EfiGuard – Disable DSE & PatchGuard via UEFI (Install unsigned drivers) - Windows - DecodeHub - Reverse Engineering, Crackmes, Software & Coding

cambaz

Founder

876 posts
10 Solutions
1.4k Reputation

About Me:
Born in 1994, he was just a child when he got his first computer in 2001. Like many children, he spent years playing games until 2007. In 2005, while still a child, he became curious about how games worked and began his research. He first tried to write cheats for games, but that wasn't what he wanted. What he wanted was to analyze how the system worked backwards and have free access to everything, and thus his reverse engineering adventure began. Although he tried to help everyone for free under different identities for years, he realized as he grew older that the industry completely exploited his good intentions, and he created this forum to offer paid services.
Social Info:
DISCORD
YOUTUBE

January 3Jan 3

Founder

This allows you to install unsigned drivers without test mode or a mapper, for example, the Titanhide service.

Overview

EfiGuard is a UEFI boot-time patching tool developed by Mattiwatti.
It disables Driver Signature Enforcement (DSE) and PatchGuard (Kernel Patch Protection) before Windows fully boots.

Because EfiGuard runs at EFI level, it bypasses Windows kernel protections in a way that user-mode or kernel-mode methods cannot.

This guide focuses on the USB boot method, which is the easiest and safest way to use EfiGuard.

Why USB Method (Recommended)

No permanent changes to system EFI
No risk of breaking Windows boot
Easy to enable and disable
Just unplug USB to remove
Perfect for testing and research

If something goes wrong, simply remove the USB and reboot.

How It Works (Simple Explanation)

System boots from USB in UEFI mode
EfiGuard EFI loader runs
DSE and PatchGuard are patched in memory
Windows Boot Manager is chainloaded
Windows starts normally with protections disabled

No Windows-side drivers
No runtime patching

Requirements

UEFI-based system (Legacy BIOS not supported)
Secure Boot must be disabled
USB flash drive formatted as FAT32
Administrator privileges
Basic UEFI knowledge recommended

Required Files

From the official repository:

Loader.efi
EfiGuardDxe.efi

Easy USB Installation (Step by Step)

Step 1: Format USB

Format the USB drive as FAT32.
Quick format is sufficient.
FAT32 is required for UEFI boot.

Step 2: Create Folder Structure

Create the following folders on the USB drive:

EFI
EFI\Boot

Step 3: Set Default UEFI Loader

Copy Loader.efi
Rename it to BOOTX64.EFI
Place it in the following path:

EFI\Boot\BOOTX64.EFI

This makes the USB automatically bootable in UEFI mode.

Step 4: Add EfiGuard Driver

Copy EfiGuardDxe.efi
Place it in the same folder:

EFI\Boot\EfiGuardDxe.efi

Final USB structure:

USB:
EFI
Boot
BOOTX64.EFI
EfiGuardDxe.efi

Booting with EfiGuard

Reboot the system
Open the boot menu (F8, F11, F12 or ESC depending on motherboard)
Select UEFI USB

EfiGuard will run automatically and then start Windows.

How to Check If It Works

After Windows boots, try loading an unsigned kernel driver.
If it loads successfully, DSE is disabled and EfiGuard is working.

Remove or Disable EfiGuard

Power off the system
Remove the USB drive
Boot normally

No cleanup required
No system changes

Warnings

This is a low-level system security tool.
Incorrect usage may cause boot issues.
Use on test systems if possible.
For research and educational purposes only.

This is the hidden content, please

PROFESSIONAL

Quote