ericwj / pssecdrv

PowerShell script and module to install the SECDRV copy protection driver on Windows 10.

How to install SECDRV.sys to play games

Microsoft does provide a way to enable SECDRV on 64-bit Windows.

• Install a game that brings (a recent version of) SECDRV.sys.

• Start the game. It should prompt for elevation. Elevate. It won't work, but you have to do it once.
  If there is an error about insufficient permissions, launch the game explicitly as Administrator, either by right-clicking the shortcut and selecting Run as Administrator or by launching the game by typing the executables path and name from an elevated command prompt.
  Dismiss all errors about things not working and quit the game. Also ignore and do not accept any changes suggested by Windows to run the game in compatibility mode or as Administrator or anything else. That might still be required for the game itself, it is not required for SECDRV to work besides running it elevated just once.

• Install the Windows 10 SDK from Get the standalone Windows 10 SDK.
  Just install all components.

• Start PowerShell as an administrator.

• Make sure you are on 64-bit Windows. Going through this guide on 32-bit Windows is pretty pointless - games should work without. SECDRV just works on 32-bit Windows.

  [System.Environment]::Is64BitOperatingSystem
  

• Find makecat.exe, makecert.exe and signtool.exe and add the path to your PATH in System Properties, Environment Variables.
  The ones in a x86 subfolder are always OK on all Intel architecture chips. No need to match the hardware or the OS bitness.

  $SdkToolsPath = dir -Path "${env:ProgramFiles(x86)}\Windows Kits\10" -Recurse -Directory | where { $n = $_.FullName; $_.BaseName -eq "x86" -and [System.IO.File]::Exists("$n\makecert.exe") -and [System.IO.File]::Exists("$n\makecat.exe") -and [System.IO.File]::Exists("$n\signtool.exe") } | sort CreationTime | select -Last 1
  $env:Path = "$env:Path;$($SdkToolsPath.FullName)"
  

• Create a new folder in your Downloads folder

  $WorkingDirectory = "$env:UserProfile\Downloads\SECDRV"
  if (-not (Test-Path $WorkingDirectory)) { mkdir $WorkingDirectory | Out-Null }
  

• Run all further commands in a PowerShell prompt as Administrator in the folder you created.

  cd $WorkingDirectory
  

• Copy SECDRV.sys in it. Match your operating system bitness.
  If it's an old version, replace it with this one downloadable here. Its from September 2006.

  # Using curl (Windows 10 has it inbox)
  curl.exe -OL https://github.com/ericwj/PsSecDrv/raw/master/tools/SECDRV/SECDRV.sys
  # Using PowerShell or PowerShell Core
  iwr -Uri https://github.com/ericwj/PsSecDrv/raw/master/tools/SECDRV/SECDRV.sys -OutFile SECDRV.sys
  

  That one is 64-bit.

• Check that you have the correct bitness:

  $bytes = [System.IO.File]::ReadAllBytes("$PWD\SECDRV.sys")
  [int]$pe = [System.Text.Encoding]::ASCII.GetString($bytes, 0, 1KB).IndexOf("PE`0`0")
  $mc = [System.BitConverter]::ToUInt16($bytes, $pe + 4)
  switch ($mc) { 0x8664 { "64-bit" } 0x014c { "32-bit" } default { "Unknown" } }
  

  This is a very opportunistic way of reading the machine type in about as few lines as possible by simply finding the first occurrence of PE\0\0 in the file. So use with caution.

  The even more opportunistic way is to simply do type SECDRV.sys | more, make sure the first two letters are MZ and look for PE usually all by itself on a line about a screen down of This program cannot be run in DOS mode. and see if you can find L or d two lines down from it.

  1. If the letter is L then the PE file is probably 32-bit (L is 0x4c in ASCII).
  2. If the letter is d then the PE file is probably 64-bit (d is 0x64 in ASCII).
  

• Enable test signing boot mode.

  bcdedit /set "{current}" testsigning on
  

• Pick a subject - any subject, but include the text "SECDRV" in it

  $Subject = "SECDRV.sys Published by \\$env:ComputerName\$env:UserName on $("{0:yyyy-MM-dd HH:mm}" -f [datetimeoffset]::Now)"
  

• Create a root certificate. 

  # try this
  makecert -r -sr LocalMachine -ss My -n $Subject
  # if it doesn't work, use this
  makecert -r -sr LocalMachine -ss My -n "CN=$Subject"
  

• Open Local Machine Certificates.

  certlm.msc
  

• Go to Personal, Certificates and select the certificate created, there usually is only one, or match the subject, right click Copy.

• Go to Trusted Root Certification Authorities, Certificates. Paste.

• Go to Trusted Publishers, Certificates. Paste.

• Make a text file called SECDRV.cdf in the folder and put the text between @" and "@ in it.

