suggestion: add "patchguard dance" from wind

[hfiref0x]

suggestion: add "patchguard dance" from wind

[hfiref0x]

The "patchguard dance" in the above project is a trivial IAT hook on services.exe to achieve unknown goals as it makes absolutely no difference if you do the same patch_dse->NtLoadDriver->restore_dse in your app without using any kind of SCM (ffs why it even use it). It maybe will save you few milliseconds compared to running "kdu with dse off, loading your loader, running kdu dse on", but you will never know was it enough or PG already did the check. KDU will not patch (nor even touch) any memory of system processes.