DSE Bypass

What is DSE?

Driver Signature Enforcement (DSE) is a Windows security feature that requires all kernel-mode drivers to be digitally signed by Microsoft or a trusted certificate authority. Without a valid signature, Windows refuses to load the driver.

Bypass Strategy

The EFI driver scans winload.efi's .text section for theMOV [rip+imm32], ecx instruction that initializes g_CiOptions, then NOPs out the 6-byte instruction to leave g_CiOptions at 0.

; Original instruction in winload.efi
mov [rip+0x12345], ecx    ; Sets g_CiOptions

; After patching (6 bytes of NOP)
nop
nop
nop
nop
nop
nop                        ; g_CiOptions remains 0

How It Works

1. EFI driver hooks gBS->ExitBootServices
2. When hook fires, read DioProcessDseBypass NVRAM variable
3. If enabled, scan winload.efi .text section for target pattern
4. Pattern: 89 0D ?? ?? ?? ?? (MOV [rip+imm32], ecx)
5. Replace 6 bytes with NOPs (90 90 90 90 90 90)
6. Restore original ExitBootServices and continue boot

Usage

1. Install the EFI driver via title bar "Install EFI" button
2. Navigate to UEFI Bootkit tab
3. In Boot Patches section, toggle DSE Bypass ON
4. Click Save to NVRAM
5. Reboot — DSE will be disabled

NVRAM Variable

Implementation