[listito]

Hello, i'd like to ask you guyz about something, if it's not allowed to ssdt hook in win x64, how do av's manage to detect and forbid certain types of access?

Is there any way to forbid OpenProcess() without ssdt hooking?

[EP_X0FF]

Hello, i'd like to ask you guyz about something, if it's not allowed to ssdt hook in win x64, how do av's manage to detect and forbid certain types of access?

Is there any way to forbid OpenProcess() without ssdt hooking?

Use search next time.

http://www.kernelmode.info/forum/viewto ... 3378#p3378

[listito]

hey thanks, but i'm just thinking, how secure are these callbacks?

[EP_X0FF]

They work at object level.

[Vrtule]

listito: I think they are more secure than SSDT hooks. They do not work with handles and important buffers are already copied to the kernel memory . So, certain attacks/bypasses are not possible.

Personally, I think that hooking should be avoied whenever possible.