Signing a Windows Kernel driver without using Microsoft

[Elisa3167]

Another thing you could do... Fake the timestamp-server response.

The /tr http://timestamp.example.com/ and use DNS redirect to your private time-stamp server.

https://github.com/Jemmy1228/TimeStampResponder-CSharp

[Kerlingen]

Originally Posted by chants

There is always hacking the private key of a trusted signing authority.

No, there is not. The only trusted authority which has ever existed is Microsoft itself and all intermediate cross-certificates signed by Microsoft have expired at least two years ago.

Originally Posted by chants

Also you could crack Windows to not check, although if on EFI, might have to hack that private key as well. Or fallback to MBR.

If you don't want Windows to check driver signatures on your own computer, then you can just turn it off. Windows provides several official ways to load drivers without proper signatures, but they are all limited to your computer and will not work when trying to distribute the driver to regular Windows systems without modifications. Microsoft is not like Apple, so Windows still allows you to switch off security features.

Originally Posted by Elisa3167

Another thing you could do... Fake the timestamp-server response.

And why would Windows trust your fake timeserver's signature? Also, as explained above, the timestamp doesn't really matter for kernel driver signatures.

[chants]

Originally Posted by Kerlingen

No, there is not. The only trusted authority which has ever existed is Microsoft itself and all intermediate cross-certificates signed by Microsoft have expired at least two years ago.

But your earlier post said if you are signed by an old cross certificate it loads, so hacking the private key to these expired certificates should allow arbitrary driver loading.

I agree cracking the OS isn't necessary but seems a lot of research is known in that area with enough details to easily do it. But more than just driver signing policy changes is needed to justify the troublem