It's also possible to disable the PatchGuard protection for debugging reasons, as debuggers may need to set breakpoints in the OS's kernel code. Therefore, it is possible to switch the OS to debug mode using the following command:
bcdedit /debug ON
Then, depending on the type of interaction with the system, it is possible to enable the method of how the debugging will be performed (via the network, locally, and so on).
Such commands require administrative privileges to be granted and the system to be restarted. Additionally, it is worth mentioning that this technique slows down the OS, especially during system startup.
Now, we will take a look at how to analyze rootkits and, in particular, how to perform the dynamic analysis of rootkits.
