Serious Discussion Why does the Comodo "Disappearing HIPS rules" bug require a complete source code rewrite?

[Divergent]

I literally suggested fixes, before you pollute them with AI copy and paste.

Easy or not, when a company is paying you, you do your jobs.
When your job is to fix bugs, you do it.
That’s how it goes in life, nothing is easy.

Is your current or previous job easy?

You go there and they’ve put a red carpet and champagne for you?

I did not claim to have the fix for this issue, especially since I do not have access to the source code. I did however compile a bunch of users experiences with the issue and looked at the architect of the application to realize what possibly could be the issue, which all evidence collected do not point to an easy fix. The fact that it's gone on as long as it has points to this. But you are so full of yourself that you think you know everything. So again, if you have the answer, which is a miracle you can do without the code, you should share this miracle.

 

[Trident]

I did claim to have the fix for this issue, especially since I do not have access to the source code. I did however compile a bunch of users experiences with the issue and looked at the architect of the application to realize what possibly could be the issue, which all evidence collected do not point to an easy fix. The fact that it's gone on as long as it has points to this. But you are so full of yourself that you seen you know everything. So again, if you have the answer, which is a miracle you can do without the code, you should share this miracle.

This evidence is a bunch of excuses. If you wanna believe the “evidence” that’s your choice to do so.

For me he said, she said, they said is not evidence.

You are so full of yourself that you believe everyone should always agree with you and your views.

If Comodo is the only vendor ever to add parsers and writers in 50 different places including the kernel (notice Eset was written way before Comodo and doesn’t do that), this is not my problem.

You are criticising me like I am the one who did the system analysis and design for Comodo.

 

[Divergent]

This evidence is a bunch of excuses. If you wanna believe the “evidence” that’s your choice to do so.

For me he said, she said, they said is not evidence.

You are so full of yourself that you believe everyone should always agree with you and your views.

If Comodo is the only vendor ever to add parsers and writers in 50 different places including the kernel (notice Eset was written way before Comodo and doesn’t do that), this is not my problem.

You are criticising me like I am the one who did the system analysis and design for Comodo.

This is actually use experience and moderators dealing with user complaints. What experience do you have with this bug exactly?

 

[Trident]

H

This is actually use experience and moderators dealing with user complaints. What experience do you have with this bug exactly?

Dealing with the user complaints (customer service) has got nothing to do with development/debugging. There are extremely large teams in India dealing with the Norton and McAfee complaints 24/7, if you ask them what’s ERASER engine, they don’t know. The first line of support is literally install/uninstall and you know that very well. For second line of support there are already technical requirements.

 

[Andy Ful]

How to fix the HIPS issue without rewriting much of the code.

1. The function that rewrites the HIPS rule should be extended by including what the analogous Xcitium function does. So, CIS will still rewrite the HIPS settings as usual, but additionally, all those settings will be stored one by one in different registry values without rewriting (as a backup).
2. CIS will use an additional kernel driver that compares the HIPS settings with the backup and updates the HIPS settings if they are corrupted.
3. The ELAM driver must be slightly modified to run this additional kernel driver as early as possible before activating HIPS rules.

 

[Divergent]

H

Dealing with the user complaints (customer service) has got nothing to do with development/debugging. There are extremely large teams in India dealing with the Norton and McAfee complaints 24/7, if you ask them what’s ERASER engine, they don’t know. The first line of support is literally install/uninstall and you know that very well. For second line of support there are already technical requirements.

How would I know this, you stated I'm unintelligent and have no experience with any of this. I barely know how to run a Chromebook.

These reports explain the symptoms which is direct evidence that ties how it effects the other modules, systems and various settings. They are indeed creditable evidence. The responses from the Moderators also point to these with how they instruct the users per case to account for them. The time line accounts for this evidence in that it points to the fact that it might not be an easy fix or it would of be done by now.

 

[Pico]

The function that rewrites the HIPS rule should be extended by including what the analogous Xcitium function does. So, CIS will still rewrite the HIPS settings as usual, but additionally, all those settings will be stored one by one in different registry values without rewriting (as a backup).

If this is terminated during shutdown you're back at the start of the problem I guess.

 

[Trident]

How would I know this, you stated I'm unintelligent and have no experience with any of this. I barely know how to run a Chromebook.

