TDL (Turla Driver Loader) For Bypassing Windows x64 Signature Enforcement
Definition: TDL Driver loader allows bypassing Windows x64 Driver Signature Enforcement.
What are the system requirements and limitations?
It can run on OS x64 Windows 7/8/8.1/10.
As Vista is obsolete so, TDL doesn't support Vista it only designed for x64 Windows.
Privilege of administrator is required.
Loaded drivers MUST BE specially designed to run as "driverless".
There is No SEH support.
There is also No driver unloading.
Automatically Only ntoskrnl import resolved, else everything is up to you.
It also provides Dummy driver examples.
Differentiate DSEFix and TDL:
As both DSEFix and TDL uses advantages of driver exploit but they have entirely different way of using it.
Benefits of DSEFix:
It manipulates kernel variable called g_CiEnabled (Vista/7, ntoskrnl.exe) and/or g_CiOptions (8+. CI.DLL).
DSEFix is simple- you need only to turn DSE it off - load your driver nothing else required.
DSEFix is a potential BSOD-generator as it id subject to PatchGuard (KPP) protection.
Advantages of TDL:
It is friendly to PatchGuard as it doesn't patch any kernel variables.
Shellcode which TDL used can be able to map driver to kernel mode without windows loader.
Non-invasive bypass od DSE is the main advantage of TDL.
There are some disadvantages too:
To run as "driverless" Your driver must be specially created.
Driver should exist in kernel mode as executable code buffer
You can load multiple drivers, if they are not conflicting each other.
Build
TDL contains full source code. You need Microsoft Visual Studio 2015 U1 and later versions if you want to build it. And same as for driver builds there should be Microsoft Windows Driver Kit 8.1.
Credits:
R136a1
N. Rin
Download Link: Click Here
ليست هناك تعليقات:
إرسال تعليق