1

From this blog article:

Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers).

Windows 8 instituted the Signing Level, also sometimes referred to as the Signature Level. This undocumented number was a way for the system to differentiate the different types of Windows binaries, something that became a requirement for Windows RT as part of its requirement to prohibit the execution of Windows “desktop” applications.

How this signature level are determined on what basis ? Is that flag passed to CreateProcess or kernel handles this ?

Improve this question

1 Answer 1

Reset to default
2

See http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf:

Signing Levels

So the signing level is embedded in the signed image's (file's) certificate. There are no special flags passed to CreateProcess(), but PspCreateProcess() (a kernel function that's executed as a result of CreateProcess()) extracts and validates the signing level from the executed image's certificate.

Improve this answer
1
  • nosuchcon.org/talks/2014/… Page 22 :: In Vista, CREATE_PROTECTED_PROCESS was the only flag needed for CreateProcess to do the right thing • But in Windows 8.1, how to specify the actual protection level required (type and signer?) • Using the new Protection Level Attribute (0x2000B) in the Process/Thread Attribute List .What about that flag signifies then ?
    – Balu
    Sep 2, 2015 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.