Driver proxy to avoid repeated code signing on Windows

Question

Drivers on Windows should be signed and submitted to Microsoft for code signing and this is a requirement for 64 bit systems. The problem is that, when you have to update the driver, you have to submit it again, once for every release.

Is possible to build some kind of proxy or shim driver so that I have to sign and submit it only once, and then have my code in a separate module?

Of course I can't just move the working code in a DLL, as also dynamically loaded modules have to be signed in order to being executed in 64 bit kernel mode. What if I put my code in a raw file, load it in memory (allocated with execution flag enabled) and then execute it? Other ideas?

Answer 1

You don't have to submit a driver to Microsoft. You have to sign your driver with a cross-signing-certificate. You will get a nag screen this way, but this is not forbidden!

There were (are) several attempts to do just what you want to do. These are 'barely' tolerated, but these drivers may be banned any at time. (By revoking your signature)

The process is very easy :

1. Load the signed driver.
2. Provide a IoControl in which user mode programs can send memory to the kernel.
3. Change the execute bit of this memory, and just call an address in this memory.