Tuesday, January 30, 2007

Update on Driver Signing Bypass

I apologize for the lack of news, but after attending CUSEC, I had to spend my time on catching up the two weeks of school and work that I had missed, and exploiting Vista ended up going on the backburner, especially as I had to re-install VMWare 6.0 (which wasn’t being helpful with me) and a new Vista 64-bit image.

That being said, it turns out the code I’ve written does not work out of the box on a Vista RTM system. Although it can be effective when combined with a reboot, this doesn’t provide any advantage of any of the myriad other ways that this could be done (including booting with the disable integrity checks BCD option or the /TESTSIGN flag).

However, it does bypass DRM. As part of the Protected Media Path, (PMP), Windows Vista sets up a number of requirements for A/V software and drivers in order to ensure it complies with the demandes of the media companies. One of these features, which has been heavily criticized as being the actual reason behind driver signing, is that “some premium content may be unavailable” if test signing mode is used. Originally, I assumed that this meant that the kernel would set some sort of variable, but this didn’t make sense: once your unsigned driver could load, it could disable this check. After reading the PMP documentation however, it seems to me that the “feature” explained is more likely the cause of this warning on premium content.

This feature is the ability of the PMP to notify A/V applications that there are unsigned drivers on the system, as well as provide a list of unsigned drivers. The idea is that the application can either outright refuse to play content, or that it can scan for known anti-DRM drivers which might be attempting to hook onto the unencrypted stream. This leads me to believe that it’s up to applications, not the OS, to enforce this DRM check.

The great thing about the code I’ve written is that it does NOT use test signing mode and it does NOT load an unsigned driver into the system. Therefore, to any A/V application running, the system seems totally safe — when in fact, it’s not. Now, because I’m still booting with a special flag, it’s possible for Microsoft to patch the PMP and have it report that this flag is set, thereby disabling premium content. However, beause I already have kernel-mode code running at this point, I can disable this flag in memory, and PMP will never know that it was enabled. Again, Microsoft could fight this by caching the value, or obfuscating it somewhere inside PMP’s kernel-mode code, but as long as it’s in kernel-mode, and I’ve got code in kernel-mode, I can patch it.

To continue this game, Microsoft could then use Patchguard on the obfuscated value…but that would only mean that I can simply disable Patchguard using the numerous methods that Skywing documented in his latest paper.

In the end, the only way that PMP is going to work is with a Hypervisor, and even that will probably fail.

Unfortunately, with almost 0% use for the open source community (which can use test signing mode for their drivers), documenting my method and/or releasing a sample might be viewed as an anti-DRM tool, and defintely a DMCA violation. Although used on its own, this POC doesn’t do anything or go anywhere near the PMP (I don’t even have Protected Media, HDMI, HD-DVD, nor do I know where PMP lives or how someone can intercept decrypted steams), a particularly nasty group of lawyers could still somehow associate the DMCA to it, so I’m not going to take any chances.

It’s quite ironic — Microsoft claims driver signing is to fight malware and increase system stability, so if I get sued under DMCA, wouldn’t that be an admission that driver signing is a “anti-copyright infringment tool”?.

I’d really love to release this tool to the public though, so I will look into my options — perhaps emphasizing the research aspect of it and crippling the binary would be a safe way.



Blogger wow said...

sheet metal fabrication, specialize in precision sheet metal fabrication

8:24 PM  
Blogger wow said...

Filling Machine- Liquid Filling Machine, Filling Machine in China.

8:24 PM  
Blogger wow said...

The <a href=http://www.chunghwaflooring.com>laminate flooring</a> guide is the A to Z of laminate flooring
,filter cloth, right filter cloth

8:25 PM  
Blogger wow said...

Find Pressure gauge, Pressure gauges are used for a variety of pressure gauge factory.
thermocouple wire,thermocouple wire RTD, thermocouple wire in sell.
some thermocouple thermometer: multifuncion Thermocouple thermometer for export.
power inverter,PC power inverter,machine power inverter.
The proximity switches - we dealing in proximity switches, proximity switches provide

8:25 PM  
Blogger xuemei said...

Now do you worried about that in the game do not had enough rohan crone to play the game, now you can not worried, my friend told me a website, in here you can buy a lot rohan gold and only spend a little money, do not hesitate, it was really, in here we had much rohan online crone, we can sure that you will get the rohan online gold, quick to come here to buy rohan money.

Now do you worried about that in the game do not had enough Rose zuly to play the game, now you can not worried, my friend told me a website, in here you can buy a lot rose zulie and only spend a little money, do not hesitate, it was really, in here we had much rose online zuly, we can sure that you will get the rose online zulie, quick to come here to buy Arua ROSE zuly.

10:21 PM  
Blogger TU said...

