Windows x64无签名驱动程序运行方法  

Excution Method of Unsigned Driver on Windows x64

作　　者：张智[1] 蔡皖东[1] 

机构地区：[1]西北工业大学计算机学院,陕西西安710129

出　　处：《微电子学与计算机》2014年第2期101-105,共5页Microelectronics & Computer

基　　金：西北工业大学研究生创业种子基金项目(Z2012141);2013年陕西省科学发展计划项目(2013K06-19)

摘　　要：主机监管系统利用过滤驱动程序对系统实现全面监管.随着微软64位操作系统的推出,要求驱动程序经过付费签名后才能正常运行.由种种原因使驱动程序不能被签名时,主机监管系统就不能在WINDOWS 64位操作系统上使用.因此无签名驱动程序问题成为在WINDOWS 64位系统开发最普遍的问题之一,会导致程序难移植、影响用户体验.通过对WINDOWS 64位系统数字签名过程的逆向分析,提出一种能一次性关闭系统数字签名验证机制的方法,从而顺利加载运行未签名驱动程序.Via filter drivers, host regulatory system manages computers perfectly. With the launch of Microsoft＇s 64- bit operating system, only signed drivers which cost money can be executed on windows x64. For some reasons drivers cannot be signed so that host regulatory system is impossible for windows x64. Unsigned driver problem becomes one of the most common problems, which lead to bad effect on portability or user experience, so it is urgent demand to execute unsigned drivers. In this paper, upon analysis of kernel assembler about verifying driver signature, we proposed a method to turn off the verification of driver signature. Then unsigned drivers can be executed.

关 键 词：驱动程序验证 数字签名WINDOWS X64 内核 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]