Not Compatible with HVCI (Core Isolation)

[DastardlyDino]

Cannot install this program. I get an error message that says "This program is not compatible with HVCI (Core Isolation)."

[tnodir]

Yes, you have to disable the Core Isolation to run this program.

See https://www.tomshardware.com/how-to/disable-vbs-windows-11

[DastardlyDino]

But that will make my computer more vulnerable to malware. No other program I have installed so far seems to have an issue with HVCI. Why does this one?

[tnodir]

It's due lack of resources to buy new EV certificate to sign the driver.

[DastardlyDino]

Got it. That's understandable. Thank you for the explanation.

[Lordvader81]

How much would a new EV certificate cost ?
you should ask for donations ?? .... I would Donate towards the cause !!

[tnodir]

Next step is to remember how to work with MS Portal and sign the drivers...

It's a complete mess :(

I've used the "Attestation signing of Windows device driver: An unofficial guide" article in 2021, but MS reorganized the process and it's different now.

[tnodir]

https://dennisbabkin.com/blog/?t=how-to-get-a-certificate-to-code-sign-windows-kernel-drivers
"But what seemed like a simple process - to create an account at that portal - turned into a multi-day headache."

I didn't figure it out still ((

[ManchurianPear]

sorry to hear about the pain! No worries, and maybe with time and input from others (I have no knowledge in this area), there might be an easier info path to follow

[nidhoggr-nil]

dang, too bad there's not a "let's encrypt" for windows. I think a LLM would be more help than me https://www.perplexity.ai/search/how-to-sign-IcSq9gytS1ijn_Bn51ez_w . But I'm sure you've already read half of the known material in the universe about it. I've never had to sign up to be a "microsoft partner" though 🤔

[JReming85]

The license is also not cheap, and would have to be renewed yearly I believe.

Thanks for not just trying to use one of the hacked/leaked certs as well.

[Lordvader81]

Awesome!! ... Let us know when it's done ✅👍

…

On Thu, Feb 22, 2024, 6:16 AM Nodir Temirkhodjaev ***@***.***> wrote: OK, I have the EV cert now. Next step is to remember how to work with MS Portal and sign the drivers... — Reply to this email directly, view it on GitHub <#108 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A4VBV276IBE4V52B7SV7OPDYU4ZJJAVCNFSM6AAAAAA2ES7XPKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DKNJWGA4TO> . You are receiving this because you commented.Message ID: ***@***.***>

[Kikimahe]

Hi,

Are there any updates here?

I installed Fort Firewall to test it and loved it. 👍

But I can't keep Core isolation disabled.
I wanted to activate it and my laptop displayed a BOSD on startup and I had to uninstall Fort Firwall. :'(

I hope this certification issue will be resolved soon.

[roswitina]

Any News to HVCI?

[tnodir]

Not yet. Was busy with other things..

[Lordvader81]

This issue is almost a year old, and was attributed to a lack of resources, among other things. Tnodir appeared responsive, claiming to have purchased the necessary certificate and began integrating it into the application. However, he later expressed difficulties in implementation, describing it as a headache, and it appeared as though he abandoned the Idea. It raises the question: why would one invest in a $300 certificate and then not integrate it, especially when it could attract more users and enhance the application's security? It leads to speculation that perhaps the certificate was never purchased ??? ... I don't understand why an asshat like Henry++ can get Core Iso working on his app but nor Tnodir....😢

[tnodir]

1. EV certificate should be bought for a company.
2. I've bought it for my friend's company after his confirmation.
3. I've stuck in MS Partner Account registration for now (it gets complicated that I don't want bother my friend).
4. I'll have to go through this sooner or later anyway.

[tnodir]

Simplewall does not need in EV Certificate, because it does not have a custom driver.

[roswitina]

I don't want to run my computer without HVCI. I would like to try your product, but I can't at the moment for the reason stated. As it is not clear from the record when they intend to realise this, I will probably have to look elsewhere. What a pity.

[JReming85]

It's not the same but you can try Malwarebytes windows firewall control.

Or PortMaster, it's like a system level and/or per app DNS/Adblock + FW +Data monitor

[Vasil3333]

This is a huge problem.
You can't install the firewall on Windows 11 because the driver is not signed.
Either you must sign the driver or make a version of the firewall without kernel driver.
Windows 10 is EOL in a year , most people will use Windows 11.
You can't disable HVCI because there are many applications (including games like Valorant, League of Legends etc) , that if you have HVCI disabled on Windows 11 it wont allow you to run those applications.
I would personally choose the route of making a version without the kernel driver since you will have to constantly pay money for the certificates if you choose the option to have a kernel driver.

[tnodir]

I'm still stuck in registration page. Same as in this comment.

[JReming85]

Not sure if its the same issue as they have with their azure dev accounts, but people report VPN to different countrys can get around it.

I think it was a different error on that sign up, but they were randomly disabling certain countries.. I am guessing abuse for vm resources

[ags1234]

Using Microsoft Windows 11 Pro Build 26100.2033

The only way I could disable HVCI was through Group Policy Editor policy modification.

1. Start - cmd - gpedit.msc
2. Computer Configuration > Administrative Templates > System > Device Guard
3. Turn On Virtualization Based Security ==> Disabled
4. Apply, OK

No need to restart.
Fort installed fine after this.

System information still says "Virtualization-based security Running".