新規事業 is wonderful.
エアコン 修理 is wonderful.
バーチャルオフィス is wonderful.
屋形船 is wonderful.
店舗デザイン is wonderful.
整体学校 is wonderful.
お見合いパーティー is wonderful.
債務整理 is wonderful.
演劇 is wonderful.
新宿 整体 is wonderful.
会社設立 is wonderful.
マカ is wonderful.
格安航空券 国内 is wonderful.
ブライダルエステ is wonderful.
オーディション is wonderful.
大宮 不動産 is wonderful.
広島 不動産 is wonderful.
バイク便 is wonderful.
ボイストレーニング is wonderful.
過払い is wonderful.
バラ is wonderful.
足やせ is wonderful.
先物取引 is wonderful.
サイディング is wonderful.
税理士 東京 is wonderful.
ウェルカムボード is wonderful.
カップリングパーティー is wonderful.
ウェディングドレス is wonderful.
相続税対策 is wonderful.
披露宴 is wonderful.
レンタルボックス is wonderful.
同窓会 会場 is wonderful.
薬剤師 募集 is wonderful.
川口市 一戸建て is wonderful.
デイトレード is wonderful.
水道工事 is wonderful.
商標調査 is wonderful.
電話代行 東京 is wonderful.
ハーレー is wonderful.
賃貸事務所 東京 is wonderful.
不眠症 治療 is wonderful.
公会計 is wonderful.
不動産投資 is wonderful.
生い立ちビデオ is wonderful.

5:35 AM  
Blogger bienleba said...

デリヘル 風俗
吉原 ソープランド
すすきの ソープラン

新宿 ソープランド
千葉 ソープランド
埼玉 ソープランド
神奈川 ソープランド

吉原 ソープランド
風俗求人 高収入
都内 キャバクラ 全額日払い
大阪 風俗
大阪 風俗
神戸 風俗
風俗 求人
風俗 求人
デリヘル 新宿
デリヘル 東京
千代田区 デリヘル
台東区 デリヘル
墨田区 デリヘル
中央区 デリヘル

6:58 PM  
Blogger bienleba said...

ダイエット クエン酸
ダイエット サプリ
レストラン ウェディング




ダイエット 方法
ダイエット 運動
競馬 ゲーム

格安 SEO
SEO 成果報酬

6:58 PM  
Blogger bienleba said...

和歌山 デリヘル
神戸 デリヘル
姫路 デリヘル
大阪 デリヘル
京都 デリヘル
大阪 デリヘル
神戸 デリヘル
和歌山 デリヘル
奈良 デリヘル
京都 デリヘル
神戸 デリヘル
姫路 デリヘル
奈良 デリヘル
京都 デリヘル
大阪 デリヘル
大阪 デリヘル

6:58 PM  
Blogger janewangleilei said...

You can have a look at it.
jordan shoes
newest jordans
jordan 7
air yeezy
jordan true flight
If you like,you can contact us.
jordan 3
jordan 4
We offer different styles.
jordan 1
jordan 2
jordan 5
jordan ajf shoes
There are cheap shoes to choose
jordan 6
jordan flight 45
Good quality with low price.
air jordan 2010
Air Jordan 2009
Enjoy it!
jordan 28

12:24 AM  
Blogger kobeli said...

Christian Louboutin Pumps
michael jordan shoes
Mens Polo Shirts
Mlb Jerseys

Manolo blahnik shoes
jordan basketball shoes
Lacoste Polo Shirts
Nba jerseys

Christian Louboutin Shoes Sale
jordan shoes sale
Wholesale Polo Shirts
Authentic Nhl jerseys

Jimmy Choo shoes
air jordan shoes sale
Cheap Polo Shirts
Authentic Mlb Jerseys

Metallic Uggs
Mini Ugg Boots
Alexander McQueen
Mini Ugg Boots
Nightfall Uggs
Chanel Shoes
Nightfall Uggs
Stripe Cable Ugg Boots
Gucci Shoes

1:45 AM  
Blogger dfadf said...

Microsoft Office
Office 2010
Microsoft Office 2010
Office 2010 key
Office 2010 download
Office 2010 Professional
Microsoft outlook
Outlook 2010
Windows 7
Microsoft outlook 2010

12:49 AM  
Blogger Nike shox said...

I really appreciate what you write here, very insightful and smart. One thing though, I’m running Firefox on Fedora and some of your site structure are a little misaligned. I know it’s not a common setup, but it is still something to watch out for. Just shooting you a heads up.Having a look Nike shox. Good things or not you have the final say.

7:22 PM  
Blogger Nike shox shoes said...

To get a thorough understanding of oneself is to get a full control of one's life. Then one will find one's life full of color and flavor.

Nike shox shoes can surely not let you down,romance yourself with nike shox

6:03 PM  

Post a Comment

<< Home