Game's anti-cheat complains when driver test-signing mode is on

Question

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.

My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and attach to the program.

However, when I enable the test-signing mode and launch the game, its anti-cheat service detects test-signing is enabled and terminates the game.

I also tried to disable the driver signature enforcement by restarting the computer and pressing F8, although the result is the same.

I thought about a possible solution: set the g_CiEnabled variable to TRUE after the game's run (however, as I can't run my driver, I'd need to find a vulnerability in a signed driver and set it from there, although I think it's not worth doing all that stuff.).

Is there an easier way to run the test-signed driver on 64 bit system without test-signing mode?

Answer 1

Sometimes the answer can really be more simple then you'd think.

One approach you could take is that instead of getting your driver to load without test-signing (which seems to be your initial direction of approach), you could prevent the debugged executable from detecting test-signing it on.

This is a link with a few suggestions on how one may detect if test-signing is enabled or not, you can search for similar looking code (e.g. calls to NtQuerySystemInformation with the right parameters).

An alternative solution if your main goal is researching the executable at hand, you could consider using windows versions prior to Vista, where loading your own drivers is far easier.