4 ms·

> Since cheat authors will not be able to get their drivers signed by Microsoft Why not? Presumably Microsoft will decline if you say outright "this is for che

> Since cheat authors will not be able to get their drivers signed by Microsoft Why not? Presumably Microsoft will decline if you say outright "this is for cheating", but if you make a kernal driver that happens to have a feature for executing commands from user space for a benign reason, i don't think they would decline to sign it. There are a few million windows drivers, there are plenty of situations where a weirdly specific driver has a valid use case.

dist-epoch 1y ago
If you succeed, some anti-cheat company will eventually detect it and Microsoft will ban the driver. And not sign further ones.
- OneDeuxTriSeiGo 1y ago
  And of course Windows 10 on include a retroactive driver blacklist and it's nontrivial to disable it.
- metalcrow 1y ago
  Eventually, maybe. But how fast will they get banned compared to how fast you can get drivers signed? Iirc it's not even that expensive to sign up to get your driver signed, around a few hundred dollars.
  - privatelypublic 1y ago
    Microsoft has to countersign them.
OneDeuxTriSeiGo 1y ago
Windows is beginning to enforce quite strong kernel mode address space isolation and security. They've also started cracking down on drivers to the point of effectively banning all printer drivers (unless you disable a bunch of security settings with big warnings on them), instead pushing those printer companies to shift entirely to Microsoft's native IPP everywhere driver.
- metalcrow 1y ago
  Fair, but what about software drivers? It's easy to make up some fake explanation for those to exist, since they don't need hardware backing.
  - OneDeuxTriSeiGo 1y ago
    You may still be able to get them approved but with the new address space protections, you have to justify broad memory access to get a sign off on your driver. So you can't just say you want access to all user space memory, etc like you used to be able to.
Tuna-Fish 1y ago
> if you make a kernal driver that happens to have a feature for executing commands from user space That's basically the one thing that's outright banned, no discussion possible. As far as Microsoft is concerned, there are no benign reasons to do that, and any software attempting to do it is treated as malware.
- metalcrow 1y ago
  Wait that can't be correct. What about software drivers? What if you wanna control the behavior of hardware remotely? Or are you referring to something more specific then that stuff?
  - Tuna-Fish 1y ago
    You need to limit the functionality available to userspace so that it can not be used to break kernel security. Any drivers that need functionality that could also be used to attack the kernel are now simply banned. This is the main reason for why modern windows versions had some hardware support issues.

dist-epoch 1y ago

If you succeed, some anti-cheat company will eventually detect it and Microsoft will ban the driver. And not sign further ones.

OneDeuxTriSeiGo 1y ago
And of course Windows 10 on include a retroactive driver blacklist and it's nontrivial to disable it.
metalcrow 1y ago
Eventually, maybe. But how fast will they get banned compared to how fast you can get drivers signed? Iirc it's not even that expensive to sign up to get your driver signed, around a few hundred dollars.
- privatelypublic 1y ago
  Microsoft has to countersign them.

OneDeuxTriSeiGo 1y ago

Windows is beginning to enforce quite strong kernel mode address space isolation and security. They've also started cracking down on drivers to the point of effectively banning all printer drivers (unless you disable a bunch of security settings with big warnings on them), instead pushing those printer companies to shift entirely to Microsoft's native IPP everywhere driver.

metalcrow 1y ago
Fair, but what about software drivers? It's easy to make up some fake explanation for those to exist, since they don't need hardware backing.
- OneDeuxTriSeiGo 1y ago
  You may still be able to get them approved but with the new address space protections, you have to justify broad memory access to get a sign off on your driver. So you can't just say you want access to all user space memory, etc like you used to be able to.

Tuna-Fish 1y ago

> if you make a kernal driver that happens to have a feature for executing commands from user space That's basically the one thing that's outright banned, no discussion possible. As far as Microsoft is concerned, there are no benign reasons to do that, and any software attempting to do it is treated as malware.

metalcrow 1y ago
Wait that can't be correct. What about software drivers? What if you wanna control the behavior of hardware remotely? Or are you referring to something more specific then that stuff?
- Tuna-Fish 1y ago
  You need to limit the functionality available to userspace so that it can not be used to break kernel security. Any drivers that need functionality that could also be used to attack the kernel are now simply banned. This is the main reason for why modern windows versions had some hardware support issues.