1

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.

My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and attach to the program.

However, when I enable the test-signing mode and launch the game, its anti-cheat service detects test-signing is enabled and terminates the game.

I also tried to disable the driver signature enforcement by restarting the computer and pressing F8, although the result is the same.

I thought about a possible solution: set the g_CiEnabled variable to TRUE after the game's run (however, as I can't run my driver, I'd need to find a vulnerability in a signed driver and set it from there, although I think it's not worth doing all that stuff.).

Is there an easier way to run the test-signed driver on 64 bit system without test-signing mode?

Improve this question
5
  • What about, using your driver, disabling the test-signing in-game check, so that the game will not terminate when test-signing is on? – NirIzr Aug 27 '18 at 19:26
  • @nirlzr AFAIK, to enable/disable test-signing, one needs to restart computer – anx199 Aug 27 '18 at 19:34
  • 1
    You are correct but I'm not suggesting you enable/disable test-signing. I suggest you patch the piece of code that tests whether test-signing is enabled in the game executable. – NirIzr Aug 27 '18 at 19:36
  • @NirIzr Oh, you're right! I don't know why I didn't think about it earlier, maybe I thought it can be bypassed easier. Thanks! – anx199 Aug 27 '18 at 19:39
  • Great, let me turn that to an answer then... – NirIzr Aug 27 '18 at 20:05
1

Sometimes the answer can really be more simple then you'd think.

One approach you could take is that instead of getting your driver to load without test-signing (which seems to be your initial direction of approach), you could prevent the debugged executable from detecting test-signing it on.

This is a link with a few suggestions on how one may detect if test-signing is enabled or not, you can search for similar looking code (e.g. calls to NtQuerySystemInformation with the right parameters).

An alternative solution if your main goal is researching the executable at hand, you could consider using windows versions prior to Vista, where loading your own drivers is far easier.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.