Disables the WPBT table in your firmware. This program use a non-permenant, non-destructive method to remove the table from system memory, so it should be executed every time the computer is rebooted before Windows bootloader starts.
- UEFI-enabled firmware
- Disabled Secure Boot (or sign it yourself)
Put dropWPBT.efi to a location where it will be executed every time before Windows starts.
- rEFInd:
ESP:\EFI\refind\drivers_x64 - OpenCore:
ESP:\EFI\OC\Drivers - Clover:
ESP:\EFI\CLOVER\drivers\UEFI
You can also load it using UEFI shell's startup.nsh, or even manually.
This method is for advanced users. You need to be familiar with how UEFI works. The commands below is just for reference, do not blindly copy and paste!
dropWPBT-loader.efi can act as a bootloader itself. To install, launch a cmd.exe with Administrator privilege and type something like this:
mountvol T: /S
mkdir T:\EFI\boot
cp dropWPBT-loader.efi T:\EFI\boot\bootx64.efi
bcdedit /set {bootmgr} path \EFI\boot\bootx64.efi
mountvol T: /D
WPBT is an ACPI table in your firmware allowing your computer vendor to run a program every time Windows (8 or later) boots. This is a convenient method for computer vendors to force the installation of a service program or an anti-theft software, but this also means your fresh installed Windows will have potentially unwanted 3rd party programs running straight on the first boot, and the end user would have basically no control over it. Also, firmware is not updated as frequently as your OS or everyday software, which means if there is a security vulnerability in the WPBT-loaded program, a fair number of users might never get the update.
A lot PC vendors (Lenovo, ASUS, etc.) are known to utilize WPBT table to run their own programs on the consumer's computer.
You can use one of the following software:
- NirSoft's FirmwareTablesView
- RWEverything
Note that they might not work if you enabled HVCI.
Search for C:\Windows\system32\wpbbin.exe.
The program inside the WPBT table runs, which typically means your Windows installation is tainted.
Some motherboards' firmware provide options to disable WPBT.
The only permenant method known to me is to modify your motherboard's UEFI firmware. The method is different for every motherboard; you need to have a dump of the UEFI firmware and need to bypass some limitations. I won't stop you from doing that, but keep in mind that you might destory your computer on the way and you will be the only one responsible for it.