Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 608616" data-attributes="member: 32260">I noticed a simple mistake in my tutorial. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite118" alt=":oops:" title="Oops!&nbsp; &nbsp; :oops:" loading="lazy" data-shortname=":oops:" />I wrote:SRP have three enforcement settings:...* Skip DLLs - ignores only LoadLibrary() calls - other security layers: &#039;DFT list + ShellExecute() + CreateProcess() + LoadLibrary() + &#039;CMD Host&#039; + &#039;Windows Script Host&#039; + &#039;Windows Installer&#039; calls are not ignored....Of course LoadLibrary() should be skipped!I have to add the correction note according to COM files. There are two kinds of COM files in Windows XP+. The old type, 16Bit COM files, that can be are run in an MS-DOS-emulating subsystem NTVDM, which is present only in 32Bit Windows systems.There are also 32Bit COM files, which are simply a special type of EXE files. So in fact, ShellExecute() is invoked when running COM files, and they are monitored by SRP when COM extension is on DFT list. Of course, all EXE like file types (32Bit COM, EXE, SCR) are also protected by CreateProcess().The last thing to test: are 16Bit EXE and COM files also protected by SRP? I have to install 32 Bit virtual machine and find 16Bit program to check this. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" /></blockquote>

[QUOTE="Andy Ful, post: 608616, member: 32260"] I noticed a simple mistake in my tutorial. :oops: I wrote: [B]SRP have three enforcement settings:[/B] ... * Skip DLLs - ignores only LoadLibrary() calls - other security layers: 'DFT list + ShellExecute() + CreateProcess() + [B][U][I]LoadLibrary()[/I][/U][/B] + 'CMD Host' + 'Windows Script Host' + 'Windows Installer' calls are not ignored. ... Of course [B][U][I]LoadLibrary()[/I][/U][/B] should be skipped! I have to add the correction note according to COM files. There are two kinds of COM files in Windows XP+. The old type, 16Bit COM files, that can be are run in an MS-DOS-emulating subsystem NTVDM, which is present only in 32Bit Windows systems. There are also 32Bit COM files, which are simply a special type of EXE files. So in fact, ShellExecute() is invoked when running COM files, and they are monitored by SRP when COM extension is on DFT list. Of course, all EXE like file types (32Bit COM, EXE, SCR) are also protected by CreateProcess(). The last thing to test: are 16Bit EXE and COM files also protected by SRP? I have to install 32 Bit virtual machine and find 16Bit program to check this. :( [/QUOTE]

Verification