Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 699906">Only thing is that multiple products using kernel-mode callbacks, one has to intercept fast. so there&#039;s a queue system (e.g. based on altitude). so when using VoodooShield and this app, one of them will get notifications first than the other... but both will still get them to function, just one will be able to do it before another one. After the callback ends for PsSetCreateProcessNotifyRoutineEx, if the CreationStatus entry in a pointer structure passed to the routine is STATUS_SUCCESS, then the operation continues further down the queue and it only gets blocked if the status code is changed (e.g. STATUS_ACCESS_DENIED,, etc.).Assuming this app uses this technique from its driver but I don&#039;t see why it wouldn&#039;t be because thats the standard documented way for x64 support as well, and this app uses a driver. soooocompatibility issues with products with behavioural detection only tends to show up when both products are doing things like code injection &amp; API hooking, emulation of system service dispatch routines (e.g. KiSystemCallXx with virtualisation) and alike. not for kernel-mode callbacks only if its handled properly... for example F-Secure DeepGuard uses hooks and so does Emsisoft so both Emsisoft BB and F-Secure DeepGuard is likely to conflict. but only if they target the same functions, or if one flags injection attacks from the other AV</blockquote>

[QUOTE="Deleted member 65228, post: 699906"] Only thing is that multiple products using kernel-mode callbacks, one has to intercept fast. so there's a queue system (e.g. based on altitude). so when using VoodooShield and this app, one of them will get notifications first than the other... but both will still get them to function, just one will be able to do it before another one. After the callback ends for PsSetCreateProcessNotifyRoutineEx, if the CreationStatus entry in a pointer structure passed to the routine is STATUS_SUCCESS, then the operation continues further down the queue and it only gets blocked if the status code is changed (e.g. STATUS_ACCESS_DENIED,, etc.). Assuming this app uses this technique from its driver but I don't see why it wouldn't be because thats the standard documented way for x64 support as well, and this app uses a driver. soooo compatibility issues with products with behavioural detection only tends to show up when both products are doing things like code injection & API hooking, emulation of system service dispatch routines (e.g. KiSystemCallXx with virtualisation) and alike. not for kernel-mode callbacks only if its handled properly... for example F-Secure DeepGuard uses hooks and so does Emsisoft so both Emsisoft BB and F-Secure DeepGuard is likely to conflict. but only if they target the same functions, or if one flags injection attacks from the other AV [/QUOTE]

Verification