Re: API Calls Hooking

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Alexander Grigoriev wrote:
No, not another kludge. There is already security in Windows. As soon as you
understand that you should not give the user administrative privileges,
everything becomes OK.


No, No, No. The official security system of Windows is yet another
rehash of the ancient user level security from the early 1970s or
before. Without additional security filtering, none of the following
can be implemented (and no, file system filters and registry filters
will NOT do the trick, as they are too far removed from the security
border and do not cover all user mode to kernel mode calls):

1. Protecting potentially buggy 4th party kernel mode code (e.g.
drivers) from receiving semantically invalid requests from user mode.

2. Enforcing policies that classify the operations (and the permissions
needed to perform them) differently than the historic division
represented by the access bitmasks defined and documented in the current
Win32 API. For instance restricting certain I/O controls which were
historically defined to be available to anyone with read access to the
device.

3. Isolating processes from each other establishing restrictions on
interprocess operations amongst unrelated processes while still allowing
the exact interprocess operations associated with normal system activity.

4. Implementing higher security levels similar to what used to be known
as "B level" security etc.

5. Restricting processes based on the code being loaded into those
processes.

6. Sandboxing untrusted processes, such as web browsers (similar to what
Vista did for IE, but differently).

"Nicolas Genen" <NicolÂs Genen@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B8BC6258-2A22-40DA-9130-CBF7A9910C0D@xxxxxxxxxxxxxxxx
I have been working on software protection making API Calls Hooking
patching
SDT table, but times changes and patching SDT isn't available anymore on
x64
systems.
There is any legitimate way to make API function Callbacks (w/ filtering)
to
make it work on x86 and x64 systems ?

Some functions that I need hook..

ZwReadVirtualMemory
ZwWriteVirtualMemory
ZwOpenProcess
ZwCreateSection
etc.




--
Jakob Bøhm, M.Sc.Eng. * jb@xxxxxxxxxx * direct tel:+45-45-90-25-33
Netop Solutions A/S * Bregnerodvej 127 * DK-3460 Birkerod * DENMARK
http://www.netop.com * tel:+45-45-90-25-25 * fax:+45-45-90-25-26
Information in this mail is hasty, not binding and may not be right.
Information in this posting may not be the official position of Netop
Solutions A/S, only the personal opinions of the author.

.

Relevant Pages

  • Re: [fw-wiz] Securing email by inhibiting urls
    ... you should implement a true URL and content filtering service.. ... Security product for web content filtering. ... I do know that we had all of the popular safeguards turned on on the McAfee ... took me personally about 40 hours to get the McAfee appliances working ...
    (Firewall-Wizards)
  • Re: Restrict by UserAgent
    ... any header data as you have noted). ... when talking about "security" it tends to be more like the ... >> more I think about it, the less effective filtering by UserAgent becomes ...
    (microsoft.public.inetserver.iis.security)
  • Re: BlackIce (with 3/2002 defs) / Sygate Pro does not detect Nimda
    ... filtering what traffic is put into the memory that BI allocates and then ... turning off all ip filters for this single program. ... or responding to single packets based on packet header information alone. ... can totally compromise your security if you fail to use it with care. ...
    (comp.security.firewalls)
  • Re: [RFC 1/1] seccomp: Add bitmask of allowed system calls.
    ... the seccomp + filter engine based filtering method does not ... itself below any existing security context, in a hierarchical way, ... sandboxing concept: under seccomp v1 the task would be able to write ...
    (Linux-Kernel)
  • Re: [fw-wiz] State of security technology for the enterprise
    ... Build in security zones, dmz, transit, low to high zones. ... Content filtering on the firewall ...
    (Firewall-Wizards)