Hacker News Reader

Comment by the_only_law | Hacker News Reader

For drivers, I don’t think so. You can enable some boot settings that allow you to run unsigned drivers, for development purposes, but it will revert upon reboot, without anyway to enable it permanently.

View on HN

It's one command and you're forever in test mode[1], i.e.: don't enforce driver signatures:

    bcdedit /set testsigning on

You just have to disable Secure Boot in UEFI first. (And I can confirm Windows 11 doesn't actually require Secure Boot to boot, I've had it off for months as part of win11 certification testing.)

I'm not sure but DRM might revert to lower levels (e.g.: 720p), but that also happens on macOS when you disable SIP IIRC.

1: https://docs.microsoft.com/en-us/windows-hardware/drivers/in...

One thing to note is that game anti cheats will just lock you out if you are in this mode.

It’s the reason that game cheat makers look for exploits in random drivers to load their cheat in kernel space.

True, I forgot about that detail. Basically anything that relies on driver signing enforcement for security/privacy -- DRM, anti-cheats, specific proprietary algorithms -- will deactivate when test mode is enabled, whether one-time via the bootloader or set via bcdedit.

https://github.com/Mattiwatti/EfiGuard

The last I checked there's a patch that will make it permanent, but of course the patcher itself is labeled as "malware" by plenty of AVs, possibly even Windows Defender itself.

Also, updates will probably revert the changes too.

Actually you can turn off enforcement if you want to. Requires a reboot and going into safe mode if I remember correctly. I have done it before when loading hacked drivers for old hardware, etc.

Oh wow, the refusal is devastating then...

There is: test signing. Painful for non-savvy users, but not impossible.

you would have to automate that somehow if it becomes an issue

All Microsoft has to do to stop that from being a problem is to tell Defender to block that automation from running on Windows, for example, by refusing to run anything signed with the automation developer's certificates.

yeah thats true, you can get around some stuff with modified keyboards, accessiblity access, automated mouse but then you are just hacking things together at that point

Reply on news.ycombinator.com