SLIC and SLP in Hyper-V?

Mostly true, but the issue is that on newer versions of Windows 10 (1703 and later iirc), a signature check occurs on vmchipset.dll so that'd have to be dealt with. vmchipset contains the firmware of Hyper-V virtual machines so any modifications would be in vmchipset.dll

 

I actually looked into it, it seems some type of code integrity policy on the system itself is preventing vmchipset from working properly rather than the binaries themselves. I'll look into it further

 

I think you are right and we need some help.

This piece of code removes the signature:

Code:

[System.Runtime.InteropServices.DllImport("Imagehlp.dll")]
private static extern bool ImageRemoveCertificate(IntPtr handle, int index);

private void UnsignFile(string file)
{
   using (System.IO.FileStream fs = new System.IO.FileStream(file, System.IO.FileMode.Open, System.IO.FileAccess.ReadWrite))
   {
      ImageRemoveCertificate(fs.SafeFileHandle.DangerousGetHandle(), 0);
      fs.Close();
   }
}

I had no issues running the HyperV with unsigned vmchipset. But if I change one single byte in the 1b module area (and update the header checksum) the clients won't start.