4

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.

System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; restore screen on boot)

But i need to boot edited version anyway. How to disable that kind of integrity check?

  • I have been trying to do a similar thing, did you ever get it working? (Im aware that this is not technically a question, but it's the only thing i could find anywhere on the internet about this topic, and I can't comment without a certain amount of reputation)@xakeapp35 – Reaxt May 20 at 1:48
  • @Reaxt hi and welcome to RE.SE! Maybe you should ask your own question?! I for one have indeed gotten this to work with a legacy BIOS and merely setting the PE checksum. However, that said, things will be different with Secure Boot (UEFI) and potentially with ELAM (which I mentioned in my answer). – 0xC0000022L May 20 at 7:06
4

You don't disable that kind of integrity check, you simply set the checksum. The one that's relevant in this particular case is the respective field in the IMAGE_OPTIONAL_HEADER, that is IMAGE_OPTIONAL_HEADER::CheckSum.

That said, you will likely run into additional issues once you resolved this one. I am not sure if the kernel itself is subject to Early Launch scans, but I reckon there's a reason why these binaries are also code-signed. So at the very least you may want to disable the integrity checks altogether from an elevated prompt: bcdedit.exe /set nointegritychecks on (make sure to reboot afterwards). Another point to consider is UEFI with enabled Secure Boot. In this case the Windows boot manager will somehow check the images it's asked to load. But since details are missing, it's not clear if this might be the cause of the issue.

Various functions can be used to compute a checksum for a PE file. The probably easiest method is using the Image Help Library function MapFileAndCheckSum() or alternatively (CheckSumMappedFile()). If I remember correctly there are a few more, including one Ldr* function from ntdll.dll which can be used to that end.

| improve this answer | |
  • Thanks for your reply, seems this is exactly what i was searching for! My question was incorrect, in some way, it was really not the good way to go. There is only one thing left uncovered here - if you afford - please add few words on simple, easy-to-use Checksum calculation method, that you would recommend to use in such situation. – xakepp35 May 28 '18 at 15:03
  • Thank you very much, that worked. I used PEChecksum very simple tool. It just scans and updates, if nesesary. Now i am stuck at 0xc0000428 (seems digital signature check related) and pressing F8-7(disable drivers signature checking) and F8-8(disable antimalware) not worked – xakepp35 May 28 '18 at 15:17
  • @xakepp35: did you use bcdedit the way I described? What exact build of Windows 10 is this? 32-bit or 64-bit? – 0xC0000022L May 28 '18 at 15:18
  • win10pro x64. properties tab shows 10.0.14393.0 File version – xakepp35 May 28 '18 at 15:26
  • Yes. I reinstalled clean system. I used bcdedit with bootmenupolicy Legacy, bootstatuspolicy IgnoreAllFailures, disableelamdrivers yes, nointegritychecks on, testsigning on. Then i've patched ntoskrnl.exe (connecting ssd to another PC, and changing permissions to Everyone: Full access), and fixed checksum in header. When booting in F8 i tried to select "disable ELAM" and "disable signing". And still getting 0xc0000428 digital signature check error on ntoskrnl.exe file... – xakepp35 May 28 '18 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.