I had some fun automating the process of changing the Teams executable. First iterations took about 10 to 15 minutes to complete but this one does the job in about 5 seconds. You don't have to use it if you don't trust it but it sets the original EXE aside so if something wrong happens, you can just replace the resulting file from this script with the original
# Getting the filepath for Teams.exe
$FilePath = Join-Path -Path $env:LOCALAPPDATA -ChildPath "Microsoft\Teams\current\Teams.exe"
# Killing all instances of Teams.exe
Get-Process | ? { $_.Path -eq $FilePath} | Stop-Process -Force -Confirm:$False
# Get the Hex and Binary format of the option "HardwareMediaKeyHandling"
$Option = "HardwareMediaKeyHandling"
$HWMKeyHandlingHexArray = ($Option.ToCharArray() | % { [String]::Format("{0:X2}", [System.Convert]::ToUInt32($_)) }) -Join "-"
$HWMKeyHandlingByteArray = [Byte[]]($HWMKeyHandlingHexArray.split("-") | % { "0x{0}" -f $_ })
# Other needed variables
$ValueOffset = 8
$OldValue = 1
$NewValue = 0
# Get Teams as ByteArray and Hex String
$Bytes = [System.IO.File]::ReadAllBytes($FilePath);
$Hex = [System.BitConverter]::ToString($Bytes)
# Get the location of the option in de HexString
$HexIndex = $Hex.IndexOf($HWMKeyHandlingHexArray)
# Calculate the index of the hex to the index of the byte array
# Account for the dashes in the string
$Index = $HexIndex * 2 / 3
# Account for the fact that HEX makes couples of 2 characters for a byte
$Index = $Index / 2
# Build in some safety
$GotIt = $True
For ($i = 0 ; $i -lt $HWMKeyHandlingByteArray.Count ; $i++) {
If ($Bytes[($Index + $i)] -ne $HWMKeyHandlingByteArray[$i]) {
$GotIt = $False
}
}
If ($GotIt -eq $False) {
"Something went wrong calculating the exact location of '{0}'" -f $Option
Break
}
Else {
# Checking for the value of the option
$ValueIndex = $Index + $HWMKeyHandlingByteArray.count + $ValueOffset
If ($Bytes[$ValueIndex] -eq $OldValue) {
# Actually setting the value
"Changing the value of option '{0}' from {1} to {2}" -f $Option, $OldValue, $NewValue
$Bytes[$ValueIndex] = $NewValue
# Set aside the old file for if something went wrong despite the checks in this script
$File = Get-Item -Path $FilePath
$CopyFilePath = Join-Path -Path $File.DirectoryName -ChildPath ("{0}.old{1}" -f $File.BaseName,$File.Extension)
[Void](Copy-Item -Path $FilePath -Destination $CopyFilePath -Force:$False -Confirm:$False)
# Write new teams.exe
[System.IO.File]::WriteAllBytes($FilePath, $Bytes)
}
ElseIf ($Bytes[$ValueIndex] -eq $NewValue) {
"No need to update the value: '{0}' is already set to {1}" -f $Option, $NewValue
}
Else {
"Something isn't correct, the value for option '{0}' is neither {1} or {2} but {3}" -f $Option, $OldValue, $NewValue, $Bytes[$ValueIndex]
}
}
This HEX editing method is the only workable one I've found. It does **bleep** up the Digital Signature so it could get flagged by some EDRs but nothing yet from FortiEDR here.
