Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry

From: "anton bassov"<xxx@xxxxxxx>
Date: Mon, 8 May 2006 09:18:35 -0500

Hi Don

Could you please explain the following:

/////////////////
Except that hooking does not work on 64-bit systems (unless you really hack
the kernel). Hopefully, Microsoft will respond to the requests by a number
of us and turn on the same protection in 32-bit systems also.
////////////////////////

How is it possible to prevent hooking????? Please let me know - I am going
to start thinking about workaround straight away

Anton Bassov
.

Follow-Ups:
- Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry
  - From: Don Burn

References:
- Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry
  - From: Don Burn

Prev by Date: Re: Any default message format dll in windows available?
Next by Date: Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry
Previous by thread: Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry
Next by thread: Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry
Index(es):
- Date
- Thread

Relevant Pages

Re: security enforcement - new monitor for winnt
... >produced products from 'Microsoft'. ... the security in Microsoft products, ... that is hooking a kernel system call to filter ...
(NT-Bugtraq)
Re: Any way to get RTL_USER_PROCESS_PARAMETERS at NtCreateSection entry
... Except that hooking does not work on 64-bit systems (unless you really hack ... the kernel). ... Don Burn (MVP, Windows DDK) ...
(microsoft.public.win32.programmer.kernel)
Re: X11 performance / NVIDIA driver
... > due to the fact that Microsoft runs the graphics drivers in kernel space ... > of a driver problem being able to crash the whole kernel rather than just ... the context switch of crossing the threshold between user processes ...
(comp.os.linux.x)
Re: Process notification
... > Agnitium Outpost hooks WriteProcessMemory, ... >> Using hooking in the kernel is worse than STUPID. ... >> Don Burn (MVP, Windows DDK) ...
(microsoft.public.win32.programmer.kernel)
Re: To the OP: Wintroll FUD about alleged insecurity refuted (was: Re: Linux why?)
... onto which a 32-bit Windows kernel was bolted. ... what he said was that "Windows NT is a better UNIX ... Microsoft Xenix way back when). ... The "total rewrite" of Vista was not a total rewrite at all. ...
(comp.os.linux.misc)