Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow unsigned/unverified/unprotected processes to use the read only funtinality of the new driver #1536

Closed
DavidXanatos opened this issue Dec 13, 2022 · 1 comment

Comments

@DavidXanatos
Copy link
Contributor

Description of the feature, modification, idea or suggestion

It would be great when the new driver would allow self compiled SystemInformer binaries and 3rd party applications to use a limited sub set of its functionality. Basically everything that is not justifiably objectionable.
The driver can retrieve a lot of unproblematic yet helpful information, as it is currently implemented however it seams only signed SystemInformer binaries can use it.

Proposed implementation details (optional)

No response

@dmex
Copy link
Member

dmex commented Jan 16, 2023

allow self compiled SystemInformer binaries

This is only permitted when the system was booted with kernel debug enabled, secure boot disabled and a kernel debugger is both enabled and connected.

allow 3rd party applications to use a limited sub set of its functionality

This subverts the Windows security model since developers would be able to use our driver and code signing to query kernel functionality that otherwise currently requires their own code signing and their own kernel driver.

@dmex dmex closed this as completed Jan 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants