Putting Driver Signature Enforcement Tampering to Rest?!

The talk opens with background on driver signing enforcement, the Windows kernel feature that requires drivers to be signed before they load. It explains how the check is wired into the kernel through the ci.dll library and a callback structure, and how Microsoft's protections have grown over the years. Signing policies, a requirement for Microsoft to co-sign drivers, vulnerable-driver blocklists and the newer kernel data protection feature were each presented as steps that raise the cost of an attack.

The middle of the talk covers the common tampering approach, where an attacker locates an internal flag, overwrites it, loads a driver, and then restores the flag. The speaker then presented two new techniques. Page swapping redirects the virtual mapping for the flag's page to a writable copy by changing the physical frame number in the page table entries. Callback swapping instead redirects one of the validation callbacks to a function that already returns zero. Live demos on a recent Windows 11 build showed the older method triggering a blue screen under protection, while the new approaches let an unsigned test driver load.

The closing section proposed defenses. A defender could record the valid state at boot, watch for driver loading through registry or file system callbacks, and then restore or block any changes. The talk argued that virtualization-based protections such as HVCI are the most robust answer, though they remain uncommon in the field.