DSE bypass using a leaked cert and adjusting the current clock.
| Commit | Message | Author | Date |
|---|---|---|---|
| 8dee3b8364 | Readme update. | Toni Uhlig | 3 years ago |
| e8747bda65 | Removed ./bin | Toni Uhlig | 3 years ago |
| 904b7a1687 | Force CI to not stop on Warnings e.g. symbol deprecation. | Toni Uhlig | 3 years ago |
| 8d3ba23101 | Added batch files and README to the source tree. | segfault | 3 years ago |
| 85e43640bf | Enforce SHA256 file digest for signtool. | segfault | 3 years ago |
| Name | Target | Subject | Date |
|---|---|---|---|
| main | 8dee3b8364 | Readme update. | 3 years ago |
| VS-2017 | 03be2877ee | Updated sigs | 5 years ago |
| Name | Target | Subject | Date |
|---|---|---|---|
| v1.0 | 8dee3b8364 | Readme update. | 3 years ago |
| VS-2017-backport | cd76323e68 | update README | 6 years ago |
What?
PastDSE is a Driver Sign Enforcement "bypass" using a leaked EV code signing certificate. It is actually not a real bypass since it does only change the date to 01-01-2014 before signing the driver and restores it afterwards. The Kernel driver loader will accept all driver images as long as the code was signed by a extended validation code signing certificate which was not revoked.
The DSE "bypass" works only on Windows 10 x64: 1803, 1809, 1903. You won't be able to load PastDSE signed drivers on other Windows versions. But it is still possible to use PastDSE with other DSE disabling techniques e.g. enabling testsigning or using EfiGuard. It works, because PastDSE is basically a manual driver mapper, nothing more.
Build Dependencies
- Visual Studio 2019 Community Edition (Visual Studio 2017 is still supported, see VS-2017 branch)
- Windows 10 x64 1803, 1809 and 1903 (may work on older versions, not verified)
- Windows 10 SDK 10.0.17763.0
- Windows Driver Kit
- Windows Universal CRT SDK
- C++/CLI support
- VC++ 2017 tools
The recommended way to install all dependencies is through vs_community.exe.
HowTo
If you do not want to build it from source, you can skip the text below and download the build artifacts from Github.
Assuming a successful (Debug) build, you have to do the automatic sign procedure by running driver-sign.bat as Administrator.
If the console window outputs something like Number of files successfully Verified: 1 then the procedure was probably succesful.
It should now be possible to load the (Debug) target driver by running driver-start.bat as Administrator.
You can now use PastDSECtrl to manual map your (unsigned) driver.
Insights
Your driver requires an exported
NTSTATUS DriverEntry(_In_ struct _DRIVER_OBJECT *DriverObject, _In_ PUNICODE_STRING RegistryPath)
symbol just as usual.
But: DriverObject will always be a NULL pointer whereas RegistryPath points to the mapped driver base address.
Since this is a manual mapped driver you can not use all kernel functions without getting either into trouble with PatchGuard
or they just won't work (usual returning an Access denied).
Example:
- PatchGuard will complain if you use functions like
PsSetLoadImageNotifyRoutine,PsSetCreateProcessNotifyRoutineandPsSetCreateThreadNotifyRoutine ObRegisterCallbacksreturns Access denied- there may be other functions e.g.
FltRegisterFilter
Contributors
Some slightly modified code from BlackBone for the driver mapping and relocation.