[Brock]

I assume there are definitely more that could freeze the system up, this is exactly why I incorporate core system driver loading allowance. And yes, it seems that other drivers such as kmixer.sys denying can also potentially lock the system up too from what I noticed in my own testing. It seems legacy drivers are the main drivers with issues from first glance? Vga.dll seems to be the main perpetrator at large however :lol:

[EP_X0FF]

In my test multiple blocking of kmixer.sys has no effect to system. Probably something network related or third-party software with their drivers can also affect system.
A configurable whitelist may solve this problem.

[Brock]

Agreed.

[kmd]

hi
i was playing with samples from zero access thread and found imagepath spoofing not handled by drvmon. bug?

[EP_X0FF]

Hello,

This kind of spoofing is not handled by current available 1.2 version. As well as load-from-header.
All these resolved in v2.0 that is ready for about 1 month.

Screenshot below indicates ZA capture and load block.



Link to VT result of serial.sys (http://www.virustotal.com/file-scan/rep ... 1308911554)

[xqrzd]

I'm not sure if this is real, but would DrvMon be able to block this: http://crowdleaks.org/hbgary-inc-workin ... me-magenta? Supposedly it is able to bypass PsSetLoadImageNotifyRoutine.

[EP_X0FF]

I'm not sure if this is real, but would DrvMon be able to block this: http://crowdleaks.org/hbgary-inc-workin ... me-magenta? Supposedly it is able to bypass PsSetLoadImageNotifyRoutine.

Aside of fairy tales from Hoglung (btw how does his "security" business right now?) the Hint inside this article is technically incorrect. Callbacks called always right before transferring control to image entry point. To work and be "invincible" this super driver still needs to be loaded first.

Probably in this article he meant something like AVG Antirootkit (whose detection rely only on callbacks) which is piece of crap.

[xqrzd]

I also thought the hint was wrong, how could returning an error from DriverEntry bypass the callback when DrvMon patches the DriverEntry to return error.
thanks for the info :)

[Tigzy]

I got a question for you.You use PsSetLoadImageNotifyRoutine to get informed about Driver loading, but how can you forbid this cause this is only a callback, not a hook?
Excuse me if the answer is obvious for you... :)

EDIT: Maybe by altering the file?

[EP_X0FF]

http://www.kernelmode.info/forum/viewto ... 6513#p6513