Smart App Control Bypass
Smart App Control, or SAC, is a Windows 11 feature that blocks unknown or untrusted programs. Under the hood, it still depends on the Windows signature plumbing. TrustMeBro swaps the SAC-specific handler, so the SAC settings page still shows "On" while the block decision disappears.
- SAC uses SIP GUID
{18B3C141-AE0D-40F9-9465-E542AFC1ABC7}. - The built-in registration lives in
wintrust.dll. - The verification path reaches
SrpCheckSmartlockerEAandProcessToken. - Hijacking that SIP's
VerifyIndirectDatahandler tontdll!DbgUiContinuemakes SAC report success for all files.
TrustMeBro keeps this out of the default hijack set. You must opt in with --sac.
Notes:
- Windows 11 only
- not present on Windows 10 or Windows Server
- discovered by Ghidra RE of
wintrust.dll - builtin GUID table offset:
.rdata 0x62410 - MITRE:
T1553.003andT1562.001
SAC stores its trust state in NTFS Extended Attributes.
| EA name | Purpose |
|---|---|
$Kernel.Smartlocker.OriginClaim |
file origin |
$Kernel.Purge.Smartlocker.Valid |
cached validation result |
$Kernel.Smartlocker.Hash |
file hash |
If the SIP hijack forces the first validation to return success, SAC writes that success into the EA cache for later checks.
The SAC SIP GUID {18B3C141-AE0D-40F9-9465-E542AFC1ABC7} has no IsMyFileType2 registration. wintrust.dll dispatches it from the builtin GUID table instead of the registry enumeration path. A sip-exec install against that GUID has no effect.
The probe command reads Code Integrity flags through NtQuerySystemInformation. SAC presence shows up as bit 0x2000. This lets the operator see SAC state before running the bypass.