Post

@decoder-it.bsky.social and i noticed that it's no more possible to call NtLoadDriver pointing to an unprivileged regkey such as \REGISTRY\USER Even if you have the SeLoadPrivilege you would still require the Admin group to write the required regkey. Some more technical details below 👇

Antonio Cocomazzi

@splintercode.bsky.social

In newer ntoskrnl.exe there is a check in IopLoadDriver->IopBuildFullDriverPath->IopQueryRegistryKeySystemPath that ensure the "ImagePath" value is under a regkey prefixed with \REGISTRY\MACHINE and if not it returns 0xC00000E5

13/12/24, 4:11 pm0 reposts0 likes

Antonio Cocomazzi

@splintercode.bsky.social

13 Dec 2024

In older ntoskrnl (e.g. Win2016 1607) the function IopQueryRegistryKeySystemPath doesn't exist and the "ImagePath" value is retrieved without checks through IopGetRegistryValue(..., "ImagePath",...) in IopBuildFullDriverPath

Antonio Cocomazzi

@splintercode.bsky.social

13 Dec 2024

There is also another check later in IopQueryRegistryKeySystemPath that ensures the ImagePath is under the "System" key