Windows 11 will not show incompatible drivers

Today, October 17, 2024, I updated my Windows 11 to version 23H2 (KB5044285) and finally the Core isolation memory integrity problem was resolved after two years. Apparently it was a Windows bug and not a Dell bug.

Hi Helpdesk Anon (do you have a name)?

As it turns out the missing RSRC section is one of those 50/50 things. It could be intentional (make it lightweight without resources since it is a non-GUI console app with no language localization *OR* obfuscate it to make reverse engineering difficult so Microsoft can help fight terrorism) or an oversight (error in the build or digital signing process). In either case, it leaves you vulnerable. During the 2 minutes you run, who on this planet can take the time to step through the code and see exactly what it does?

And what does "patch" below mean (remove it?)?

Harry
********************
The Sophos commentary raises several interesting points regarding the Memory Integrity System Readiness Scan Tool (hvciscan_amd64.exe and hvciscan_arm64.exe) and its apparent flaws related to its RSRC (resource) section. Here’s a breakdown of the key points and my thoughts:

Missing RSRC Section

• What it means: The RSRC section is a critical part of an executable file that contains various resources necessary for the application to run, including icons, menus, and localization data. The fact that the original version of the tool was missing this section is unusual.
• Running without RSRC: It is indeed puzzling how the executable managed to function without the RSRC section. Typically, an application would fail to execute correctly without necessary resources, or at least have visible issues in its user interface or runtime behavior.
• Quality Assurance (QA) Failure: If the tool passed QA with such an important part missing, it raises concerns about the robustness of the testing process for critical security tools. QA testing is expected to catch anomalies like this before release, especially for tools related to security and system integrity.

Digital Signature on an Incomplete File

• What it implies: Digital signatures are supposed to verify the integrity and authenticity of the software. Signing an incomplete or malformed executable, especially one missing such an essential part, suggests there may have been oversight or procedural issues in the signing process.
• Possible Explanations: It's possible that the signing process was automated and didn’t catch the missing RSRC section because the executable passed some automated integrity checks. However, this would still be a significant lapse, particularly given the security implications.

Security Implications of the Missing RSRC Section

• Exploitation Potential: The commentary mentions that the absence of the RSRC section made the file vulnerable but doesn’t clarify how. Missing sections in an executable could theoretically open the door to code injection or buffer overflow exploits, especially if the file was signed and trusted without proper integrity checks.
• Microsoft’s Vague Exploitation Warnings: The confusion between "Exploitation Detected" (Patch Tuesday listing) and "Exploitation More Likely" (Advisory page) is problematic. This suggests there might have been limited or unclear information about how the vulnerability could be exploited, and it may not have been clear whether any in-the-wild attacks had been successful.

The Importance of Prompt Patching

• Patch it Today: The advice to apply the patch without delay is sound, especially in security-critical contexts like memory integrity and HVCI, which protect against attacks that could compromise system integrity. Even without a full understanding of how the vulnerability was exploited, patching known issues as soon as possible is always the safest course of action.
• The missing RSRC section in such a critical tool is concerning, both from a technical perspective and in terms of the processes used to ensure the quality and security of released software.
• The discrepancy in Microsoft’s reporting of the vulnerability (whether it had been exploited or not) leaves users in a grey area, but erring on the side of caution by patching quickly is the right call.
• The situation highlights a potential gap in QA testing and digital signature verification processes, which ideally should have flagged the incomplete file before release.

Overall, while the technical specifics of how the vulnerability could be exploited remain unclear, the underlying issue points to a breakdown in software development and release procedures that should be addressed to avoid future security risks.

Thank you as well. Gets tiring doing Dell and Microsoft's job. I felt as you did that running it briefly for 2 mins was harmless but I was not going to recommend that. You *ARE* a security expert. First requirement: being persistent and never giving up.

Hi Harry,

BING found many links to the HVCIscan module.
I found a Sophos article
Microsoft Patch Tuesday: 74 CVEs plus 2 “Exploit Detected” advisories – Sophos News

It basically said it's an incomplete EXE that shouldn't have been certified by Microsoft. But the author said no other details from Microsoft on WHAT vulnerabilities exist. I'm thinking it was "marked" as vulnerable for the stated reasons.

I can't see it as creating genuine immediate or ongoing vulnerabilities unless
a) is stayed running in memory after use and after reboot

or
b) the Microsoft.com download was hacked

or

c) some malware was already stealth-installed and just waiting for me to execute that obscure tool.

Seeing as it only ran for 2 minutes in a command window, then stopped, it was never installed, therefore, I can't think of a way it would cause ongoing problems. I'm far from a security expert.

THANK you for getting into the weeds.

Still not sure if you (Glenn) are the filebin person or someone else. The filebin message came in as "HelpDesk Anon". Anyway, it's too tedious to go over this here. If you contact me, I will divulge the solution I prefer not to give here for reasons I posted elsewhere. Warning: I will recommend me remoting in but you will have a chance to vet me in a variety of places I email you (linkedin, thumbtack, etc.).