Stuck at error 577 and error 2 when running elam executable service

[Siradankullanici]

This the moved discussion from the #61 If you want understand better please read here. I have a problem which causing 577 (cerrtifcate blocked becauuse not valid) and error 2 (file path) happens when I run from batch file. This project is awesome and very advanced but I having skill issue.

[0xflux]

Hey @Siradankullanici

I don't currently have access to my dev machine to go through and double check, I'll do my best to help from memory until I'm back with my pc!

I may have to do a dry build from a clean pull also to verify. But:

1. Create the ELAM certificate with the cert.ps1 file in the driver crate. That will generate a correct certificate you'll want to keep in the driver crate.

2. Double check the cert hash matches that in the build.rs file for the driver, as that hash is needed for the resources section of the driver to validate the PPL service.

3. Open Developer Command Prompt as admin and cd into the driver crate, and run: cargo make

4. Once built, assuming your ELAM certificate is in the /driver crate, you can run sign.bat from /driver (in developer command prompt) and it should successfully sign the driver.

5. From the parent directory (aka the workspace root) run cargo build -p sanctum_ppl_runner --release

6. From that directory, you can sign the ELAM with the .ps1 script that will look for the service binary in /target.../release/sanctum_ppl_runner.exe.

7. Build the tauri app (I think its cargo tauri build dev, a google will help you if that's wrong), um_engine, injected_dll and elam_installer.

8. You'll need to rename injected_dll.dll to sanctum.dll

9. in your dev VM, enable test signing and debug mode, reboot

10. You'll need to create %AppData%/Sanctum, and drop the ioc.txt in there, and drop the DLL, sanctum_ppl_runner, and driver also.

11. Drop the elam_installer, gui and um_engine in a dir of your choosing (I use desktop/sanctum)

12. with elevated poweshell run ./elam_installer.exe, then sc start sanctum_ppl_runner

13. you should now be able to launch the gui app (as admin) and also run um_engine (as admin).

I realise this is a lot of setup. When I am next able to work on the project (next week) I'll look as a priority to simplify this process - preferable with an install script for first time setup, and maybe see how I can streamline the build process.

Let me know if any of that worked / or if it didn't where you got stuck at, and I'll be able to advise further :-)

[Siradankullanici]

I now tried to compile at VM at stuck at stage 12. It seems lke error 577 still happening even if bcdedit testsigning enabled on 24H2

[Siradankullanici]

certmgrresults.txt

[0xflux]

Interesting; I'm taking a look at this today (back from holiday), so I'll try get an init powershell script setup that should hopefully at least build the vm environment correctly, and perhaps another for the build side :)

[0xflux]

@Siradankullanici Also, I cant see it anywhere - did you try run the driver in isolation via sc?

[Siradankullanici]

I using VM for this because when I use non vm I can't delete service without manually removing it.

[0xflux]

Yeah, definitely use a VM for this - you don’t want to BSOD your host from a bug :'). Did you try run the driver as advised above via sc in isolation though? That will help pin down if its an issue with the elam program, cert, or something else weird going on for you.

I'm just building a fresh VM now, and got a fresh clone from git of my project, so hopefully I'll be able to replicate the steps and see if i run into the same issue as you :)

[0xflux]

@Siradankullanici Ok I got this for you!

What you need to do, on your host (or wherever you cloned this repo) do the following

In a developer cmd prompt, navigate to the driver crate.

Run:

• cargo clean
• cargo make
• .\sign.bat
• certmgr.exe -v target\debug\sanctum_package\sanctum.sys

Now with the output of certmgr, look for:

Content Hash (To-Be-Signed Hash):: (it will be just above the half way point of the output)

For example, mine now looks like:

Content Hash (To-Be-Signed Hash)::
     0E 86 BB 91 27 84 61 81 F7 1D C8 05 A9 27 7C 2E    '....'.a......'|.'
     CB A9 3A 79 14 EB C0 E5 BA 71 1C 68 12 7A C9 5E    '..:y.....q.h.z.^'

So; you take those bytes and concatenate them. In the driver build script (`driver/build.rs) you will see:

    // Generate the ELAM `.rc` file dynamically
    let elam_rc_content = r#"MicrosoftElamCertificateInfo  MSElamCertInfoID
    {
        1,                        
        L"0E86BB9127846181F71DC805A9277C2ECBA93A7914EBC0E5BA711C68127AC95E\0", // To-Be-Signed Hash
        0x800C,                   
        L"\0"                     
    }"#;

Replace 0E86BB9127846181F71DC805A9277C2ECBA93A7914EBC0E5BA711C68127AC95E with the concatenated hash output you got above. See how mine now in this instance is the same as my output from certmgr above?

