How hfiref0x/dsefix works
DSEFix is an x64 Windows utility that attempts to disable Driver Signature Enforcement and can restore its default setting with -e. Its documented approach uses a vulnerable VirtualBox kernel driver to modify the version-specific Code Integrity setting. The excerpts show driver loading and IOCTL setup, but omit parts of the command and patch routines; those links are limited to the documented workflow and explicit function responsibilities.
Main entry points: main.c Program entry · cui.c Console output · vboxdrv.h VBox driver image · sup.c Driver file utilities
Components 16
Command interface
- Program entry
Source/DSEFix/main.c - Command processing
Source/DSEFix/main.c - Console output
Source/DSEFix/cui/cui.c
Driver access
- Driver lifecycle
Source/DSEFix/main.c - VBox driver image
Source/DSEFix/vboxdrv.h - Driver file utilities
Source/DSEFix/sup.c - VBox IOCTL loader
Source/DSEFix/main.c
Integrity control
- DSE state patching
Source/DSEFix/main.c - Code Integrity state
Runtime support
- x64 instruction decoder
Source/DSEFix/hde/hde64.c - System information
Source/DSEFix/sup.c - NT API definitions
Source/DSEFix/ntdll/ntos.h - String and argument helpers
Source/DSEFix/minirtl
Other components
- Administrator
- Windows SCM and device
- Windows kernel
Connections 16
- Administrator → Program entry: runs
- Program entry → Command processing: dispatches
- Program entry → Console output: reports
- Command processing → Driver lifecycle: starts driver
- Driver lifecycle → VBox driver image: uses image
- Driver lifecycle → Driver file utilities: backs up and writes
- Driver lifecycle → Windows SCM and device: manages service
- Driver lifecycle → VBox IOCTL loader: opens device
- VBox IOCTL loader → Windows SCM and device: sends requests
- Command processing → DSE state patching: selects operation
- DSE state patching → x64 instruction decoder: decodes instructions
- DSE state patching → Windows kernel: accesses memory
- Windows kernel → Code Integrity state: contains setting
- Command processing → System information: queries system
- Program entry → String and argument helpers: uses helpers
- Program entry → NT API definitions: uses declarations