  Set-Content -Path SECDRV.cdf -Value @"
  [CatalogHeader]
  Name=SECDRV.cat
  PublicVersion=0x1
  EncodingType=0x00010001
  CATATTR1=0x10010001:OSAttr:2:6.0
  [CatalogFiles]
  <hash>SECDRV=SECDRV.sys
  "@
  

• Make a driver catalog file in the folder.

  makecat -o SECDRV.txt -r SECDRV.cdf
  

• Get the thumbprint of the certificate you created. The thumbprint is shown in certlm for the certificate created, just double click it and look around, without spaces. Or get it in PowerShell with dir:

  $Publishers = dir Cert:\LocalMachine\TrustedPublisher | where HasPrivateKey | sort NotAfter
  $Publishers | select Thumbprint, NotBefore, NotAfter, Subject
  $Publisher = $Publishers | select -Last 1

• Sign the driver.

  signtool sign /sm /s TrustedPublisher /sha1 "$($Publisher.Thumbprint)" /t http://timestamp.digicert.com secdrv.cat
  

  If you get SignTool Error: No file digest algorithm specified. (...) use the /fd certHash option., run this instead

  signtool sign /sm /s TrustedPublisher /sha1 "$($Publisher.Thumbprint)" /fd SHA256 /t http://timestamp.digicert.com secdrv.cat
  

• Install the driver. This adds it to the driver catalog on your system, but does not copy files or create driver services.

  signtool catdb /u secdrv.cat
  

• Just to be sure, overwrite the SECDRV.sys referred to by the kernel driver service with the exact version that you signed and installed.

  sc.exe qc secdrv
  

  If the output has something like \??\C:\Windows\system32\drivers\SECDRV.sys, copy that path excluding \??\ and use it in the next command:

  copy .\SECDRV.sys "C:\Windows\system32\drivers\SECDRV.sys"
  

• Reboot.

• Test if it works.

  sc.exe start secdrv
  

If it doesn't work, check these reasons.

• You are not an Administrator or you opened the PowerShell prompt without elevation. Right click the button in the Task Bar and hit Run as Administrator and start over.
• SECDRV.sys is too old. Then the driver doesn't start. Right click it, hit Properties, go to Details and check Product version. It contains a date as a string. If you downloaded it from the link above, the version is "SECURITY Driver 4.03.086 2006/09/13".
• SECDRV.sys is 32-bit and your Windows is 64-bit. Download SECDRV.sys from the link given.
• SECDRV.sys is 64-bit and your Windows is 32-bit. Then don't download the driver from the link given, but use whichever version came with the game you installed. Also you shouldn't have started following this guide in the first place.
• You might have to run games that need SECDRV as Administrator. The driver might not be installed and the driver services might not be present until you have tried this.
• Secure Boot is enabled. Run bcdedit again after disabling it.
• You didn't reboot. You will have to reboot.

Now play games.

pssecdrv's Issues

SECDRV failing to install while signing the driver

I was able to go through all the steps without any error but it fails during the signing process.

[SC] StartService: OpenService FAILED 1060: The specified service does not exist as an installed service.

Hi, I'm on Win 10 Enterprise LTSC N latest. Tried your guide:
Got cert installed. Copied secdrv.sys from pulled github link into C:\Windows\SysWOW64\drivers and C:\Windows\System32\drivers but still getting this after restart (windows in test mode):

PS C:\WINDOWS\system32> & cmd /c sc start secdrv.sys
[SC] StartService: OpenService FAILED 1060:

The specified service does not exist as an installed service.

PS C:\WINDOWS\system32>

SECDRV.sys Self-Sign - Need help with adding Environment Variable Path

Greetings, I need some help with the instructions for setting the SDK Tools Path in the System Environment Variable path to perform self-sign of secdrv.sys driver as noted here:
https://github.com/ericwj/PsSecDrv

In the instructions it states, "Find makecat.exe, makecert.exe and signtool.exe and add the path to your PATH in System Properties, Environment Variables.
The ones in a x86 subfolder are always OK on all Intel architecture chips. No need to match the hardware or the OS bitness."

However, for (makecat.exe, makecert.exe and signtool.exe), the path is "C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86"

Q: What is the $SdkToolsPath referenced below used for?
Q: Is this $SdkToolsPath below required or can I simply add the path (above) to System EV?

Note: if I execute the command script below within PS, the command completes but it does not update the System EV Path so I'm confused on how to use the $SdkToolsPath below.

Q: How do I use the $SdkToolsPath referenced below?

$SdkToolsPath = dir -Path "${env:ProgramFiles(x86)}\Windows Kits\10" -Recurse -Directory | where { $n = $.FullName; $.BaseName -eq "x86" -and [System.IO.File]::Exists("$n\makecert.exe") -and [System.IO.File]::Exists("$n\makecat.exe") -and [System.IO.File]::Exists("$n\signtool.exe") } | sort CreationTime | select -Last 1
$env:Path = "$env:Path;$($SdkToolsPath.FullName)"

Thanks.

