Download the release version of EfiGuard here: Open an administrator powershell and run the following: The mountvol command with the /S flag

Read More »

Debugging a Windows Service

There’s a nice guide on how to debug a service here:, but in my experience trying to configure the registry with gflags has never actually worked. I also find using regedit to be clumsy and tedious. So here, I am sharing some 1 liners for setting up service debugging.

Read More »

Defeating Anti-Debugging with TitanHide

Recently I was looking for bugs in a Windows program which employs a variety of anti-debugging techniques including: Executing the INT 2d instruction ( Hiding threads from the debugger with NtSetInformationThread ( Calling IsDebuggerPresent ( These measures and more can be defeated with an off the shelf driver called TitanHide

Read More »