Home

Awesome

CiDemoDriver

A joint effort of Liron Zuarets and I, CiDemoDriver is a very simple driver which demonstrates using ci.dll API in order to validate files. This repository complements a write-up we published about the subject.

Logic

The driver registers a ProcessCreateProcessNotify routine and whenever a new process is created, it tries to verify its Authentocide signature using two ci.dll APIs:

If the file's signature was verified successfully, the driver will parse the output PolicyInfo structure in order to extract the signing certificate and its details.

Requirements

License

This software is open-source under the MIT license. See the LICENSE.txt file in this repository.