Reply to thread

Message

<blockquote data-quote="436880927" data-source="post: 828060">[USER=50782]@Windows_Security[/USER] MemProtect&#039;s DLL blocking abilities is indirect. In user-mode, you need a handle to a process to use generic APIs like NtWriteVirtualMemory/NtMapViewOfSection or a handle to a thread to hijack it.There are injection methods that can be performed from user-mode that require no handle... shared memory targets.Furthermore, there are ways to acquire a handle to a process or a thread without explicitly creating or duplicating it yourself.AVs which have kernel-mode software do not need to dick around with a fancy bypass. They do not have to adhere to MemProtect. If people in the kernel wanted, they can walk the list of registered callbacks to ObRegisterCallbacks... and oh my god... unregister it!Keep on believing in reviews from others who do not understand the &quot;techno talk&quot;, it doesn&#039;t mean you&#039;re right. I am right and you are wrong, factually.The fact remains that MemProtect cannot and does not explicitly prevent code injection - if this was the case, I wouldn&#039;t be able to inject code with NtWriteVirtualMemory from user-mode with a handle that isn&#039;t mine.Instead of arguing with me or getting your knickers in a twist because I dizz&#039;d your favourite software, read what I am saying and educate yourself. Or smack the report button like everyone else that gets butt-hurt over the truth.</blockquote>

[QUOTE="436880927, post: 828060"] [USER=50782]@Windows_Security[/USER] MemProtect's DLL blocking abilities is indirect. In user-mode, you need a handle to a process to use generic APIs like NtWriteVirtualMemory/NtMapViewOfSection or a handle to a thread to hijack it. There are injection methods that can be performed from user-mode that require no handle... shared memory targets. Furthermore, there are ways to acquire a handle to a process or a thread without explicitly creating or duplicating it yourself. AVs which have kernel-mode software do not need to dick around with a fancy bypass. They do not have to adhere to MemProtect. If people in the kernel wanted, they can walk the list of registered callbacks to ObRegisterCallbacks... and oh my god... unregister it! Keep on believing in reviews from others who do not understand the "techno talk", it doesn't mean you're right. I am right and you are wrong, factually. The fact remains that MemProtect cannot and does not explicitly prevent code injection - if this was the case, I wouldn't be able to inject code with NtWriteVirtualMemory from user-mode with a handle that isn't mine. Instead of arguing with me or getting your knickers in a twist because I dizz'd your favourite software, read what I am saying and educate yourself. Or smack the report button like everyone else that gets butt-hurt over the truth. [/QUOTE]

Verification