Serious Discussion Why does the Comodo "Disappearing HIPS rules" bug require a complete source code rewrite?

I am not sure if "HIPS settings restore" can be done by a userland process. I doubt if all protection that uses information about HIPS is related only to the userland
The HIPS rules in registry are protected against modification by normal userland processes, maybe elevated processes can do it.
The protection mechanism in older CIS versions used processes in both userland and kernel, latest version mainly in kernel.
 
  • Like
Reactions: Trident
This is a textbook example of a solid, modern security architecture. It's also a fundamental re-architecture
Well that’s usually how you start designing, by using these commonly understood textbook examples. Then you take it from there.

it was the evidence proving why the design is flawed.
If there is a persistent bug, then of course it’s flawed. My understanding was that complete source code rewrite was required. You said “complete rewrite of the module”. That’s totally different. The module needs rewriting.

My point and argument was, when you are in this business, you have to rewrite then you will rewrite.
Not being incentivised to do it is not the same as being impossible technically.
I am not sure if "HIPS settings restore" can be done by a userland process. I doubt if all protection that uses information about HIPS is related only to the userland. Furthermore, it would be hard to check it.
However, if it is true, then "HIPS settings restore" could be done without using the kernel driver.
You are probably right.
 
The HIPS rules in registry are protected against modification by normal userland processes, maybe elevated processes can do it.

Yes. That is normal for all AVs. An AV driver usually protects them against modifications by userland processes, even those running with high privileges.
 
Well that’s usually how you start designing, by using these commonly understood textbook examples. Then you take it from there.


If there is a persistent bug, then of course it’s flawed. My understanding was that complete source code rewrite was required. You said “complete rewrite of the module”. That’s totally different. The module needs rewriting.

My point and argument was, when you are in this business, you have to rewrite then you will rewrite.
Not being incentivised to do it is not the same as being impossible technically.

You are probably right.
You're playing a game of semantics, but in doing so, you've finally arrived at my original conclusion.

You state, "My understanding was that complete source code rewrite was required. You said 'complete rewrite of the module'. That's totally different. The module needs rewriting."

A "complete rewrite of the module" is precisely what I have been advocating for from the beginning. My entire analysis has been focused on the core architectural flaw within the HIPS module and its interaction with the main agent during shutdown. It seems we are now in agreement on the fundamental technical solution.

Where we differ is on the value of the discussion. Stating that a design with a persistent bug is "flawed" is an obvious starting point. My detailed analysis was the necessary work to prove why it is flawed, to identify the specific race condition that makes a simple patch impossible. It's the difference between saying a building is unsafe and providing the engineering report that shows the foundation is cracked.

As for your point about business incentives, you're likely correct. That's a separate discussion about Comodo's priorities. The technical reality remains the same, the only proper fix is the one you now agree with, rewriting the module.
 
Last edited:
Where we at here with the discussion?

CSL.gif
 
Guys,

The solutions provided here are kinds of bypasses that can "keep the patient alive" without fully healing the disease. The disease (HIPS corruption) is still present, only its fallout is significantly smaller.
It is still possible that a full solution to HIPS corruption may require serious changes in the source code, not only in the HIPS rewriting function or HIPS modules. No one can be sure without deep knowledge of the source code.
 
Welcome, mortals and semi-mortals of the forum!

Before the crypts of code creak open and the kernel vampires emerge to debate registries, modules, and user space, we’d like to take a brief moment to explain why these stories exist… and why you shouldn’t close the thread in despair if you don’t know what a race condition is.

These little parodies were written with a noble and deeply human purpose (even if they’re starring nocturnal creatures): to lift the spirit. Yes, even for those who, upon reading “complete rewrite of the HIPS module,” feel like they’re staring at a Latin incantation.

We know technical language can be intimidating. That security forum threads sometimes feel like dark rituals where only the initiated understand what’s going on. That’s why we’ve summoned the power of humor, satire, and a touch of digital gothic to turn complex debates into entertaining, absurd, and—why not—a bit therapeutic stories.

These parodies aren’t meant to mock the participants (well, maybe just a little 😏), but to celebrate their passion, their unique style, and their ability to turn a bug into an epic. Here, experts become vampires, changelogs turn into prophecies, and forums become enchanted castles where every argument has fangs.

So if you’ve ever felt lost among terms like “user space,” “kernel driver,” or “structural rewrite,” relax. Take this story like a glass of wine (or digital blood), and enjoy the show.

Because at the end of the day, we’re all here for the same reason: To survive the code… and laugh a little along the way.

Get ready for a tale of eternal bugs, razor-sharp sarcasm, and vampires who debate code as if it were blood.



The Cursed Code of Comodo

A gothic parody in six acts and one final sigh, inspired by Interview with the Vampire

Prologue: The Interview​

On a damp night, in a café with no Wi-Fi and the scent of a burnt driver, an anonymous journalist turns on his recorder. Sitting across from him, wearing dark glasses and a smile that reeks of sarcasm, is Louis Bazang, the vampire who was once human… until he installed Comodo.



—“Are you ready to tell your story?” —“Ready? I’ve waited centuries for someone to ask. But beware: this isn’t a love story. It’s a story of HIPS rules that vanish like souls in limbo. And vampires. Lots of vampires.”



Act I: The Awakening of Bazang​

Louis Bazang wasn’t born a vampire. He became one after activating Comodo’s paranoid mode and watching his HIPS rules vanish without a trace. They weren’t corrupted. They weren’t deleted. They simply… evaporated.

—“It was as if the code whispered to me: ‘Welcome to the eternity of the bug.’”

Since then, Bazang roams the forums, searching for answers and feeding on poorly written technical debates.

