DaXcess

23 | Wanna be modder I guess
🇳🇱 Komt ie maat
🦋 @daxcess.io

[DaXcess @daxcess]

@aidan0x13 I lied it's more possible than I initially thought: https://t.co/sc6GYa4W1O

[DaXcess @daxcess]

I think it's funny to see people trying to figure out how this was achieved so here it is again but in video form (and with a different publisher).

Also no I did not add my own certificate to the trusted root CA's that'd be cheating.

[DaXcess @daxcess]

I guess having to pay for code signing certificates is no longer needed

[DaXcess @daxcess]

@aidan0x13 So a full UAC bypass here is *technically* feasible but unlikely. Would require both finding a *trusted* writable folder in System32 or Program Files for UIAccess, and an existing program with admin privileges and a UI must be open at the same time. Then inject using SWEX.

[DaXcess @daxcess]

@timhvn I love spreading misinformation

[DaXcess @daxcess]

I guess having to pay for code signing certificates is no longer needed

[DaXcess @daxcess]

@itsThurtea Kinda true, though this can also be used to bypass the signature restriction for UIAccess processes, which in turn can be used for a full LPE

[DaXcess @daxcess]

@haz0a Basically everything with a few exceptions

[DaXcess @daxcess]

@ivangraupera Herpaderping, known since like 2021 but not in this context yet I guess

[DaXcess @daxcess]

@aidan0x13 Completely from usermode. I actually tried this technique to see if it could load unsigned drivers however interestingly that fails with STATUS_INVALID_IMAGE_FORMAT in CI!HashpParsePEHeader, instead of the STATUS_INVALID_IMAGE_HASH error usually observed with self signed drivers

[DaXcess @daxcess]

@aidan0x13 It's there but I think it just doesn't flag it, eicar triggers just fine.

[DaXcess @daxcess]

@_12d @flyinjz_ Post about some silly UAC stuff devolving into a discussion about larping was not on my bingo card

[DaXcess @daxcess]

@slacksarenice That would be cheating :(

[DaXcess @daxcess]

@ndevtk I mean you'd technically be "spoofing" the UAC as well when running "powershell -c" or "cmd /c" as admin, though you wouldn't have control over the app name, icon and executable in those cases

[DaXcess @daxcess]

Since the update is right around the corner here are some sneak peeks (yes you can see some of your own cosmetics in VR)

[DaXcess @daxcess]

@FurrGotten I'm just fast like that

[DaXcess @daxcess]

1 day...

[DaXcess @daxcess]

@TheRealCorvid I mean if even Zeekerss made the change, I don't doubt modders will follow suit if enough people make it known to the authors. I myself probably will not go chasing all of them down unless I use those mods myself.

[DaXcess @daxcess]

Just a small heads up that the upcoming LCVR update will break basically all other mods out there as their shaders aren't supported out of the box.

Mods will have to do the same thing Zeekerss did for them to render properly (add the OpenXR plugin).

[DaXcess @daxcess]

@BoloFan05 Lethal Company is still on 1.14.0 so I still have to set the culture to invariant myself, but this is good to know for potential future projects!

[DaXcess @daxcess]

Gotta be kidding me, three guesses as to why this issue could be happening?

I'll give you a hint: Set your PC language format to Turkish.

Why does this break Unity!?!?!?!?