Categories:
EverythingFlattr me:
Wed, 07 Dec 2005
If you install a Driver on Windows XP which is not blessed
by Microsoft, you get a nasty Dialog box with a warning. - Microsoft tries to tell people this is for stability reasons - See this blog entry at The Old New Thing
for someone arguing for it, and read the comments for reasons why this idea only sounds good in writing.
About a year ago this had also come up on the OpenVPN mailinglist (see here). Someone in that thread pointed out, that Microsoft says you can't change it in your program which tiggered my hacker gene to see how this could be done anyways.
Liberal usage of regmon revealed that the value is indeed stored in the Policy key of HKLM\Software\Microsoft\Driver Signing
, but there was also a write to the PrivateHash key of HKLM\Software\Microsoft\Windows\CurrentVersion\Setup
.
With the help of apispy it was easily found out that the PrivateHash is an MD5 hash of the 4-byte-extended value of the Policy Key and some seed. The Seed is the 4-byte value of the seed
key from HKLM\System\WPA\PnP
).
This was quickly written down in a small proof of concept program. - And please, don't even think about ugly things like automating a mouse click to acknowledge such a dialog box again. :)
– Sec
posted at: 17:53 | Category: /rev-eng | permanent link to this entry | 3 comments (trackback)
-
Majstorovo ćoše » Blog Archive » Unattended (silent) OpenVPN install
Pingback wrote on Wed, 05 Mar 2008 14:52Pingback from http://www.dualsoft.net/majstorije/?p=6 -
Thanks for this code. I was actually interested in being able to change the Policy value for HKLM\Software\Microsoft\Non-Driver Signing which is also protected by the PrivateHash. It turns out that the non-driver value is simply the 0th byte of your "input" array. Thanks for the key to solving my problem. Best regards, Bill L.
About:
Other Blogs:
- OLLIWOOD (Aug 11)
- sisyphus.de - supplying the web with meaningless information since 1997 (Aug 11)
- XlF's BlogWorld (Jun 11)
- J.-Henrik Wist (Jun 11)
- NickBlog (Nov 10)
Sec wrote on Tue, 27 Nov 2007 10:17
Checking my referrer logs I found a longish discussion about this program on another forum. While most of the posts pertain to their attempts to convert this to some scripting language, there is one posting here which mentions that I might have gotten the last parameter of the CryptAcquireContext() function wrong. They say it should be CRYPT_VERIFYCONTEXT instead of simply "0".
Take care.