无硬编码动态关闭驱动签名强制(DSE) 支持Win7~Win10
ci.dll中g_CiOptions全局变量的值决定系统在加载驱动的时候是否会检测数字签名通过IDA发现在CipInitialize函数中可以定位到g_CiOptions这个全局变量
//win7 windbg
CI!CipInitialize:
fffff880`00ce5308 488bc4 mov rax,rsp
fffff880`00ce530b 48895808 mov qword ptr ,rbx
fffff880`00ce530f 48896810 mov qword ptr ,rbp
fffff880`00ce5313 48897020 mov qword ptr ,rsi
fffff880`00ce5317 4c894018 mov qword ptr ,r8
fffff880`00ce531b 57 push rdi
fffff880`00ce531c 4154 push r12
fffff880`00ce531e 4155 push r13
fffff880`00ce5320 4156 push r14
fffff880`00ce5322 4157 push r15
fffff880`00ce5324 4883ec20 sub rsp,20h
fffff880`00ce5328 498be8 mov rbp,r8
fffff880`00ce532b 488bf2 mov rsi,rdx
fffff880`00ce532e 890dbcaaffff mov dword ptr ,ecx
fffff880`00ce5334 ff15165dffff call qword ptr
//win7 IDA
地址 Function 指令
INIT:000000000006E406 db 'PsGetCurrentProcess',0
INIT:000000000006E49C db 'PsGetCurrentProcessId',0
PAGE:000000000000D334 CipInitialize call cs:__imp_PsGetCurrentProcess
PAGE:000000000000E96C CipCallPeauth call cs:__imp_PsGetCurrentProcess
PAGE:000000000000F08A CipFixImageType call cs:__imp_PsGetCurrentProcess
PAGE:00000000000198A6 PEReturnState call cs:__imp_PsGetCurrentProcessId
PAGE:000000000001B507 I_PEUpdateHashCache call cs:__imp_PsGetCurrentProcessId
.idata:0000000000003050 extrn __imp_PsGetCurrentProcess:qword
.idata:0000000000003090 extrn __imp_PsGetCurrentProcessId:qword
//win10 windbg
CI!CipInitialize:
fffff804`6dab68f4 48895c2408 mov qword ptr ,rbx
fffff804`6dab68f9 48896c2410 mov qword ptr ,rbp
fffff804`6dab68fe 4889742418 mov qword ptr ,rsi
fffff804`6dab6903 57 push rdi
fffff804`6dab6904 4154 push r12
fffff804`6dab6906 4156 push r14
fffff804`6dab6908 4883ec40 sub rsp,40h
fffff804`6dab690c 498be9 mov rbp,r9
fffff804`6dab690f 890dfb63ffff mov dword ptr ,ecx
fffff804`6dab6915 498bf8 mov rdi,r8
fffff804`6dab6918 488bf2 mov rsi,rdx
fffff804`6dab691b 448bf1 mov r14d,ecx
fffff804`6dab691e ff15bcc7ffff call qword ptr
//win10 IDA
地址 Function 指令
PAGE:000000000002691E CipInitialize call cs:__imp_PsGetCurrentProcess
PAGE:0000000000034EC8 CipValidateDataMappedFileWithContext call cs:__imp_PsGetCurrentProcess
PAGE:000000000003EA60 CiSetUnlockInformation call cs:__imp_PsGetCurrentProcess
PAGE:000000000004E494 PEReturnState call cs:__imp_PsGetCurrentProcessId
PAGE:000000000005069A I_PEUpdateHashCache call cs:__imp_PsGetCurrentProcessId
.idata:00000000000230C0 __imp_PsGetCurrentProcessId dq ? ; DATA XREF: PEReturnState+64↓r
.idata:00000000000230E0 ; __int64 (*PsGetCurrentProcess)(void)
通过汇编代码可以发现g_CiOptions的后面100%会调用PsGetCurrentProcess函数
于是通过IDA搜索PsGetCurrentProcess，发现最先调用PsGetCurrentProcess的函数就是CipInitialize
于是写了以下代码来定位g_CiOptions的地址，然后修改g_CiOptions地址的值实现关闭DSE，可以同时在Win7~Win10使用
核心代码：
**** Hidden Message ***** 6666666666666666666666
页:
[1]