KPC: Ultimate Windows Privilege Escalation & Memory Forensics Tool

I'm assuming your entries in “BootExecute” are correct—kvc_smss for kvc and bb for BootBypass
If so, it occurs to me that there might be an unnecessary entry in the drivers.ini file, such as:

Code:

Offset_SeCiCallbacks=15746976
Offset_Callback=32
Offset_SafeFunction=6977376

If that's the case, the patch might be in the wrong place, because depending on the version, that entry was reliable until I figured out how to calculate offsets offline during bootup. If not, please check in Notepad++ and Notepad to see if the drivers.ini file has any strange characters; it would be best if you could send it to me as an attachment.

I’ll check on my end in a moment to see what happens when I have a redundant old entry

 

Replace the file with mine, and we'll see if it works. I suspect the editor might be altering something; it would be better to attach it as a compressed file so I can see right away if it's correct. If it works with my file, edit the file in Notepad++, and I’ll review the conversion in kvc_smss. I definitely did it in BB. I turned on Verbose mode so you could see “Patched - success...”

 

Remove the signature from the driver! Error 428!!!!
I'll let you know why in a moment—I just need to step away for a bit. This isn't a problem with KVC and BB, but rather a change in the cross-signature policy

 

You need to login to view this posts content.

 

I have the latest Windows 10 with the April update. I got this driver running without a single issue (it’s almost 20 years old)—even the I8kfanGUI.exe app started working. It’s a shame it works for me, because I was hoping they’d changed something with the EFI trust chain policy update and I’d have a challenge, but now I’m not so sure. Don't worry, there's always a way. Since you're booting from Windows, I'll easily compile a version for you that works with kvc_smss. Just give me the current offsets from the command
‘kvc dse off --safe’
I'll see how they compare to the ones detected in boot mode

 

It should work with the latest version of KVC, though I’ll admit that on such an early version of Windows 10, the algorithm might be completely different—and probably simpler—and I didn’t include it. I’m speculating a bit because I’d need multiple versions; the old version did this via PDB, and maybe I should prioritize that since it’s the only reliable method, but it also carries a very high risk due to inconsistencies between the updated system and the downloaded symbol files. In that case, an unfavorable patch could cause a BSOD and cause some confusion.

 

In any case, I have to move down to a lower level (RING -1) and move away from PDB because I’m developing highly efficient methods for controlling the Hypervisor in EFI. I’m not officially releasing this yet so Microsoft doesn’t have time to patch it, so it will likely be available in the summer—probably late June or early July—once they’ve implemented the new chain of trust. To read the system at all, I wrote my own driver, an ultra-efficient one for NTFS, inspired by ReactOS’s logic. It’s only 15KB. I could have used the one from Rufus, but it runs in FUSE user space and is slow. Attached are preliminary versions of some of my latest products:

HvciBypass.efi - this is a bootkit that disables HVCI regardless of the registry state, tested exclusively on Windows 11 26H1 (it will work on other versions 99% of the time as well). But in the development version, in addition to self-signing into the BIOS, it can sign other files and drivers with the root certificate, so people won’t have to switch their machines to developer mode or disable SecureBoot; they don't even have to touch HVCI in any way.

And if they want to patch HVCI, then despite the status:

Powershell:

Code:

Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard | Format-List SecurityServicesConfigured,SecurityServicesRunning,VirtualizationBasedSecurityStatus

SecurityServicesConfigured : {2}
SecurityServicesRunning : {0}
VirtualizationBasedSecurityStatus : 2

All security interface sliders originating from SecHealthUI will indicate full protection. For this purpose, I wrote a library (payload.dll) that removes prompts from memory and worked out the mechanism in HypervisorEnforcedCodeIntegrity ChangedInBootCycle for when and how to manipulate the timestamp so the system thinks it did it itself. In addition, I wrote a 3 KB service in x64 assembly that controls the flag inversion just before shutdown—extremely efficient with a pre-shutdown phase and a dedicated thread (bbs.exe/asm)—because none of the options from the Task Scheduler were fast enough to complete before shutdown.

I included this for illustrative purposes; I’m not idle—in my spare time, I write various modules for KVC. The goal of KVC itself is to compromise the Windows system at every stage in a positive sense; it’s the equivalent of rooting Android devices.

 

@Viking99 -
I modified the offset search for Windows 10 and added a more robust semantic fallback (though not the lightning-fast one from IDA). I tested it locally and it took only 20 ms, though I’m still verifying its reliability. Additionally, I wrote a 4 KB service in assembly (bbs.exe) to keep the HVCI slider in the "enabled" position. It disables itself during the pre-shutdown phase so that bb.exe doesn’t have to force a restart via registry manipulation. This is purely for aesthetics and works when RestoreHVCI=YES.

BTW: BB creates BBS; you only need this one file—the other one will appear in the system32 folder automatically

The service starts during boot; it’s like BB’s older brother keeping an eye on the visual state. I can arm it with PPL so it remains untouched. You can see the SecHealthUI slider toggle by running:

Code:

sc stop HvciShutdownSvc
windowsdefender://devicesecurity/
//*Close the “Device Security” window
sc start HvciShutdownSvc
//*reopen
windowsdefender://devicesecurity/

The hooking library and loader from the previous post trigger the full visual effects of HVCI, as if loading a driver on a hardened Win11 system—a clever trick that shows Microsoft’s UI is just a facade.