[madaboo]

Hi,

When M$ has introduced Kernel Patch Guard and said "making hooks on kernel is bad" - did they actually provided any other solution for this?
e.g filtering files can as I understand be hadnled with minifilter drivers, but what if I need to scan registries, or I want to scan any ZwVirtualAlloc or any other thigs.. has micorsoft told also "go this way" ??

thank you.

[EP_X0FF]

but what if I need to scan registries,

CmRegisterCallback

or I want to scan any ZwVirtualAlloc or any other thigs.. has micorsoft told also "go this way" ??thank you.

Do not know purpose of NtAllocateVirtualMemory interception and what are hidden under "other things".

[rkhunter]

What task you want decide in x64? I think you should start from this issue.

[Vrtule]

Look at Kernel Data and Filtering Support For Vista SP1 document from Microsoft.

If your task is GUI-based, you can still hook in win32k.sys driver.

Why do you want to hook NtAllocateVirtualMemory?

[rkhunter]

Seems this is bad idea - hooking in ring0 at x64, especially win32k. Moreover, even if not guarded today it will be tomorrow.

[Vrtule]

Seems this is bad idea - hooking in ring0 at x64, especially win32k. Moreover, even if not guarded today it will be tomorrow.

I think that before win32k.sys starts to be guarded, Microsoft will provide some interfaces to allow HIPS systems to protect against various kinds of GUI attacks and other techniques. Some AVs/HIPS systems hook in win32k nowadys (Kaspersky, Avast, Outpost).

However, I agree that this kind of hooking is not good idea.

[madaboo]

Guys thank you for joining.

Hm.. I'm lookin' on CrRegisterCallback doc and see "Modifying output parameters is supported in Windows Vista and later." here: http://msdn.microsoft.com/en-us/library ... 85%29.aspx
My question now is: what with Windows Xp x64?

[EP_X0FF]

You can and should forget about it.

[madaboo]

EP_X0FF
Thanks for joining..

forget about it in context of x64 windows xp OR x64 at all??

[EP_X0FF]

EP_X0FF
Thanks for joining..

forget about it in context of x64 windows xp OR x64 at all??

x64 Windows XP.