Turla was also able to bypass PatchGuard by disabling its ability to show the blue screen of death when the system integrity check fails. After PatchGuard detects the unauthorized patching of the system kernel or its important tables (that is, SSDT, IDT, or GDT), it calls the KeBugCheckEx API to show the blue screen of death. Turla malware hooks this API and continues the execution normally.
A later version of PatchGuard was cloning this API on-the-fly to ensure that the verification will be enforced and cause the system to shut down. However, Turla was able to hook an early subroutine in the KeBugCheckEx API to make sure it was able to resume the execution of the system normally after the integrity check failed. The following code is a snippet of the KeBugCheckEx API:
mov qword ptr [rsp+8],rcx
mov qword ptr [rsp+10h],rdx
mov qword ptr [rsp+18h],r8
mov qword ptr [rsp+20h],r9
pushfq
sub rsp,30h
cli
mov rcx,qword ptr gs:[20h]
add rcx,120h
call nt!RtlCaptureContext...
