无法进入内核模式的非官方暂时解决办法 Unofficial temporary workaround to enter "kernel mode"

[andronoob]

1. 用signtool删除OpenArkDrv64.sys自带的证书被吊销的数字签名（否则即使禁用驱动强制签名也无法加载） Remove the invalid digital signature (signed by a certificate which has been revoked) of OpenArkDrv64.sys using signtool (otherwise the driver cannot be loaded even if DSE is already disabled)

signtool.exe remove /s OpenArkDrv64.sys

signtool.exe可以从Windows SDK中获取。signtool.exe can be obtained from Windows SDK.

OpenArkDrv64.sys在%temp%下可以找到。OpenArkDrv64.sys can be found at %temp%.

2. 禁用驱动强制签名 Disable DSE (Driver Signature Enforcement)

有多种方法。There're multiple ways to achieve this.

方法之一是使用EfiGuard，需要禁用SecureBoot。One of the methods is using EfiGuard, with SecureBoot disabled.

https://github.com/Mattiwatti/EfiGuard

大致步骤： Brief instructions:

(1) 挂载ESP（EFI系统分区）到S盘 Mount the ESP (EFI System Partition) to driveletter S

mountvol S: /s

(2) 把EfiGuardDxe.efi、Loader.config.efi、Loader.efi三个文件复制到S:\EFI\Boot\

copy EfiGuard-v1.2.1\EFI\Boot\*.efi S:\EFI\Boot\

(3) 用BOOTICE给Loader.config.efi添加UEFI启动项 Add Loader.config.efi to the UEFI boot sequence list using BOOTICE

可以勾选下次启动时使用该项，也可以在BIOS设置（也就是所谓的“UEFI固件设置”）的（硬盘）启动顺序里选择新加入的UEFI启动项。You can either check the "Boot this entry next time" checkbox in BOOTICE or adjust UEFI (harddrive) boot sequence in the BIOS settings (so-called "UEFI firmware settings") .

(4) 别忘了禁用安全启动。Don't forget to disable SecureBoot.

在F8启动菜单里选择禁用驱动强制签名应该也可以，但我没试过。而且桌面版Windows的F8从Win8开始就被微软干掉了，想重新开启F8菜单需要bcdedit /set {default} bootmenupolicy legacy（bootmenupolicy默认是standard）Choosing "Disable driver signature enforcement" in the F8 boot menu should work as well, but I haven't tested this method. Also, F8 boot menu of desktop versions of Windows has been crippled by Microsoft since Win8, you can re-enable it by bcdedit /set {default} bootmenupolicy legacy (if you want to revert to the default, change bootmenupolicy value from "legacy" to "standard")

3. 手动加载驱动 Load the driver manually

先把已被去除数字签名的OpenArkDrv64.sys复制到%windir%\system32\drivers\ First, copy OpenArkDrv64.sys (which already has its signature removed) to %windir%\system32\drivers\

然后删除服务（如果存在） Then delete the service (if exists)

sc delete OpenArkDrv64

然后创建服务 Then create the service

sc create OpenArkDrv64 binpath= \Windows\system32\drivers\OpenArkDrv64.sys type= kernel start= demand

最后启动服务 Then start the service

sc start OpenArkDrv64

[abcdehc]

question:
OpenArkDrv64.sys can NOT be found at %temp%.

logs:
[UNONE::ObLoadDriverW] [ERR] NtLoadDriver service:\Registry\Machine\System\CurrentControlSet\Services\OpenArkDrv64 err:c0000603
[Kernel::onClickKernelMode] [ERR] InstallDriver C:\Users\HC\AppData\Roaming\OpenArk\kernel\OpenArkDrv64.sys err

[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[ArkDrvApi::Process::OpenProcess] [ERR] OpenProcess by Kernel pid:4 err:2
[OpenArk::onActionCheckUpdate] [INFO] requset server:http://file.blackint3.com:88/openark/version.txt
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] local appver:1.3.0, build:202302271420
[OpenArk::onActionCheckUpdate::::operator ()] [INFO] server responsed:{
"err": 0,
"appver": "1.3.0",
"appbd": "202302271420",
"appcl": "6L+b56iL566h55CG5aKe5by677yM6Ieq5Yqo5Yi35paw77yM5pSv5oyB5ouW5Yqo6YCJ5oup56qX5Y+jCuWGheaguOWinuWKoFNTRFQvU2hhZG93L1dGUC9GaWx0ZXIvTWluaWZpbHRlci9UaW1lcuetieWkmuenjeWbnuiwgwrng63plK7mlK/mjIFXaW4xMQrlt6XlhbflupPlkIjlubbvvIzmm7TmlrDmjaLku6PvvIzmlK/mjIHmn6Xor6IK5omr5o+P5Zmo5aKe5YqgRUxG44CB5pmu6YCa5paH5Lu25omr5o+PCuWinuWKoOaVsOWtpuiuoeeul+etiee8lueoi+WKqeaJiwrlkITnp41CVUfkv67lpI3vvIzlkITnp43orrDkuI3muIXnmoTlip/og70K5pe26ZqU5LiA5bm077yM5Y+q6IO96K+077yMR29vZCBMdWNrIDIwMjPvvIEKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkltcG92ZWQgcHJvY2VzcyBtYW5hZ2VyLCByZWZyZXNoIGF1dG9tYXRpY2FsbHkuCkFkZGVkIGtlcm5lbCBmZWF0dXJlcywgU1NEVC9TaGFkb3cvV0ZQL0ZpbHRlci9NaW5pZmlsdGVyL1RpbWVyIGV0Yy4KQWRkZWQgZW51bSBob3RrZXkgZm9yIHdpbjExLgpBZGRlZCB0b29scyByZXBvLCBzZWFyY2ggc3VwcG9ydGVkLgpBZGRlZCBFTEYvRklMRSBzY2FubmVyIC4KQWRkZWQgbWF0Y2ggY2FjdWxhdG9yIGluIGNvZGVraXRzLgpCdWdmaXhlZCBhbmQgb3RoZXIgZmVhdHVyZXMuCkdvb2QgTHVjayAyMDIzIQo=",
"appurl": "https://github.com/BlackINT3/OpenArk/releases"
}

[andronoob]

OpenArkDrv64.sys can NOT be found at %temp%.

You may see the new path in the log. However I haven't been using this tool for quite some time. I don't know what was going on then.

[andronoob]

Oh I see. Tried 1.3.0. It automatically deletes the driver after operation even if it failed to load. You have to make use of NTFS ACL to deny deletion, so that the file would be kept.

[andronoob]

With EfiGuard having DSE disabled, you have to deny deletion and data write/modify/append with NTFS ACL.