Seattle
waiting..
eg
does it need the sdk/wdk secure boot policy
maybe a way to turn the debugger into a protected process so it can access another protected process (csrss)
Personally I hope it isnt too easy to set up, as then only those who really need it and know how to do it (and the consequences) will use it, and there will be less chance of MS closing it off further
My in-progress 8.1 jailbreak hack doesn't require the Windows Kits Policy to be installed, no. It bootstraps execution of unsigned native code using an exploit in PowerShell, then loads a kernel driver using a flaw in the code signing system.
The PowerShell exploit is, in effect, a sandbox escape. It does not require Administrator privilege, but all you get is native code execution at the same privilege as your user account.
The kernel driver loading bug requires Administrator privilege; it is not bypassing the requirement of your account needing Administrator privilege to ask the Service Control Manager to load a driver on your behalf. In Raymond Chen terms, it's "already on the other side of the airtight hatchway".
The hack is designed to be automatically started and permanent; once installed, it'll load at each boot, until you uninstall it. It won't load if Safe Mode is enabled, to aid with troubleshooting. When it loads, it will write to the Security audit log to indicate that it has jailbroken the system. Also, I plan on enabling the desktop watermark as if a prerelease build and changing the text to "Jailbroken" or similar.
Melissa
My in-progress 8.1 jailbreak hack doesn't require the Windows Kits Policy to be installed, no. It bootstraps execution of unsigned native code using an exploit in PowerShell, then loads a kernel driver using a flaw in the code signing system.
The PowerShell exploit is, in effect, a sandbox escape. It does not require Administrator privilege, but all you get is native code execution at the same privilege as your user account.
The kernel driver loading bug requires Administrator privilege; it is not bypassing the requirement of your account needing Administrator privilege to ask the Service Control Manager to load a driver on your behalf. In Raymond Chen terms, it's "already on the other side of the airtight hatchway".
The hack is designed to be automatically started and permanent; once installed, it'll load at each boot, until you uninstall it. It won't load if Safe Mode is enabled, to aid with troubleshooting. When it loads, it will write to the Security audit log to indicate that it has jailbroken the system. Also, I plan on enabling the desktop watermark as if a prerelease build and changing the text to "Jailbroken" or similar.
Melissa
| Tags |
| hack, jailbreak, windows, windows rt, winrt |
| Thread Tools | Search this Thread |
| Display Modes | |
|
|
Linear Mode
