A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #16954  by Tigzy
 Sun Dec 02, 2012 10:27 am
Run service->application combo with service configured to restart on any error.
I was not aware of that. That could do the trick indeed!
Service is responsible for running your main tasks and restarting your application, while your application only provides GUI (requestedExecutionLevel = asInvoker) for manipulating some service features like for example scan.
Yeah, the layered design I wanted to use is something similar. Doing the processing in service, while gui is only for user configuration (and is weak)
Protect service registry keys by removing current user from ACL
Wanted to use the Cm callback which is available since XP.

I don't want to use undocumented, this is for commercial product.
PatchGuard won't allow you do this.
Patchguard on XP? :)
 #16957  by EP_X0FF
 Sun Dec 02, 2012 12:38 pm
Tigzy wrote:
Protect service registry keys by removing current user from ACL
Wanted to use the Cm callback which is available since XP.

I don't want to use undocumented, this is for commercial product.
What is undocumented here? ACL?
Patchguard on XP? :)
Imagine that, since it was introduced with x64 Windows 2003 SP1 which kernel is also used in x64 Windows XP.
 #16959  by Tigzy
 Sun Dec 02, 2012 1:14 pm
What is undocumented here? ACL?
No. I speak generally, not about what you said.
Imagine that, since it was introduced with x64 Windows 2003 SP1 which kernel is also used in x64 Windows XP.
Yeah, Agreed. But as I said, no hooks, so there will be no problem.
 #16961  by EP_X0FF
 Sun Dec 02, 2012 1:58 pm
Tigzy wrote:
What is undocumented here? ACL?
No. I speak generally, not about what you said.
There is nothing undocumented in what I posted. CreateProcess or better CreateThread notify MSDN documented, routines to work with SID/ACL/ACE also.