6 ms·

Interesting. If I understand correctly, the "bypass" is https://github.com/coofcookie/Windows11Upgrade/blob/1.0.0/Windows11Upgrade/win11_installSystem.cs#L13-L

Interesting. If I understand correctly, the "bypass" is https://github.com/coofcookie/Windows11Upgrade/blob/1.0.0/Windows11Upgrade/win11_installSystem.cs#L13-L28 https://github.com/coofcookie/Windows11Upgrade/blob/1.0.0/Wi... which is a copy of https://github.com/AveYo/MediaCreationTool.bat/blob/main/MCT/no_11_setup_checks_on_dynamic_update.cmd https://github.com/AveYo/MediaCreationTool.bat/blob/main/MCT... which appears to be intentionally cryptic. It sets HKLM\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU=1 which is mentioned by Microsoft in https://support.microsoft.com/windows/ways-to-install-windows-11-e0edbbfb-cfc5-4011-868b-2ce77ac7c70e https://support.microsoft.com/windows/ways-to-install-window... which seems reasonable. According to the comment, the rest of the script "uses IFEO to attach to Virtual Disk Service Loader process running during setup, then erases appraiserres.dll [...] it must also do some ping-pong renaming of vdsldr in system32\11" Could anyone explain this in more detail? Also note, according to https://github.com/AveYo/MediaCreationTool.bat/issues/11 https://github.com/AveYo/MediaCreationTool.bat/issues/11 it skips the CPU and TPM checks, but not the Secure Boot checks.

denysvitali 5y ago
As you mentioned, you'll still need Secure Boot (or at least, UEFI boot) + GPT.
anaisbetts 5y ago
The Image File Execution Options's "Debugger" key works in an extremely simple way - it literally intercepts process creation, takes whatever's in the "Debuggers" key, and prepends it to the command-line to run. If that thing is not a Debugger, it means you effectively get to hook whenever a process is created and Do Something. This is a great way to nerf a program You Don't Like (i.e. corporate antivirus), because you can write `Please Die` (or literally anything really) in the Debuggers line, and because the resulting command-line is invalid, the CreateProcess call simply fails, yet every integrity check for verifying the file still exists and its ACLs are set still pass.

denysvitali 5y ago

As you mentioned, you'll still need Secure Boot (or at least, UEFI boot) + GPT.

anaisbetts 5y ago

The Image File Execution Options's "Debugger" key works in an extremely simple way - it literally intercepts process creation, takes whatever's in the "Debuggers" key, and prepends it to the command-line to run. If that thing is not a Debugger, it means you effectively get to hook whenever a process is created and Do Something. This is a great way to nerf a program You Don't Like (i.e. corporate antivirus), because you can write `Please Die` (or literally anything really) in the Debuggers line, and because the resulting command-line is invalid, the CreateProcess call simply fails, yet every integrity check for verifying the file still exists and its ACLs are set still pass.