efiguard-detected

efiguard-detect dumbest possible way to check if EfiGuard killed your patchguard or not. how it works efiguard leaves a SetVariable backdoor at runtime - we just poke it from usermode asking to read 2 bytes at ntoskrnl base. if we get back MZ - the backdoor is alive, efiguard did its thing, pg is...