Skip to content

ArmBreaker

snowie2000 edited this page Jun 4, 2021 · 5 revisions

Purpose

This option allows MacType to intercept process creation and downgrade some of the mitigation policy options in Windows 10 so that they can work with MacType again.

Possible values

  • 0, default, does nothing.
  • 1, remove force ms sign requirement.
  • 2, downgrade dynamic code generation restrictions. Chrome, ProcessHacker, and some other apps need this to work.

Suggestions

Please enable this option per executable so it does not affect system security too severely. (As of RC1, per executable armbreaker hasn't been implemented)

Softwares can also use registry to apply mitigation policy to them before they are launched, which can't be intercepted and has to be removed manually from registry (or from group policy editor)

The registry path for mitigation policy is SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions\ProcessMitigationOptions under HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER

As of RC1, this option doesn't work in mactype.ini globally, you need to add it to your in-use profile.

Clone this wiki locally