Guide [Source] Windows Kernel — Secure Boot & WBCL Registry Faking for TPM Attestation Bypass (C++)

[byte_corvus]

Boys, dropping a base for faking Secure Boot states from kernel-mode. I've been digging through some legacy bypass methods and decided to put this together. To be clear: this is effectively a legacy approach for those running environments where you cannot enable SB for real. TPM attestation checks will catch you eventually, so don't expect this to save you on high-security titles with active hardware attestation.

This snippet focuses on modifying the WCBL reg keys and NtosKrnl values to report a compliant state to the OS.

#include "Driver.h"
 //48 8B 05 ? ? ? ? 48 8B ? 0F 11 45 ? 48 85 C0 = HalEfiRuntimeServicesTable -> works on win11 and win10!
 VOID SetSecureBootNtosValue()
{
 static CHAR szSig[] = "C1 E8 03 24 01 88 42 01";  
  pDriver->ulSecureBootValueAddress = FindPattern( pDriver->ulNtosKrnlBase, pDriver->ulNtosKrnlSize, szSig, -0x6, TRUE, 0x2 ); 
  memset( szSig, 0, sizeof(szSig) ); 
  if(!pDriver->ulSecureBootValueAddress)
  return; 
  ULONG ulValue = *(ULONG*)(pDriver->ulSecureBootValueAddress); 
 pDriver->ulSecureBootOrigValue = ulValue; 
  ulValue |= 0x1; 
 ulValue |= 0x8; 
  *(ULONG*)(pDriver->ulSecureBootValueAddress) = ulValue; 
}
 VOID SetSecureBootRegKey()
{
 CHAR szSecureBootState[128] = {0}; 
 GetDecryptedString( STRING_REG_KEYPATH_SECUREBOOTSTATE, szSecureBootState ); 
  CHAR szUEFISecureBootEnabled[128] = {0}; 
 GetDecryptedString( STRING_REG_KEYNAME_UEFISECUREBOOTENABLED, szUEFISecureBootEnabled ); 
  WCHAR wzSecureBootState[128] = {0};
 mbstowcs( wzSecureBootState, szSecureBootState, 128 ); 
  WCHAR wzUEFISecureBootEnabled[128] = {0}; 
 mbstowcs( wzUEFISecureBootEnabled, szUEFISecureBootEnabled, 128 ); 
  UNICODE_STRING usKeyPath, usValueName;  
 RtlInitUnicodeString( &usKeyPath, wzSecureBootState ); 
 RtlInitUnicodeString( &usValueName, wzUEFISecureBootEnabled );  
  OBJECT_ATTRIBUTES obj; 
 InitializeObjectAttributes( &obj, &usKeyPath, OBJ_CASE_INSENSITIVE, NULL, NULL ); 
  HANDLE hKey = 0;
 NTSTATUS ntRet = ZwOpenKey( &hKey, KEY_ALL_ACCESS, &obj );
  if(ntRet == STATUS_SUCCESS)
 {
  DWORD dwValue = 0x1; 
  ZwSetValueKey( hKey, &usValueName, 0, REG_DWORD, (PVOID)&dwValue, sizeof(DWORD) ); 
   ZwClose( hKey ); 
 }
}

Technical breakdown:

1. NtosKrnl Hooking: Uses a pattern search for HalEfiRuntimeServicesTable to locate and flip the SB flags directly in memory.
2. Registry Manipulation: Forces the UEFISecureBootEnabled key to 0x1.
3. WCBL/TPM Logic: Parses the platform log file and registry blocks for "S.e.c.u" signatures, adjusts the size, and patches the bytes to report a secure state.
4. KUSER_SHARED_DATA: Performs a safe write to DbgSecureBootEnabled to ensure the user-mode structures reflect the spoofed state.

If you're using this, make sure to clean your pool allocations. Using ExAllocatePool for these operations is fine, but if you're dealing with strict kernel-mode scanners, consider moving these allocations to a static memory block or a custom allocator to hide the footprint from integrity checks.

Has anyone experimented with hooking the specific TPM communication buffers instead of just patching the registry/boot flags? Most modern ACs are moving towards remote attestation rather than just checking local flags.

Drop your thoughts or any optimization for the sig scanning below.