Introduction
Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog : .inf, .sys and .dll dependencies.
This is done by checking whether the certificate chain is valid, that means that the root CA has to be under the local Trusted Root CA and also the leaf certificate (not the root CA) has to be under the Trusted Publisher, so the installation doesn't prompt to ask the user if he trusts in the publisher.
However, when the installation finishes the driver fails to load into the kernel. I suppose that winload validates the driver's certificate by looking in its own trusted root CA store, so the only CAs that are supported are in this list :
Question
Is there a way to patch winload to insert a new Root CA so when it loads our driver it validates the certificate correctly?
I know that modifying winload will break its digital signature, so we can resign it using the private key of our new Root CA, that will do the work theoretically.