Windows7内核完整性验证机制研究

Kernel Integrity Verification of Windows 7

Windows 7的内核完整性验证机制使得传统的内核级攻击代码失去作用。针对这一问题,在对系统启动过程中的bootmgr和winload.exe两个文件进行详细分析的基础上,通过修改这两个文件来绕过用于加载内核完整性验证过程的关键函数。测试表明,在获取提升权限的前提下,将上述两个启动文件替换后系统仍然能够正常启动而没有发现异常,说明可以对Windows 7的部分完整性验证机制实现突破。

Windows 7＇s kernel integrity verification mechanism makes traditional kernel-level attacks useless.To solve this problem,this paper presents detailed analysis of two files in the system boot process,bootmgr and winload.exe.The key functions used to load the integrity verification process are bypassed by modifying these two files.Tests show that when privileges have been elevated,the Windows 7 system is still able to start with no abnormal syptoms found after the replacing of the two files.So with this method,the integrity verification mechanism of Windows 7 is partially broken.