search

mandiant / flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Apache License 2.0
1.76k stars 356 forks source link

WinDivert error 577, Windows cannot verify digital signature #55

Closed strictlymike closed 6 years ago

strictlymike commented 6 years ago

When you start FakeNet-NG, you see the following error:

ERROR: Failed to open a handle to the WinDivert driver: [Error 577] Windows cannot verify the digital signature for
this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged,
or that might be malicious software from an unknown source.

This is an issue relating to WinDivert (as opposed to FakeNet-NG), but as it impedes using FakeNet-NG, I am documenting it here.

It appears that new Windows driver signing practices are at issue here. See this comment from the WinDivert Driver Signing discussion. For me, it was sufficient to bring my VM out of isolation, run Windows Update, and then retry. The updated VM ran FakeNet-NG without any Windows driver signing error.

Thanks to @garsim for noticing this as well, and @tankbusta for noting the relevant conversation about the issue including the work-around.

strictlymike commented 6 years ago

This ticket was logged for documentation purposes and will be closed.

tankbusta commented 6 years ago

If you're also trying to run fakenet on windows 10 v1607+ and have secure boot enabled, you'll also have difficulties loading the driver due to requirement changes.

see https://blogs.msdn.microsoft.com/windows_hardware_certification/2016/07/26/driver-signing-changes-in-windows-10-version-1607/