A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #32519  by pointer
 Fri Jan 25, 2019 4:23 pm
I already saw in several Questions/Answers in some foruns that says that not is possible write to any SSDT tables no Windows x64 here, are some:

* Hook ZwTerminateProcess in x64 Driver (Without SSDT)

* Is there a kernel-mode callback for LdrLoadDll?

* Kernel Patch Protection

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

Already in others places i saw that is used a "bypasser" on KPP, here are one:

* What is PatchGuard?

Then based in these diferents versions of facts, what is really what antivirus software developers make to write on SSDT tables on Win x64 with success without any lock by KPP? How they are able to this really?

I think that this is a question that many kernel developers want know, how this happens truly. :)

Thx :D
 #32527  by EP_X0FF
 Sun Jan 27, 2019 2:40 pm
Patchguard in win7 doesn't check some areas. As far as I remember inline hooking of win32k table was used by sandboxie before. Microsoft closed this in Win8. http://www.kernelmode.info/forum/viewto ... =14&t=2416

As for your links:

1) https://stackoverflow.com/questions/205 ... thout-ssdt
Answer is ObRegisterCallbacks.

2) https://stackoverflow.com/questions/256 ... ldrloaddll
Answer posted in that thread.

Everything else is useless spam.
 #32531  by pointer
 Sun Jan 27, 2019 6:33 pm
EP_X0FF wrote: Sun Jan 27, 2019 2:40 pm Patchguard in win7 doesn't check some areas. As far as I remember inline hooking of win32k table was used by sandboxie before. Microsoft closed this in Win8. http://www.kernelmode.info/forum/viewto ... =14&t=2416

As for your links:

1) https://stackoverflow.com/questions/205 ... thout-ssdt
Answer is ObRegisterCallbacks.

2) https://stackoverflow.com/questions/256 ... ldrloaddll
Answer posted in that thread.

Everything else is useless spam.
@EP_X0FF, thank you by point me a direction logical and truly. Doubt solved! :D