SIP Execution Surface

SIP Execution Surface

Some Windows signature checks start by asking many handlers, one after another, "does this file belong to you?" If one of those handlers points at your DLL, Windows loads your DLL during that question phase. The load happens inside the process that asked for the signature check.

Diagram

Technical detail

• CryptSIPDllIsMyFileType2 runs during SIP file-type resolution.
• Registration path:
  • HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{GUID}
• TrustMeBro sip-exec install points that GUID at your DLL and uses IsMyFileType2 as the export name.

Any process that calls WinVerifyTrust on a matching file type may load the DLL. TrustMeBro notes this surface in:

• Explorer
• SmartScreen
• Defender
• certutil
• signtool
• AV scanners

This makes SIP resolution an execution surface, not only a trust surface.

Provider behavior pattern

PSBits GtSipIsFmt2 always returns FALSE. Windows still loads the registered DLL and runs its export during routing, but the provider does not claim the file type. Normal SIP resolution keeps going. This yields code execution without disrupting verification.

Scope of the effect

IsMyFileType2 runs during file-type routing, before hash or chain evaluation. The DLL runs for side effects such as persistence or a callback. It is not a verification bypass by itself.