SECDRV.SYS Not Loading in Windows 10; this will break thousands of older games.

Hello from Prague, 

I used your advice, installed the Windows 10 SDK, and certified the SECDRV driver.

Now, the AOM game runs directly from Windows 10, even under another account on my computer.

In addition, this was my first practical demonstration of Windows Powershell.

Previously, I used AOM to boot the computer without signing the drivers and I was so dangerous to run the game. Thank you for your help.

J. Tomascin

Thanks for the response and recommendations, I'll be sure to take precautions.

I've noticed that once you've re-booted the system, SECDRV fails to start and games will fail to load, as expected; at this point the system will once again be protected, providing you haven't been compromised by a root kit attack?

I know that the below commands and disable driver signature enforcementallow SECDRV to once again load:

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS

bcdedit /set TESTSIGNING ON

I think the default service start configuration is demand start (manual).

sc.exe start secdrv

will again start the driver.

You can configure it to automatically start after every boot as follows

sc.exe config secdrv start= auto

You can find out what the start type is with the 'query configuration' command:

sc.exe qc secdrv

Not having secdrv started only protects you from issues with the driver itself. You might still have software that runs elevated simply start the driver and exploit your system from there. You will also still be vulnerable from having secure boot disabled.

Not having secdrv started only protects you from issues with the driver itself. You might still have software that runs elevated simply start the driver and exploit your system from there. You will also still be vulnerable from having secure boot disabled.

Currently, I'm running SECDRV only when It's needed. The rest of the time it's disabled so I can use the system for normal usage.

Running these commands and rebooting will auto start SECDRV.

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS

bcdedit /set TESTSIGNING ON

So if I don't run the these two commands, attempting to run SECDRV will be blocked from starting.

If software that runs elevated makes the same attempt, it would also fail to start SECDRV?

My BIOS has had Secure Boot enabled throughout the entire process (My MOBO doesn't allow be to disable it anyhow).

Microsoft does provide a way to re-enable SECDRV.

• Install a game that brings (a recent version of) SECDRV.sys.
• Install the Windows 10 SDK from Get the standalone Windows 10 SDK. Just install all components, cuz who cares.
• Start PowerShell as Administrator.
• Find makecat.exe, makecert.exe and signtool.exe and add the path to your PATH:

dir -Directory -Path 'C:\Program Files (x86)\Windows Kits\10' -Recurse |

where BaseName -eq "x86" |

where { (dir $_.FullName -Filter makecert.exe) -ne $null } |

where { (dir $_.FullName -Filter makecat.exe) -ne $null } |

where { (dir $_.FullName -Filter signtool.exe) -ne $null } |

select -First 1 |

foreach { $env:Path = "$env:Path;$($_.FullName)" }

• The ones in a x86 subfolder are always OK on all Intel architecture chips. No need to match the hardware or the OS bitness.
• Create a new folder, copy SECDRV.sys in it. If it's an old version, use this one here. Its from September 2006.

mkdir "$env:USERPROFILE\Downloads\SECDRV" | Out-Null

cd "$env:USERPROFILE\Downloads\SECDRV"

• If it's an old version, use this one here. Its from September 2006.

curl -UseBasicParsing -Uri "https://github.com/ericwj/PsSecDrv/raw/master/tools/SECDRV/SECDRV.sys" -OutFile "SECDRV.sys"

• Enable test signing boot mode.

bcdedit /set "{current}" testsigning on

• Pick a subject for the certificate.

$Subject = "SECDRV.sys signing for $env:USERDOMAIN$env:USERNAME on $("{0:dd-MMM-yy HH:mm}" -f [datetime]::Now)"

• Create a root certificate.

makecert -r -sr LocalMachine -ss My -n "CN=$Subject"

• Open Local Machine Certificates.

certlm.msc

• Go to Personal, Certificates and select the certificate created, there usually is only one, or match the subject, right click Copy.
• Go to Trusted Root Certification Authorities, Certificates. Paste.
• Go to Trusted Publishers, Certificates. Paste.
• Make a text file called SECDRV.cdf in the folder and put this in it.

[CatalogHeader]

Name=SECDRV.cat

PublicVersion=0x1

EncodingType=0x00010001

CATATTR1=0x10010001:OSAttr:2:6.0

[CatalogFiles]

<hash>SECDRV=SECDRV.sys

• Make a driver catalog file in the folder.

makecat -o SECDRV.txt -r SECDRV.cdf

• Sign the driver. Use the thumbprint as shown in certlm for the certificate created, just double click it and look around, without spaces. Or get it in PowerShell with dir:

$Cert = dir Cert:\LocalMachine -Recurse | where Subject -Match ([regex]::Escape($Subject)) | select -First 1

$Thumbprint = $Cert.Thumbprint

signtool sign /sm /s Root /sha1 "$Thumbprint" /t "http://timestamp.verisign.com/scripts/timstamp.dll" secdrv.cat

• Install the driver.

signtool catdb /u secdrv.cat

• Reboot.
• Test if it works.

sc.exe start secdrv

If it doesn't work,

• one reason is the SECDRV.sys on your system is too old. Then the driver doesn't start.
• Another reason is Secure Boot is enabled. Run bcdedit again after disabling it.
• Another reason is you didn't reboot. You will have to reboot.
• On 64-bit systems, SECDRV might still report 'This driver is blocked from loading' if it is configured with C:\Windows\SysWOW64\drivers\SECDRV.sys as the binary path. To 1) verify and fix this, 2) copy SECDRV.sys and 3) change the binary path of the driver service:

sc.exe qc secdrv

copy C:\Windows\SysWOW64\drivers\SECDRV.sys C:\Windows\System32\drivers

sc.exe config secdrv binpath= C:\Windows\System32\drivers\SECDRV.sys

In PowerShell, don't omit the ".exe." in sc.exe. Nothing will appear to happen, but you will have ended up with a file called "start", "qc" or "config" that contains the text "secdrv" because sc is short for Set-Content...

Now play games.

Thanks, this enabled me to install and run the Sims Deluxe and it's various expansion packs without the need for a NoCD. Certain it will work with other games that require SECDRV.sys.

It's not perfect but this is the only way to restore full functionality with old discs. I wonder how severe the security vulnerability is though once this is enabled?

I don't doubt this will work but if i have to do all this I really don't want to take a chance it will cause a problem with my computer.