Hacker News Reader

Hacker News

Comment by user5994461 | Hacker News Reader

Parent Full thread

user5994461

It's not possible to install drivers that are not signed, on Windows.

View on HN

But it's still possible to install a custom root cert?

That's madness.

Yes it is.

Being unable to install a custom root cert would break a bunch of shit.

I'm not sure it's correct that custom root certs are allowed for drivers. I asked this in another comment.

I think kernel mode drivers have more stringent signing requirements than user mode drivers. A user-installed CA definitely cannot be used to silently install a kernel mode driver.

Oh. When you say driver do you mean user-mode? I always assume kernel mode (in every OS). But if so that would make sense!

You need to install a user mode drive to leverage already existing kernel code with your device.

I assume this is what ADB does, using the Microsoft provided WinUSB kernel mode driver and associating it with your mobile phone USB vendor and product ID. There's not a single line of code in such a driver, just some INF descriptors.

There might also be different forms of user mode driver, not sure how they work.

> You need to install a user mode drive to leverage already existing kernel code with your device.

You mean a user-mode application? A user-mode driver is something you write instead of a kernel-mode driver (when it's possible), not on top of it. (?)

Windows has User-Mode Driver Framework and Kernel-Mode Driver Framework where UMDF exposes only a part of the kernel API.

KMDF drivers have to be signed with a CA that's not user installed while UMDF drivers may be.

I'm already aware of this and I don't understand how this answers the question in the comment you replied to. Maybe you meant to reply to a different comment?

Yes, a user-mode driver is something you would write instead of a kernel mode driver, if you can. Kernel-mode code is the most powerful, but also poses the greatest security and stability threat to the computer, so Microsoft locks it down the hardest. If you don't need the extra power, you can write a use-mode driver that uses Microsoft-provided kernel components (Like Winusb.sys) and you don't have to go through the same security procedures.

Yes, I think they also have to be counter signed by Microsoft.

Yeah but who would try to use commercial hardware as an attack vector?

You forgot the /sarc tag.

Or maybe forgot all the digital picture frames that hosted viruses.

It should be possible, but be like Chrome Extensions where there's an entirely different flow to install a non-WebStore extension. Though perhaps Chrome's doesn't provide enough warning...

It can have its small benefits to install custom (non-root) certs in Windows 10 to support old hardware,

Thanks to the folks at http://leshcatlabs.net/unifl-unified-leshcat-drivers/ i can put Windows 10 on old laptops with 'unsupported' old AMD and/or Intel gpu's.

When i was modifying my HTPC from Windows 8 to 10 i also experienced that annoying protection. I used the Cmedia BitPerfect drivers on my Windows 8 machine (https://code.google.com/archive/p/cmediadrivers/wikis/Bitper...) to have almost perfect DTS throughput, but couldn't use these on Windows 10 because not signed. The Leshcat people kindly provided me with a signed version.

Reply on news.ycombinator.com