CMDT - Ultra-lightweight Run-as-TrustedInstaller (Pure x64/x86 Assembly)

Discussion in 'MDL Projects and Applications' started by wesmar, Feb 6, 2026.

  1. adric

    adric MDL Expert

    Jul 30, 2009
    1,536
    1,721
    60
    Cmdt doesn't work when trying to delete Windows Defender Log files. Result is access denied. GUI as well as Command prompts
    Code:
    C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service>cmdt_x64.exe -cli del *.log
    
     
  2. wesmar

    wesmar MDL Member

    Apr 1, 2012
    194
    676
    10
    TrustedInstaller won't help at all here because the restriction is enforced directly in the kernel. I'm actually thinking about building a tool to bypass this. The way to do it is via a BYOVD approach, leveraging a signed driver like IObitUnlocker.sys to execute low-level deletion.

    The key is to construct a raw IRP packet and send it directly to the underlying file system device object (Ntfs.sys / ReFs.sys), completely bypassing the Filter Manager (FltMgr.sys). By routing the I/O request below the Anti-Malware altitude, you effectively blindsided WdFilter.sys and its pre-operation callbacks. Otherwise, you're not getting past it on a live system.
    P.S. I’ve actually written my own custom driver called kvcstrm which has god-mode privileges and covers all possible primitives. It’s unsigned, but since I can map/load it anyway, I’ll either use that or just leverage a signed vulnerable one.
     
  3. adric

    adric MDL Expert

    Jul 30, 2009
    1,536
    1,721
    60
    Okay, I will just disable Defender and then delete the logs.
     
  4. betakernel

    betakernel MDL Novice

    Nov 29, 2017
    38
    11
    0


    Code:
    @echo off
    if /i "%UserName%" == "SYSTEM" (Goto GotAdmin) else (reg query "HKLM\SYSTEM\ControlSet001\Control\MiniNT" 1>nul 2>nul&&Goto GotAdmin)
    :BatchGotAdmin
    Set _Args=&Set Args=%*
    if `%1` neq `` Set "_Args=%Args:"=""%"
    if exist %WinDir%\System32\fltMC.exe fltMC 1>nul 2>nul||(echo CreateObject^("Shell.Application"^).ShellExecute "cmd.exe","/c """"%~f0"" %_Args%""",,"runas",1 >"%TEMP%\getAdmin.vbs"&(CScript 1>nul 2>nul&&CScript //nologo "%TEMP%\getAdmin.vbs" 1>nul 2>nul||"%TEMP%\getAdmin.vbs" 2>nul)&del /f /q "%TEMP%\getAdmin.vbs" 2>nul&Exit /b)
    
    :GotAdmin
    Pushd "%CD%"&cd /d "%~dp0"
    
    schtasks -create -f -sc onStart -ru "NT AUTHORITY\SYSTEM" -tn DWDH -tr "cmd /c cd /d 'C:\ProgramData\Microsoft\Windows Defender\Scans' & rd /s /q History\Service & del /f mpenginedb.db* & schtasks /delete /f /tn DWDH" >nul 2>nul
    
    
    Exit
     
  5. wesmar

    wesmar MDL Member

    Apr 1, 2012
    194
    676
    10
    Early ForceIO build

    I’m posting an early ForceIO build. It is a tiny standalone client for the signed IObit Unlocker driver and can remove Defender-protected quarantine/log files where TrustedInstaller elevation is not enough.

    The real code is small; most of the EXE is checksum padding. IObitUnlocker.sys verifies the caller EXE against hardcoded checksums from the original IObitUnlocker.exe, so I pad my binary to match them instead of patching the signed driver. The driver remains untouched and normally signed.

    Tomorrow I’ll publish a full write-up on my site and I’ll continue testing all IOCTL combinations. The goal is to polish ForceIO into a clean, fast replacement for the bloated original GUI, reproducing every useful operation with much less overhead.

    Treat it as an early test build for now. Use it only on files you really intend to remove.
     

