Prepare Windows for the standard build

In the loader this is the Standard method. It works by first loading a legitimate, digitally signed driver, which then allows our own modules to load. Windows has several defences aimed at exactly that, and every one of them has to be out of the way first.

When you run the loader it shows a Select a load method screen listing each of these with a live indicator, so you can see at a glance which one is still wrong.

1. 1
   Open Windows Security from the Start menu.
2. 2
   Go to Device security, then Core isolation details.
3. 3
   Switch Memory integrity to Off.
4. 4
   Restart the machine. This one genuinely needs the reboot.

Skip the reboot and the loader will tell you so, with Please disable 'Memory Integrity' then reboot and try again.

If the switch is greyed out or flips back on, it is usually one of these:

• A managed device where policy enforces it. Check Settings, then Accounts, for a work or school account.
• An incompatible driver warning that has to be cleared first. Windows names the driver on that screen.
• A previous attempt that did not reboot. Restart and look again.

You can confirm the current state from PowerShell:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity' -Name Enabled

Enabled : 0 is what you want. This is the exact value the loader reads.

Microsoft's blocklist stops known-abusable signed drivers from loading, which includes the kind of driver this method relies on. The loader checks it and stops with Please disable 'Vulnerable Driver Blocklist' then reboot and try again.

1. 1
   Open Windows Security, then Device security, then Core isolation details.
2. 2
   Switch Microsoft Vulnerable Driver Blocklist to Off.
3. 3
   Restart the machine.

If that toggle is not shown on your Windows version, set the value directly from an administrator PowerShell:

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' -Name VulnerableDriverBlocklistEnable -Value 0

Reboot afterwards, then confirm:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' -Name VulnerableDriverBlocklistEnable

Two things can still be occupying the kernel before the loader ever runs, and neither shows up as a simple Windows toggle.

1. 1
   Unload Hyper-V

   Open Turn Windows features on or off and untick Hyper-V, Virtual Machine Platform and Windows Hypervisor Platform if any are ticked. Then, from an administrator prompt:

   Administrator

   bcdedit /set hypervisorlaunchtype off

   Restart. This also switches off the virtualization-based security that keeps Memory Integrity alive.

2. 2
   Unload boot anti-cheats

   Anti-cheats that start with Windows, such as Riot Vanguard, FACEIT and ESEA, load their own kernel drivers before you get a chance to spoof. Fully exit them, or set their service to manual start, and reboot. Simply closing the game is not enough.

Secure Boot lives in your BIOS, usually under a tab named Boot, Security or Authentication. The Secure Boot page has the exact menu path for ASUS, MSI, Gigabyte, ASRock, Dell, HP and Lenovo boards. Use the Turn it off steps there, not the clear-the-keys ones.

Check everything at once from PowerShell rather than clicking through three separate screens:

Confirm-SecureBootUEFI
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity' -Name Enabled
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' -Name VulnerableDriverBlocklistEnable

With all of that in place you are ready to download the loader.