Self signed certificate kernel drivers in Windows 10

[LuciferSam86]

So, quoting what I said there : #1388 (comment)

I tested this project with the sample driver in the repo: https://github.com/HypsyNZ/DSEDodge-Signed-Kernel-Driver

After I installed the suggested WDK (and uninstalled the other version I had) and updated my Visual Studio 2019 I was able to install a kernel driver without problems with a self signed certificated loaded in the UEFI.

In the week-end I'll try to build sandboxie.

[isaak654]

What do you think about providing a tutorial for #2310 ?
Perhaps it is worth collaborating with @DavidBerdik who managed to achieve it.

[LuciferSam86]

I'm a C# developer, not a C++ or C one . But I guess I could check : I mean I was able to made some modifications on GZDoom and the scripting system behind it.

DSEDodge is for self signing the kernel drivers without the need of a expensive EV certificate.

PS: Do you have a guide for debugging sandboxie and the driver behind? With some debug it could help me to understand how it works.

[DavidXanatos]

Debugging sandboxie (except the driver) using VS2019 is quite easy, like in C# you set break points and observe locals, stack and the program flow.
Debugging the driver is not possible on machine you eider need 2 PC's or a VM inside a PC, then you can use WinDBG to debug the windows kernel and the sbiedriver running within it.

About renaming sbiedll go to my_version.h and edit

#define SBIEDLL                 L"SbieDll"

that should do the trick, sandboxie is made to be easy to rebrand and changing binary names is a part of that.

[DavidBerdik]

As @DavidXanatos said, the bulk of the work I did was renaming DLLs and binaries in my_version.h, although I believe I had to also change the names in a few other places such as Installer/copy_build.cmd. The version of Sandboxie that I forked from is pretty old at this point, so you're probably better off just using trial and error to figure out where else the changes need made. One trick that I've found to be particularly helpful with evading detection is to rename the various DLLs and EXEs to use names that are identical to names of DLLs and EXEs that ship with Windows. Things like svchost.exe, netstat.exe, kernel32.dll, etc. In my experience, this is going to freak out your antivirus software since this trick is commonly used by malware developers. Obviously, there's nothing to worry about in this case, but just be aware of it.

Also, when I built my modified version, I had trouble with the internal signature verification that @DavidXanatos added here causing my build to not run properly. If you encounter this issue, you can either try to fix this properly or be lazy like I was and just replace the contents of this function with a single return TRUE; line.