    Attached Files:

  6. adric

    adric MDL Expert

    Jul 30, 2009
    1,536
    1,721
    60
  7. adric

    adric MDL Expert

    Jul 30, 2009
    1,536
    1,721
    60
    #73 adric, Jul 13, 2026
    Last edited: Jul 13, 2026
    Sorry, but for me the double prompt is back. Admin Session and Non-Admin: Microsoft Windows Pro [Version 10.0.22631.7219]

    Noticed that an invalid command doesn't show any output:
    'netsession' is not recognized as an internal or external command, operable program or batch file.
    Code:
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> cmdt_x64.exe -cli netsession
    
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026>
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026>
    
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> cmdt_x64.exe -cli net session
    
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026>
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026>There are no entries in the list.
    
    f8787bdc7968469c6c00b2c159e1aca825ff56ce9773577688b33a69e7ecbf05 ?SHA256*cmdt_x64.exe
    --a-- W32    APP ENU         1.0.0.1 shp     31,232 01-01-2030 cmdt_x64.exe
     
  8. wesmar

    wesmar MDL Member

    Apr 1, 2012
    194
    676
    10
    Quick follow-up on the previous fix.

    Two more things surfaced after that build went out:

    1. What looked like a second UAC prompt on some setups turned out to be my own relay code re-elevating through ShellExecuteExW("runas") even when the caller was already admin -- "runas" can pop a consent dialog a second time even from an elevated process. Fixed properly now: the already-elevated path captures output entirely in-process (local temp file + direct token duplication), no ShellExecuteExW involved at all when already admin. Zero prompts past the first one, verified with redirect/pipe/plain console, elevated and non-elevated.

    2. Separately: the GUI never scaled for PerMonitorV2-aware displays. The manifest declares PerMonitorV2 but the window/controls were laid out with fixed 96-DPI pixel values, so on scaled displays (125%/150%/etc) the window rendered tiny with clipped/cramped controls. Fixed: DPI queried via GetDpiForWindow/GetDpiForSystem, every control coordinate scaled accordingly, and the window's total size is now computed from the desired client area via AdjustWindowRectExForDpi instead of a guessed constant, so caption/menu/border overhead is correct regardless of theme or DPI.

    Tested through the terminal at several DPI scales, elevated and non-elevated shells.
     

    Attached Files:

  9. adric

    adric MDL Expert

    Jul 30, 2009
    1,536
    1,721
    60
    #75 adric, Jul 13, 2026
    Last edited: Jul 14, 2026
    Still have double prompt on non-admin. Batch file doesn't show this, but starting a non-admin prompt and running cmdt from there does.
    Code:
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>cmdt_x64 -cli net session
    
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>There are no entries in the list.
    Also, is it possible to add showing stderr output when an error is indicated in addition to only stdout?

    I noticed the old -cli method showed stdout on a separate line like it should. This is no longer the case.
    Code:
    U:\SwApps\Tools4Maint\CmdElevation\CmdT>cmdt_x64 -cli net session
    There are no entries in the list.
    
    U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>There are no entries in the list.
    
    Sorry for all the nitpicking. I hope you aren't being annoyed by my comments. Still a great useful tool..
     
  10. Xadiaris

    Xadiaris MDL Junior Member

    Apr 23, 2008
    69
    29
    0
    Same here.
    upload_2026-7-13_20-37-41.png
     
  11. GrofLuigi

    GrofLuigi MDL Senior Member

    Sep 17, 2016
    420
    1,134
    10
    This version doesn't work on Windows 7 any more. Most of the previous versions (the ones I tried) did.

    1.jpg
    2.jpg
     
  12. wesmar

    wesmar MDL Member

    Apr 1, 2012
    194
    676
    10
    I'm not mad—it's a tool for you guys, so I've gotten back to work on it. Scaling and modern Windows features have broken compatibility with older versions of Windows. I'm creating fallback versions and adding two versions of cli-gui. I'll upload them again after testing.
     
  13. Xadiaris

    Xadiaris MDL Junior Member

    Apr 23, 2008
    69
    29
    0
    #80 Xadiaris, Jul 17, 2026
    Last edited: Jul 17, 2026
    Console is good now. Double-clicking GUI opens and closes it immediately. Run as administrator GUI is displayed normally.