Disabler for Driver Signature Enforcement
- Patching g_CiOptions using ring0 driver
- Patching using UEFI (Not planned)
- Not IOCTL communication
Driver supports Manual mapping, so you can use for example kdmapper for mapping driver or just create it using new service (but you need to sign it):
sc create dse type=kernel binPath=<path/to/KernelMode.sys>
sc start dse
After that start UserMode.exe with disable or enable arguments.
Now CI.dll is protected by PatchGuard, to bypass it you have many ways:
- Load NoBsodDriver (Very meme way)
- Disable PatchGuard for example using EfiGuard
- After your manipulations, turn DSE back off
- vergiliusproject for Windows opaque structures
- 4FB7 FindCiOptions for DONT_RESOLVE_DLL_REFERENCES flag to load CI.dll using LoadLibraryEx