SignTool Error: Invalid SHA1 hash format: /t

Hello, I followed your tutorial to the letter, but at

part i get

and I don't knnow why.After I wen to look trough closed Issues to see If someone else got the same problem and got it solved, but only found a perculiar issue at #5 where appearantly user got a different output in PowerShell at command

for him PowerShell returned with

but for me it's

and I seriously dunno what to do and would rreally appreciate if you could enlighten me where I go worng. If you need more information please let me know.

Please help - SECDRV Isn't being created

Hi,

I don't seem to be able to successfully complete these steps (I've done it once, somehow), but ever since, it's not worked for me.
Typically, all the steps seem to go through ok, but after the reboot there is no SECDRV Service Installed and no SECDRV Reg Key.

1. Installed the SDK, left default installation directory.
2. Open PS as Admin and run

$SdkToolsPath = dir -Path "${env:ProgramFiles(x86)}\Windows Kits\10" -Recurse -Directory | where { $n = $_.FullName; $_.BaseName -eq "x86" -and [System.IO.File]::Exists("$n\makecert.exe") -and [System.IO.File]::Exists("$n\makecat.exe") -and [System.IO.File]::Exists("$n\signtool.exe") } | sort CreationTime | select -Last 1
$env:Path = "$env:Path;$($SdkToolsPath.FullName)"

Result

3. Create the Folder in Downloads and set working directory, both work.

4. Download the SECDRV.sys file from GitHub. Success.

5. Enable Test Signing. Success.

6. This is where I think it's falling down. Pick a Subject. I simply leave it as default.

$Subject = "SECDRV.sys Publisher by \\$env:ComputerName\$env:UserName on $("{0:yyyy-MM-dd HH:mm}" -f [datetimeoffset]::Now)"

7. Then I attempt to make the root cert, slightly modified code.

makecert -r -sr LocalMachine -ss My -n "CN=$Subject"

8. Copied created cert to Trusted Root and Trusted Publishers.

9. Create SECDRV.cdf - Seemingly successful. I.e, it created the file in the working directory.

10. Driver Catalog also created

11. Gather Thumbprint, then sign the driver. No changes to any code made.

12. Install the driver

Then, I reboot.

What am I doing wrong to not get this working again? PLEASE HELP!

How to generate and use a self-signed certificate

Hello,

Some commands don't work, so I searched a solution on internet, but it's difficult to understand how to fix the problem because I don't know how to use Powershell.

When I type :
makecert -r -sr LocalMachine -ss My -n $Subject
it shows :
Error: Can't create the key of the subject ('JoeSoft') Failed

When I type :
signtool sign /sm /s Root /sha1 "$($Publisher.Thumbprint)" /t "http://www.aloaha.com/wi-software-en/aloaha-timestamping-server.php" secdrv .cat
It shows :
SignTool Error: Invalid SHA1 hash format: /t

Could you help me please ?

"A certificate was explicitly revoked by its issuer."

I have retried everything from the very beginning of the instructions twice now and I still get this error when running sc start secdrv at the very end.

[SC] StartService FAILED 2148204812:

A certificate was explicitly revoked by its issuer.

On latest version of Windows 11. I don't what I am doing wrong.

Windows 10 seems to be deleting secdrv.sys automatically now

I went through all the steps to re-enable secdrv through powershell, and appeared to have the desired result, but upon reboot, secdrv.sys simply disappears from the system32/drivers folder, and the service can't be found.

Install-SecDrv fails

When launching command Install-SecDrv it throws an error:

Install-Package : Не удалось найти поставщики пакетов (PSModule).
C:\Users\root\Documents\WindowsPowerShell\Modules\SECDRV\SECDRV.psm1:198 знак:9

•     Install-Package -Name ($PswuSpec.ModuleName) -ProviderName PS ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidArgument: (Microsoft.Power....InstallPack
    age:InstallPackage) [Install-Package], Exception
  • FullyQualifiedErrorId : UnknownProviders,Microsoft.PowerShell.PackageMan
    agement.Cmdlets.InstallPackage

The required package PSWindowsUpdate could not be obtained. This may be due to
connectivity problems, or a version conflict. Try again later.
C:\Users\root\Documents\WindowsPowerShell\Modules\SECDRV\SECDRV.psm1:201 знак:1
3

•         throw "The required package PSWindowsUpdate could not be  ...
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (The required pa...ry again la
    ter.:String) [], RuntimeException
  • FullyQualifiedErrorId : The required package PSWindowsUpdate could not b
    e obtained. This may be due to connectivity problems, or a version conflic
    t. Try again later.