4

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.

System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; restore screen on boot)

But i need to boot edited version anyway. How to disable that kind of integrity check?

2
  • I have been trying to do a similar thing, did you ever get it working? (Im aware that this is not technically a question, but it's the only thing i could find anywhere on the internet about this topic, and I can't comment without a certain amount of reputation)@xakeapp35
    – Reaxt
    Commented May 20, 2020 at 1:48
  • @Reaxt hi and welcome to RE.SE! Maybe you should ask your own question?! I for one have indeed gotten this to work with a legacy BIOS and merely setting the PE checksum. However, that said, things will be different with Secure Boot (UEFI) and potentially with ELAM (which I mentioned in my answer).
    – 0xC0000022L
    Commented May 20, 2020 at 7:06

1 Answer 1

4

You don't disable that kind of integrity check, you simply set the checksum. The one that's relevant in this particular case is the respective field in the IMAGE_OPTIONAL_HEADER, that is IMAGE_OPTIONAL_HEADER::CheckSum.

That said, you will likely run into additional issues once you resolved this one. I am not sure if the kernel itself is subject to Early Launch scans, but I reckon there's a reason why these binaries are also code-signed. So at the very least you may want to disable the integrity checks altogether from an elevated prompt: bcdedit.exe /set nointegritychecks on (make sure to reboot afterwards). Another point to consider is UEFI with enabled Secure Boot. In this case the Windows boot manager will somehow check the images it's asked to load. But since details are missing, it's not clear if this might be the cause of the issue.

Various functions can be used to compute a checksum for a PE file. The probably easiest method is using the Image Help Library function MapFileAndCheckSum() or alternatively (CheckSumMappedFile()). If I remember correctly there are a few more, including one Ldr* function from ntdll.dll which can be used to that end.

6
  • Thanks for your reply, seems this is exactly what i was searching for! My question was incorrect, in some way, it was really not the good way to go. There is only one thing left uncovered here - if you afford - please add few words on simple, easy-to-use Checksum calculation method, that you would recommend to use in such situation.
    – xakepp35
    Commented May 28, 2018 at 15:03
  • Thank you very much, that worked. I used PEChecksum very simple tool. It just scans and updates, if nesesary. Now i am stuck at 0xc0000428 (seems digital signature check related) and pressing F8-7(disable drivers signature checking) and F8-8(disable antimalware) not worked
    – xakepp35
    Commented May 28, 2018 at 15:17
  • @xakepp35: did you use bcdedit the way I described? What exact build of Windows 10 is this? 32-bit or 64-bit?
    – 0xC0000022L
    Commented May 28, 2018 at 15:18
  • win10pro x64. properties tab shows 10.0.14393.0 File version
    – xakepp35
    Commented May 28, 2018 at 15:26
  • 1
    @xakepp35 Fascinating. So a different status. Since you already turned it on, did you prepare your system for test signing and test-signed the changed binary after setting the checksum? Also, have you tried instead to strip the signature from the binary and leave it unsigned (but also leave testsigning off)?
    – 0xC0000022L
    Commented May 28, 2018 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.