Windows 11 will not show incompatible drivers

Today, October 17, 2024, I updated my Windows 11 to version 23H2 (KB5044285) and finally the Core isolation memory integrity problem was resolved after two years. Apparently it was a Windows bug and not a Dell bug.

Thank you for the details, Harry, and thanks for asking ChatGPT.

FYI, I learned from an online guy named "Apostate Prophet" that it's possible to get ChatGPT to lie or tailor responses, by ordering your own ChatGPT to follow certain parameters in advance. ;-)

I'm glad ChatGPT liked your thoughtful response.

Hi Gary, no I am not suggesting that you're reasoning is not sound (double negative). A security expert IMO ultimately is forced to do risk management when they have a compelling reason to do something such as running hvciscan_amd64.exe which has benefits. I am just saying Microsoft and Dell don't help with the assessment by addressing the issue and doing a deep dive to provide a solution. They apparently don't think it's that important to enable Memory Integrity or fix the blank screen. I don't like that but I do understand. Same with Dell -- if they would just properly uninstall the Dell stuff when we uninstall it, it would help a lot.

All we can do is make a best effort to plead with them, do some deep-dive research on our own and then (we can) publish the benefits or lack thereof for Memory Integrity and include anything else useful such as the Sophos commentary. Then we the people must make a decision with that information (including your thoughts and mine) and I happen to choose, like you, to run it and think about it as you did. I just feel it's sad so much energy has to be spent.

Summary: I personally think you're reasoning is sound and keep up the great work!

Update... I took all of the above and pasted it into ChatGPT for a re-write and you'll enjoy this. Too bad MSFT and Dell won't read it. chatGPT constantly gives me the assurance I am taking the high road and corporate America, where I don't fit, is not :-).

****************************
ChatGPT said:
It sounds like you're having a thoughtful discussion with Gary about the complexities of managing security features, such as Memory Integrity and specific tools like hvciscan_amd64.exe, and the frustrations with Microsoft and Dell's handling of related issues. Your reasoning highlights an important aspect of risk management in security, where security experts often must weigh the benefits and risks of enabling certain features like Memory Integrity—which helps defend against malicious exploits by ensuring drivers are properly signed—and its potential downsides, like the blank screen issue.

It's frustrating when big companies like Microsoft and Dell don't provide clear, deep-dives into resolving these issues or thoroughly uninstalling proprietary software like Dell’s utilities. This forces users to do their own research, make risk-based decisions, and try to communicate their findings back to the community.

Your suggestion to publish findings on the benefits or lack thereof for Memory Integrity (and related security commentary such as from Sophos) is a great way to empower others to make informed decisions. You both seem to acknowledge the shared burden of doing deep research, but agree that running the tool and analyzing the trade-offs, despite the extra energy required, is the best effort for ensuring system integrity.

It’s admirable that you’re actively working through this and are considering sharing your findings for the benefit of others. Keep pushing forward! If you need help diving deeper into any technical or research aspects, feel free to ask.

Hey Harry,

Name's Gary. (I had 2 grandfathers named Harry. Coincidence.)

Thanks for the reminder that I'm a Security Expert. ;-)

I am a bit skeptical though.

(Aside, I noticed that sometimes I show up as HelpDesk Anon and sometimes as HelpDesk Anon-0. Microsoft seems to do this to my ID because I have this Community ID linked to two registered emails.)

ANYHOW,

"In either case, it leaves you vulnerable. During the 2 minutes you run, who on this planet can take the time to step through the code and see exactly what it does?"

I don't really know how to do that anyhow, other than maybe Process Explorer.

Am I being "reckless" (?) in feeling reassured that

a) it is a command running in CMD that scans drivers (don't know how it does so, presumably Registry)

b) an EXE lacking details, but it is published and hosted by Microsoft, presumably "not malicious"

c) doesn't seem to do any installation or writing to disk. I wouldn't expect that it writes by stealth. I assume it is scanning and reading-only, displaying results in CMD window.

Are you suggesting that is not sound reasoning for deciding to run such a scanner, albeit one lacking the RSRC?
Memory Integrity System Readiness Scan Tool (hvciscan_amd64.exe)?

Thanks for the discussion.

Hi Helpdesk Anon (do you have a name)?

As it turns out the missing RSRC section is one of those 50/50 things. It could be intentional (make it lightweight without resources since it is a non-GUI console app with no language localization *OR* obfuscate it to make reverse engineering difficult so Microsoft can help fight terrorism) or an oversight (error in the build or digital signing process). In either case, it leaves you vulnerable. During the 2 minutes you run, who on this planet can take the time to step through the code and see exactly what it does?

And what does "patch" below mean (remove it?)?

Harry
********************
The Sophos commentary raises several interesting points regarding the Memory Integrity System Readiness Scan Tool (hvciscan_amd64.exe and hvciscan_arm64.exe) and its apparent flaws related to its RSRC (resource) section. Here’s a breakdown of the key points and my thoughts:

Missing RSRC Section

• What it means: The RSRC section is a critical part of an executable file that contains various resources necessary for the application to run, including icons, menus, and localization data. The fact that the original version of the tool was missing this section is unusual.
• Running without RSRC: It is indeed puzzling how the executable managed to function without the RSRC section. Typically, an application would fail to execute correctly without necessary resources, or at least have visible issues in its user interface or runtime behavior.
• Quality Assurance (QA) Failure: If the tool passed QA with such an important part missing, it raises concerns about the robustness of the testing process for critical security tools. QA testing is expected to catch anomalies like this before release, especially for tools related to security and system integrity.

Digital Signature on an Incomplete File

• What it implies: Digital signatures are supposed to verify the integrity and authenticity of the software. Signing an incomplete or malformed executable, especially one missing such an essential part, suggests there may have been oversight or procedural issues in the signing process.
• Possible Explanations: It's possible that the signing process was automated and didn’t catch the missing RSRC section because the executable passed some automated integrity checks. However, this would still be a significant lapse, particularly given the security implications.

Security Implications of the Missing RSRC Section

• Exploitation Potential: The commentary mentions that the absence of the RSRC section made the file vulnerable but doesn’t clarify how. Missing sections in an executable could theoretically open the door to code injection or buffer overflow exploits, especially if the file was signed and trusted without proper integrity checks.
• Microsoft’s Vague Exploitation Warnings: The confusion between "Exploitation Detected" (Patch Tuesday listing) and "Exploitation More Likely" (Advisory page) is problematic. This suggests there might have been limited or unclear information about how the vulnerability could be exploited, and it may not have been clear whether any in-the-wild attacks had been successful.

The Importance of Prompt Patching

• Patch it Today: The advice to apply the patch without delay is sound, especially in security-critical contexts like memory integrity and HVCI, which protect against attacks that could compromise system integrity. Even without a full understanding of how the vulnerability was exploited, patching known issues as soon as possible is always the safest course of action.
• The missing RSRC section in such a critical tool is concerning, both from a technical perspective and in terms of the processes used to ensure the quality and security of released software.
• The discrepancy in Microsoft’s reporting of the vulnerability (whether it had been exploited or not) leaves users in a grey area, but erring on the side of caution by patching quickly is the right call.
• The situation highlights a potential gap in QA testing and digital signature verification processes, which ideally should have flagged the incomplete file before release.

Overall, while the technical specifics of how the vulnerability could be exploited remain unclear, the underlying issue points to a breakdown in software development and release procedures that should be addressed to avoid future security risks.