1

Introduction

Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog : .inf, .sys and .dll dependencies.

This is done by checking whether the certificate chain is valid, that means that the root CA has to be under the local Trusted Root CA and also the leaf certificate (not the root CA) has to be under the Trusted Publisher, so the installation doesn't prompt to ask the user if he trusts in the publisher.

However, when the installation finishes the driver fails to load into the kernel. I suppose that winload validates the driver's certificate by looking in its own trusted root CA store, so the only CAs that are supported are in this list :

Question

Is there a way to patch winload to insert a new Root CA so when it loads our driver it validates the certificate correctly?

I know that modifying winload will break its digital signature, so we can resign it using the private key of our new Root CA, that will do the work theoretically.

Improve this question
2

Yes, you would need to patch ci.dll (which contains the list of hardcoded Root CAs) and winload.exe (which validates the integrity of ci.dll).

You can find this discussed in http://www.programdevelop.com/4608016/.

Improve this answer
3
  • 1
    Thanks for your answer. So when a driver is loaded into the kernel in system boot the digital certificate is matched to a root CA stored in ci.dll right? I've seen over there that winload before loading ntoskrnl.exe verifies its digital signature against nt5.cat, do you know any kind of info about this? – kub0x Jun 29 '15 at 15:55
  • "So when a driver is loaded into the kernel in system boot the digital certificate is matched to a root CA stored in ci.dll right?" -- The driver's certificate chain is verified to be rooted in a CA stored in ci.dll. "I've seen over there that winload before loading ntoskrnl.exe verifies its digital signature against nt5.cat, do you know any kind of info about this?" -- What are you looking to know? – Jason Geffner Jun 29 '15 at 16:00
  • 1
    I'm reading this now: homepage.ntlworld.com/jonathan.deboynepollard/FGA/… . Concretely the section " How Windows NT6 is bootstrapped by its loader" you will see that winload is responsible of loading the kernel boot drivers, so my driver is going to be loaded by this process. In this article is said that winload verifies itself against nt5.cat. So what I get from here and from your indications is that I have to patch ci.dll and the signature from winload in the catalog. Thanks again for throwing some light. – kub0x Jun 29 '15 at 16:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.