g_CiOptions in a Virtualized World

This report analyzes methods for bypassing Windows Driver Signature Enforcement (DSE) to load unsigned kernel drivers—either by patching CI.dll's CiValidateImageHeader through direct PTE manipulation or by using vulnerable signed drivers (e.g., iqvw64e.sys) to achieve kernel read/write primitives. It shows how Kernel Data Protection (KDP) under VBS can block simple g_CiOptions overwrites, provides signature-hunting and PTE-modification PoC code to patch executable kernel pages, and explains that enabling HVCI (SLAT-enforced protections) or Attack Surface Reduction can mitigate these attacks.