http://kat.lua.cz click here for tl;dr Tablets with Windows, SecureBoot, TPM and Bitlocker are all fun and games,until you want to install some free utility (such as FreeOTFE). Long story short,you have to disable Bitlocker, or buy a higher than home edition of windows (to add-pw protector so you can turn off secure boot). Bummer. There are of course other ways around this ,unfortunately the vbox exploit is not very suitable for my baytrail tablet,enforced WHQL won't even allow the driver to load. However this being an oldhat-trick, googling turned up an interesting approach ofsimply loading older, more buggy Microsoft drivers (=WHQL sig) on modern windowsto exploit, and use that to bypass DSE. We'll still keep using the same bug class, but try to find some more reliabletarget than mountmgr.sys , as dealing with trashed SYSTEM thread stack and SMEP is pretty annoying. Using RtlQueryRegistryValues bugs as a convenient copy-what-where Maybe we can do better - don't try to hijack IP control, but abuse RtlQueryRegistryValues to simply write 0 byte into CI.DLL!ci_Options , thus removing signed driver enforcement- all without running any shellcode. http://kat.lua.cz/posts/Some_fun_with_vintage_bugs_and_driver_signing_enforcement http://kat.lua.cz/posts/Some_fun_with_vintage_bugs_and_driver_signing_enforcement