Disabling BCD testsigning option using registry

Question

My code should disable testsigning BCD option using Windows registry. The same as command line bcdedit -set testsigning off.

I can't do shellexecute with cmd. I found one Testsigning reference in registry, in HKLM\SYSTEM\ControlSet001\Control\SystemStartOptions value, but this value contains current kernel run options, not options for next start.

So, I can't use it.

I found that testsigning option are saved in HLKM\BCD00000000\Objects\{%GUID%}\Elements\16000049, but this GUID is different on different PC's.

How I could acquire it?

Answer 1

If you don't bother of activating it for all boot entries:

• Enumerate all key names beneath "Objects"
• Write your registry values in a loop into every found key name.

Using NT native API your approach could look something like the following pseudocode:

while(numEntries < index){
    NtEnumerateKey(index++, &pGuidKeyname...);
    RtlStringCbPrintfW(buf, %s, rootkey,pGuidKeyname);
    NtSetValueKey(buf, "YES");
}