Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 700736">I recon they will use the same kernel-mode callback that OSArmor uses. If multiple drivers register the callback, only one drivers callback routine is triggered at a time. If I make 3 drivers which all register PsSetCreateProcessNotifyRoutineEx, only one at a time will receive the notification. So the second driver may receive the notification first, then the first driver after the thread for the callback routine for the first notified callback routine has ended.They likely suspend it so they don&#039;t have to hold up the thread for the callback routine, so the thread ends and the execution was successful, except the new process is in a suspended state and doesn&#039;t get to execute any code until the users request deems it to be allowed to be executed. Which is actually not a bad idea at all because Microsoft advise against holding up the callback routine threads in kernel-mode.This is assuming ReHIPS does use the common and documented and secure kernel-mode approach with PsSetCreateProcessNotifyRoutine/Ex/Ex2 for process start-up interception. Especially considering they claim not to use rootkit-like techniques like API hooking, so kernel-mode callbacks are a good bet for them to use.</blockquote>

[QUOTE="Deleted member 65228, post: 700736"] I recon they will use the same kernel-mode callback that OSArmor uses. If multiple drivers register the callback, only one drivers callback routine is triggered at a time. If I make 3 drivers which all register PsSetCreateProcessNotifyRoutineEx, only one at a time will receive the notification. So the second driver may receive the notification first, then the first driver after the thread for the callback routine for the first notified callback routine has ended. They likely suspend it so they don't have to hold up the thread for the callback routine, so the thread ends and the execution was successful, except the new process is in a suspended state and doesn't get to execute any code until the users request deems it to be allowed to be executed. Which is actually not a bad idea at all because Microsoft advise against holding up the callback routine threads in kernel-mode. This is assuming ReHIPS does use the common and documented and secure kernel-mode approach with PsSetCreateProcessNotifyRoutine/Ex/Ex2 for process start-up interception. Especially considering they claim not to use rootkit-like techniques like API hooking, so kernel-mode callbacks are a good bet for them to use. [/QUOTE]

Verification