# msnightmare/signdrop architecture

> Architecture diagram of the GitHub repository msnightmare/signdrop, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/msnightmare/signdrop
- Repository: https://github.com/msnightmare/signdrop

## Overview

SignDrop is a Windows local-privilege-escalation proof of concept. Its principal workflow prepares a CLFS log/container and symbolic-link redirection, then invokes Windows Defender’s signature-update RPC so the privileged process opens the prepared container; the README describes the resulting SYSTEM-level impact. The implementation is concentrated in SigDrop.cpp, with windefend_h.h providing generated Defender RPC declarations. The excerpts show only parts of the PoC, so some detailed setup and completion steps are represented only where the README documents them.

Main entry points: [`SigDrop.cpp`](https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp) (SignDrop PoC), [`windefend_h.h`](https://github.com/msnightmare/signdrop/blob/main/windefend_h.h) (Defender RPC declarations), [`resource.h`](https://github.com/msnightmare/signdrop/blob/main/resource.h) (Embedded payload ID)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_poc["PoC workflow"]
  node_poc["SignDrop PoC<br/>[SigDrop.cpp]"]
  node_clfs_setup["CLFS setup<br/>[SigDrop.cpp]"]
  node_redirect["Symbolic-link redirection<br/>[SigDrop.cpp]"]
  node_oplock["Oplock coordination<br/>[SigDrop.cpp]"]
  node_rpc_call["Defender RPC call<br/>[SigDrop.cpp]"]
end

subgraph group_windows["Windows components"]
  node_rpc_contract["Defender RPC declarations<br/>[windefend_h.h]"]
  node_defender["Windows Defender"]
  node_clfs["CLFS driver"]
end

subgraph group_artifacts["Files and outcome"]
  node_container["CLFS container files"]
  node_auth_file["Authentication file"]
  node_resource_id["Embedded payload ID<br/>[resource.h]"]
  node_system_shell["SYSTEM shell outcome"]
end

node_operator(("PoC operator"))

node_operator -->|"runs"| node_poc
node_poc -->|"prepares"| node_clfs_setup
node_clfs_setup -->|"opens device"| node_clfs
node_clfs_setup -->|"creates"| node_container
node_redirect -->|"redirects paths"| node_container
node_poc -->|"sets up"| node_redirect
node_poc -->|"requests"| node_oplock
node_poc -->|"starts worker"| node_rpc_call
node_rpc_call -->|"uses procedure"| node_rpc_contract
node_rpc_call -->|"calls update RPC"| node_defender
node_defender -->|"opens as privileged process"| node_container
node_clfs -->|"creates signature"| node_auth_file
node_poc -->|"looks up payload"| node_resource_id
node_poc -->|"achieves elevation"| node_system_shell

click node_poc "https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp"
click node_clfs_setup "https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp"
click node_redirect "https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp"
click node_oplock "https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp"
click node_rpc_call "https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp"
click node_rpc_contract "https://github.com/msnightmare/signdrop/blob/main/windefend_h.h"
click node_resource_id "https://github.com/msnightmare/signdrop/blob/main/resource.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_poc,node_clfs_setup,node_redirect,node_oplock,node_rpc_call toneBlue
class node_rpc_contract,node_defender,node_clfs toneAmber
class node_container,node_auth_file,node_resource_id,node_system_shell toneMint
class node_operator toneIndigo
```

## Components

### PoC workflow

- [SignDrop PoC](https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp): `SigDrop.cpp`
- [CLFS setup](https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp): `SigDrop.cpp`
- [Symbolic-link redirection](https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp): `SigDrop.cpp`
- [Oplock coordination](https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp): `SigDrop.cpp`
- [Defender RPC call](https://github.com/msnightmare/signdrop/blob/main/SigDrop.cpp): `SigDrop.cpp`

### Windows components

- [Defender RPC declarations](https://github.com/msnightmare/signdrop/blob/main/windefend_h.h): `windefend_h.h`
- **Windows Defender**
- **CLFS driver**

### Files and outcome

- **CLFS container files**
- **Authentication file**
- [Embedded payload ID](https://github.com/msnightmare/signdrop/blob/main/resource.h): `resource.h`
- **SYSTEM shell outcome**

### Other components

- **PoC operator**

## Connections

- PoC operator → SignDrop PoC: runs (evidence: `README.md`)
- SignDrop PoC → CLFS setup: prepares (evidence: `SigDrop.cpp`)
- CLFS setup → CLFS driver: opens device (evidence: `README.md`)
- CLFS setup → CLFS container files: creates (evidence: `SigDrop.cpp`)
- Symbolic-link redirection → CLFS container files: redirects paths (evidence: `README.md`)
- SignDrop PoC → Symbolic-link redirection: sets up (evidence: `SigDrop.cpp`)
- SignDrop PoC → Oplock coordination: requests (evidence: `SigDrop.cpp`)
- SignDrop PoC → Defender RPC call: starts worker (evidence: `SigDrop.cpp`)
- Defender RPC call → Defender RPC declarations: uses procedure (evidence: `SigDrop.cpp`)
- Defender RPC call → Windows Defender: calls update RPC (evidence: `SigDrop.cpp`)
- Windows Defender → CLFS container files: opens as privileged process (evidence: `README.md`)
- CLFS driver → Authentication file: creates signature (evidence: `README.md`)
- SignDrop PoC → Embedded payload ID: looks up payload (evidence: `SigDrop.cpp`)
- SignDrop PoC → SYSTEM shell outcome: achieves elevation (evidence: `README.md`)