Kernel Patch Protection (PatchGuard) & HyperGuard

How it works

1. 1PatchGuard (`KPP`) periodically checksums and re-validates kernel code pages, the system service table (SSDT), the IDT/GDT, and other core structures that pre-x64 era drivers used to patch routinely for legitimate (and illegitimate) purposes.
2. 2Detection isn't instantaneous or synchronous with the modification — by design, the delay and the heavily obfuscated checking code make it impractical for an attacker to reliably patch around a specific check.
3. 3A detected violation results in a kernel bugcheck, which is deliberately destructive: the design goal is that a tampered 64-bit kernel should crash rather than keep running in an unknown, untrustworthy state.
4. 4**HyperGuard** raises the same idea a level: with Hyper-V/VBS active, the hypervisor itself (operating at a trust level the regular kernel cannot touch, per [Virtualization & the hypervisor](/levels/virtualization/overview)) monitors critical kernel-mode state from outside the kernel entirely — closing the gap where a sufficiently privileged kernel-mode attacker might otherwise disable or race PatchGuard's own in-kernel checks.

Key terms

KPP

Kernel Patch Protection, the formal name for what's commonly called PatchGuard.

CRITICAL_STRUCTURE_CORRUPTION

Bugcheck code 0x109, raised when PatchGuard detects tampering with protected kernel state.

DRIVER_VERIFIER_DETECTED_VIOLATION

A related but distinct bugcheck from Driver Verifier, often confused with PatchGuard triggers.