Lots of people (even technical ones) seem to be confused how things like ASUS Armory Crate and the like can just "run" in Windows after boot, without any user interaction, on a clean install.

So I figured I'd give a brief explanation:
Your BIOS/UEFI provides this thing called ACPI tables. These tables contain a lot of information the OS needs, such as how to talk to certain hardware, and even routines for things like sending the "power off" signal after shutdown.

There is an ACPI table called WPBT (Windows Platform Binary Table). On boot, Windows will read this table, if present, and literally just run the contents of the entry as a binary (after verifying its Authenticode signature). Yep, that's it, you just have an exe file in your UEFI that Windows is configured to run. Unless you set a registry entry to turn this off.

Here's the official docs for the detail hungry folk: https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx

@Doridian wtf. Who allowed this

@flafflar The same people who were upset ACPI would give advantages to Linux without them "doing any work" and wanted to block non-Windows from using it: https://en.wikipedia.org/wiki/ACPI#History

@Doridian also, for some context, the real purpose of the WPBT was to let Absolute to implement the CompuTrace persistence module without doing horribly ugly and dangerous hacks, which they were doing before: https://www.blackhat.com/docs/us-14/materials/us-14-Kamluk-Computrace-Backdoor-Revisited-WP.pdf

corporations wanted their laptops to be able to phone home if stolen even if the OS was wiped, Microsoft didn't want Absolute rawdogging NTFS and modifying system files in a BIOS option ROM, so this was the compromise.

@bhtooefr Interesting! Thanks for the context, I wasn't aware of that :3

@Doridian can the signature be spoofed? Like what's stopping me or a piece of malware from just injecting whatever exe in there?

@0x4d6165 It needs to be signed by a CA that Windows trusts (the same root store used to sign apps or drivers for Windows to my knowledge).

So yeah, you can sign it with any cert or key you want, but if it's not in Windows trusted code signing store, it won't execute it. (At least so says the spec, there might be vulnerabilities in it, who knows)

@Doridian @0x4d6165 presumably what you can do is find a vulnerable trusted driver and inject it in there and exploit it