dumbest possible way to check if EfiGuard killed your patchguard or not.
efiguard leaves a SetVariable backdoor at runtime - we just poke it from usermode asking to read 2 bytes at ntoskrnl base. if we get back MZ - the backdoor is alive, efiguard did its thing, pg is dead.
only works if the user picked the default dse bypass method (DSE_DISABLE_SETVARIABLE_HOOK) — which is the default. if DSE_DISABLE_AT_BOOT was chosen instead, the hook gets removed at ExitBootServices and there's nothing to detect from usermode.
requires admin + SeSystemEnvironmentPrivilege.
cl /EHsc src/main.cpp /link ntdll.lib psapi.lib
src/main.cpp
