Why it is worth attention

It introduces a novel low-level technique to bypass kernel hooks on the TPM device stack, directly reading cached TPM data to verify hardware identity, which is critical for anti-cheat and attestation systems.

Who it is for

Security researchers investigating TPM subversion and kernel-level spoofing
Anti-cheat and anti-tamper developers building hardware-backed identity verification
Windows kernel developers interested in WDF driver internals and reverse engineering
System administrators requiring robust hardware attestation for secure boot or remote validation

Use cases

Detecting cheats or malware that spoof TPM public keys to bypass hardware-based identity checks
Validating the integrity of TPM responses before relying on them for attestation or licensing
Forensic analysis to determine if a system's TPM has been tampered with by a kernel driver hook
Research and development of more resilient anti-spoofing mechanisms for gaming or enterprise security

Strengths

Uses a dual-path comparison (IOCTL vs cached) to detect hook-based spoofing that the IOCTL path cannot bypass
Directly reads internal TPM driver structures (TPM_STACK/TPM_RESMGR) to obtain the ground truth
Minimal footprint: a small WDM/WDF-style kernel driver with focused functionality
Provides a clear proof-of-concept that can be adapted for other anti-tamper scenarios

Considerations

Relies on reverse-engineered offsets into TPM.sys that may require updates per Windows build
Only works on systems with a hardware TPM 2.0 and the Windows TPM driver stack
Requires a signed kernel driver and appropriate test-signing or Secure Boot configuration for loading

README quick start

DetectTpmSpoofing

Small WDM/WDF-style kernel driver that checks whether TPM 2.0 responses on a machine have been tampered with, i.e. spoofed by a driver that hooks IRP_MJ_DEVICE_CONTROL / DeviceIoControl on \Driver\TPM.

Why

Some cheats/spoofers install a filter or hook on the TPM device stack so that TPM2_ReadPublic (and similar commands) return a forged public key/EK instead of the real one, letting them fake hardware identity to anti-cheat or attestation checks. The forged data only shows up on the IOCTL path, because the hook sits between the caller and the real TPM.

How it works

The driver gets the same TPM2_ReadPublic result two different ways and compares them:

HashTpmIoctl — opens \??\TPM directly and sends a raw TPM2_ReadPublic command via ZwDeviceIoControlFile, exactly like a userland caller would through DeviceIoControl. This is the path a hook would intercept.
HashTpmCached — walks the TPM.sys driver object, follows its WDF device context to the internal TPM_STACK / resource manager structures, and reads the cached response buffer the TPM driver already stored for handle 0x81010001 (the EK). This bypasses the IOCTL path entirely, so a hook on DeviceIoControl has no way to touch it.

Both responses get parsed (IsReadPublicRSA2048) and hashed with a small FNV-1a implementation. If both hashes come back non-zero, the driver logs whether they match. If a hook is spoofing the IOCTL response, the two hashes will differ — the IOCTL path shows the fake key, the cached path still holds the real one.

Note: the offsets into TPM_STACK / TPM_RESMGR are reverse engineered from TPM.sys and will need to be re-checked against the target Windows build if they stop matching. The WDF context type-info (_WDF_TpmStack_TYPE_INFO) is located by walking TPM.sys's PE section table for .data and assuming it sits at the start of that section — also hacky, same caveat applies.

Files

src/Driver.cpp — the driver itself (entry point, IOCTL path, cached-buffer path, comparison).
src/tpm12.h, src/tpm20.h — TCG TPM 1.2/2.0 spec structures and constants used to build/parse the ReadPublic command.

Building

Requires the WDK and Ninja/cl.exe (see CMakePresets.json).

cmake --preset x64-debug
cmake --build --preset x64-debug

Sign the resulting driver with

Related repositories

Similar projects matched by category, topics, and programming language.

Infatoshi

Featured

netherite

A from-scratch C/CUDA reimplementation of Minecraft 1.11.2 that is bit-verified against the original Java game and includes batched CUDA reinforcement learning support.

AI & Machine LearningLarge Language Models

258

nsdkinx

Featured

twell

Twell is a tiny, embeddable, zero-allocation physics engine for interruptible, Apple-style UI animations, available as a single-header C library with Python bindings.

MobileDesign & Creative

sqliteai

Featured

waste

WASTE is a C-based inference engine that streams MoE experts from disk to run a 2.78 trillion-parameter model on a consumer laptop with 64 GB RAM.

Data & DatabasesData Engineering