ELAM driver callback

[Vijayan.S]

As per MSDN doc, ELAM driver can use the following callback to verify the signature of the boot drivers that are loaded after ELAM.

ELAM Driver Requirements - Windows drivers

Boot Driver Callbacks

Use IoRegisterBootDriverCallback and IoUnRegisterBootDriverCallback to register and unregister a BOOT_DRIVER_CALLBACK_FUNCTION.


My question is can i avoid the registration as i don't want to validate the boot driver files. But i will have the ELAM driver as it is required to run a service as protected.

Protecting Anti-Malware Services - Win32 apps


Thanks,

Continue reading...