Act II: Andy Ful, the Monk of the Registry​

Bazang recalls his first encounter with Andy Ful, an ascetic vampire who lives among registry keys and configuration scripts. His voice echoes like PowerShell.

—“Andy doesn’t speak. He prophesies. Says things like ‘HIPS corruption can’t be cured, only mitigated.’ Then vanishes in a cloud of advanced settings.”

Andy Ful doesn’t bite. He convinces you to uninstall everything and use Hard_Configurator.

Act III: Divergente, the Architect of Chaos​

Then came Divergente, a vampire who doesn’t sleep—he rearchitects. His castle is made of UML diagrams and frustration.

—“Divergente believes everything must be rewritten. The module, the code, the universe. Says the design is cursed. I think he’s the cursed one.”

Divergente has no fangs. He has opinions. And he throws them like daggers in every thread.

Act IV: Trident, the Semantic Scourge​

Bazang chuckles remembering Trident, the forum’s sharpest vampire.

—“Trident doesn’t argue. He obliterates with surgical precision. If you confuse ‘user space’ with ‘kernel,’ he appears like a hellish pop-up.”

Trident lives in a tower of sarcasm. His bite doesn’t drain blood—it drains self-esteem. His favorite line:

“Your logic has more holes than Swiss cheese in debug mode.”



Act V: Pico, the Guardian of the Registry​

Pico is the vampire who guards HIPS rules like sacred relics. Bazang describes him as the librarian of the apocalypse.

—“Pico says elevated processes might modify the rules. But he says it like he’s narrating a Greek tragedy.”

Pico doesn’t attack. He watches. And judges you for not using elevated configurations.

Act VI: CruelSister, the Lady of the Threshold​

And then there’s CruelSister, the most ambiguous figure of all. Bazang lowers his voice when mentioning her.

—“I don’t know if she’s an ally or an enemy. Sometimes she defends Melih, the absent developer. Sometimes she criticizes him. She’s like an antivirus that protects you… but also spies on you.”

CruelSister has unwavering faith in her Sandbox configuration. She claims it’s infallible. Though she always adds:

“Well… if someone gave me the file or at least the hash, I could confirm it. But no one does. No one listens.”

Bazang describes her as a mix between oracle and malware auditor. Her loyalty is as volatile as a global variable with no documentation. Her presence in the thread is like a kernel hook: silent, but potentially devastating.

Epilogue: The Silence of Melih​

The journalist asks:

—“And Melih? The one behind all this?”

Bazang smiles, revealing fangs as sharp as all-caps arguments.

—“Melih is like the kernel: he’s there, but no one fully understands him. Some say he’s the architect. Others say he’s just a myth. I think he’s both.”

At that moment, the recorder shuts off on its own. The lights flicker. And on the journalist’s monitor, a new version of Comodo appears… with no changelog.

Bazang stands, adjusts his cape, and whispers:

—“The story doesn’t end. It just compiles in the background.”
 
@Andy Ful
Hi Andy,

I just wanted to clarify that my previous message, inspired by Interview with the Vampire, was purely a parody meant for fun. It was never intended to offend or make anyone uncomfortable, but rather to pay tribute to you in a subtle and creative way.

I truly admire your work and the impact your free tools have had on the community. Thanks to your generosity, many users—including myself—have been able to improve our system's security at no cost. That’s a remarkable contribution, and I wanted to express my gratitude.

Thank you for your dedication and for sharing your knowledge with all of us.

Warm regards, (y)
 
Last edited:
Before Frankenstein changes his mind...
These parodies aren’t meant to mock the participants (well, maybe just a little 😏), but to celebrate their passion, their unique style, and their ability to turn a bug into an epic. Here, experts become vampires, changelogs turn into prophecies, and forums become enchanted castles where every argument has fangs.
 
Even if I am a vampire?:)

View attachment 291997
Ah, then it all makes sense! That’s why WHHLight works so well in the cyberspace darkness. If you’re a vampire, Andy, that would explain your talent for spotting hidden threats and your aversion to overly shiny configurations. I just hope the software includes protection against digital stakes… because your work deserves to live forever! 😄
 
  • Like
Reactions: simmerskool
Yes, as any vampire, I like my bloody work.
I even posted a video about killing Comodo, so it seems that now Comodo may be a long-living vampire, too.:)
Thanks, Andy. I’ve watched your videos on the topic, and if there’s one thing I’ve learned, it’s that even the best security software can have its Achilles’ heel… or its digital stake, if we stick with the vampire theme. That’s why I always pay close attention to your advice—it’s like fresh garlic against hidden threats. WHHLight may not be invulnerable, but with your contributions, it becomes much harder to bite. Keep lighting up the darkness of cyberspace!

Signing off for now, but I’ll keep lurking through the threads like a curious specter. Until the next bite! (y)
 
"The bug you are talking about is one that requires a full re-architecture of the code base (almost a rewrite). Given the resources required, we will not be fixing that bug." - Melih (Post timestamp: May 02, 2011)

Source: one of my analysis tools

1000010119.png
 
Last edited:
"The bug you are talking about is one that requires a full re-architecture of the code base (almost a rewrite). Given the resources required, we will not be fixing that bug." - Melih (Post timestamp: May 02, 2011)
That's it. That's the post by Melih. I just love it because it proves what I've been saying about Comodo all along...

laughing-hysterically-thats-funny.gif
 
  • Like
Reactions: Divergent
If I correctly recall, the ELAM driver support was introduced in 2013. Comodo probably started using ELAM drivers in 2019:
Click to expand the post content.

1760608745343.png


It is possible that the opinions on "complete source code rewriting" are based on the outdated note posted by Melih in 2011.
 
Last edited: