Post

@decoder-it.bsky.social and i noticed that it's no more possible to call NtLoadDriver pointing to an unprivileged regkey such as \REGISTRY\USER Even if you have the SeLoadPrivilege you would still require the Admin group to write the required regkey. Some more technical details below 👇

In newer ntoskrnl.exe there is a check in IopLoadDriver->IopBuildFullDriverPath->IopQueryRegistryKeySystemPath that ensure the "ImagePath" value is under a regkey prefixed with \REGISTRY\MACHINE and if not it returns 0xC00000E5

In older ntoskrnl (e.g. Win2016 1607) the function IopQueryRegistryKeySystemPath doesn't exist and the "ImagePath" value is retrieved without checks through IopGetRegistryValue(..., "ImagePath",...) in IopBuildFullDriverPath