Once you have replaced that hash, do a cargo clean, cargo make ,.\sign.bat for the driver. Copy the new driver file over to your Vm in %AppData%\Sanctum, then reboot (if required) and in an admin powershell run elam_installer.exe and it should now work for you :)

I have done the above in my clean VM and it works. I did import my cert into the cert manager in the VM, but I dont think this is required. If you still have difficulty, please let me know. I'm going to rewrite the readme for this project as its long overdue, but I will possibly do a youtube video on deploying this project to a VM given its rather complex.

If this worked, please mark as complete. Thanks for your discussion too - I will work on improving the repo for people to actually use (there is an open issue for it from somebody else), and I will try move anything that is currently janky to an experimental branch so at least the main branch will be stable :)

Edit

If this is the first time getting it all running (likely will be) - you may notice your sanctum_ppl_runner service will error when starting (do so via service manager to spot the error dialogue). Reboot your PC after getting it to run the first time (I'll raise an issue to 'fix', it does something which requires a reboot).

You also may not have the required child process in your %AppData%\Sanctum folder that spawns from the ppl runner; again, ill put an issue in to fix this as the child process is no longer required. Just some legacy stuff I did whilst messing about with it. I've fixed the child process thing, so ill push some changes to the main branch today, and I will introduce a change log also for the main branch in terms of stability, more so for updates which may affect a clean install / need some manual adjustment between releases.

[Siradankullanici]

Mine one still:
Content Hash (To-Be-Signed Hash):: 90 3E 53 1C 8B EF 7C 2D 63 1B A6 92 72 06 B0 73 '.>S...|-c...r..s' 23 8F 0F 44 89 52 7D DD E2 67 F2 DC 2F D5 1D CC '#..D.R}..g../...'
Like that. Which version of Windows did you use?

[0xflux]

Hmm, weird. Delete the cert: sanctum.pfx in the driver crate, and re-run cert.ps1. Do a cargo clean of the driver and try again see if you get a different To-Be_signed hash on the sanctum.sys driver, the hash on my clean clone was different to the one I had previously used (ending 1DCC as yours does there).

My host is Windows 11 23H2 where I create the cert.

I dont think this should matter, but for good measure, try add the .pfx to the cert manager in your vm. Drop the cert into a folder on your VM and run:

$pwd = ConvertTo-SecureString -String "password" -AsPlainText -Force

Import-PfxCertificate -FilePath sanctum.pfx -CertStoreLocation Cert:\LocalMachine\Root -Password $pwd

Import-PfxCertificate -FilePath sanctum.pfx -CertStoreLocation Cert:\LocalMachine\TrustedPublisher -Password $pwd

As I say, I dont think that will be required, but might be worth trying.

[0xflux]

@Siradankullanici fyi readme updated and files updated to make the deploy process (hopefully) smoother.

[0xflux]

Added this to the issue, but video installation guide is up: https://www.youtube.com/watch?v=BFbz6ZjGitA

[Siradankullanici]

Well I mark with answer but I still get 577 in different computers for some reason. Probably doing something wrong.

[Siradankullanici]

I confirmed this general issue so I going to close discussion. Spybot ELAM installer also didn't worked on my VM.

[Siradankullanici]

I now working on Sanctum yet again but this time content hash suprsingly same with yours so I was in correct way.

[Siradankullanici]

Can't believe it but sanctum_ppl_runner is now working let's look the app.

[Siradankullanici]

Well now I get the last problematic problem he can't find the PIPE_NAME so it causing

[0xflux]

Have you started um_engine.exe as admin as well as the GUI?

[Siradankullanici]

Now it worked.

Thank you so much!