These reports explain the symptoms which is direct evidence that ties how it effects the other modules, systems and various settings. They are indeed creditable evidence. The responses from the Moderators also point to these with how they instruct the users per case to account for them. The time line accounts for this evidence in that it points to the fact that it might not be an easy fix or it would if be done by now.

The mods simply recite the excuses the development team has provided. Every business (and I am hoping Comodo too) operates on the basis of the least privileges needed for staff to do their job. Mods don’t need access to the codebase to do their job.

There is a lot that can happen there, you have no evidence or information.

It could be that a developer was a drama queen, the code wasn’t as clean as they wanted and at the first hurdle they declared the code “messy spaghetti”. It could be something totally else.

The issue in Xcitium has been fixed, which is evidence that when someone wants to fix it can actually do it.

Also, don’t twist and turn so you’re the victim again.

 

[Divergent]

Also, don’t twist and turn so you’re the victim again.

Is this your only recourse. Such a professional you are. No different then all the deflection and misdirection by the other so called professionals. You can not directly asses and look at things logically so you lash out with these childish redirects.

 

[Trident]

Is this your only recourse. Such a professional you are. No different then all the deflection and misdirection by the other so called professionals. You can not directly asses and look at things logically so you lash out with these childish redirects.

Yeah, I agree.

 

[Andy Ful]

If this is terminated during shutdown you're back at the start of the problem I guess.

You guessed wrong. Before the Windows restart, it will work as usual, and after the restart, as in Xcitium.

 

[Trident]

You guessed wrong. Before the Windows restart, it will work as usual, and after the restart, as in Xcitium.

But then again, if the fix needs to be applied in many different locations which was your initial assumption, it wouldn’t be so straight forward. This works best assuming that the code is well structured (which is my assumption).

 

[Andy Ful]

But then again, if the fix needs to be applied in many different locations which was your initial assumption, it wouldn’t be so straight forward. This works best assuming that the code is well structured (which is my assumption).

I do not think so. While reading the HIPS settings is most probably from many different code locations (drivers, services, CIS application, etc.), the HIPS rewriting function is most probably only one.
However, I do not know the code, so I cannot say this for sure.

 

[Trident]

I do not think so. While reading the HIPS settings is most probably from many different code locations (drivers, services, CIS application, etc.), the HIPS rewriting function is most probably only one.
However, I do not know the code, so I cannot say this for sure.

Comodo can also perform verification whether or not the rules were actually written. Since you are suggesting “one by one” you probably think that Comodo deletes all rules, then rewrites them and fails at the second step.

They can still do the backup one by one but they can also verify at the end of the function whether everything was written.

Or they can suspend creation of new rules on shutdown to eliminate the faulty write alltogether.

 

[Halp2001]

A Lighthearted Interlude​

Before diving into this parody, let’s take a moment to breathe. This story is meant to lighten the mood and bring a smile to the faces of everyone following the Comodo HIPS saga. Forums can get intense, especially when bugs linger and opinions clash — but humor is healthy, and laughter is good for the soul.

So, in the spirit of camaraderie and comic relief, here’s a playful tale inspired by Agatha Christie’s detective novels, starring Bazang as our digital Poirot. Enjoy the mystery, the drama, and the absurdity — all in good fun!

“The Mystery of the Disappearing HIPS Rules”​

A parody inspired by Agatha Christie, based on the MalwareTips thread about Comodo’s HIPS issues

Chapter 1: The Bug That Vanished​

It was a foggy morning on the MalwareTips forum. Users gathered around a case that had baffled even the most seasoned tech minds: Comodo’s HIPS rules were vanishing without a trace. Some blamed registry corruption, others suspected ghostly glitches. But only one man kept a clear head: Bazang.

Bazang, with his perfectly groomed mustache and sepia-toned avatar, observed the thread like Poirot surveying a crime scene. “Messieurs,” he said, “this is no ordinary bug. It is a crime against logic.”

Chapter 2: The Forum Suspects​

There were many suspects:

Trident, the fiery one, hurling accusations like daggers. “It’s the design! Comodo wrote parsers in 50 different places!”

Divergent, the collector of testimonies, citing moderators, users, and timelines like courtroom evidence.

Andy Ful, the code sage, proposing kernel drivers and registry backups as solutions.

Pico, the skeptic, doubting everything — even Windows restarts.



But Bazang remained unimpressed. “Emotion clouds judgment,” he murmured, scribbling notes in his digital notebook.

Chapter 3: Bazang’s Method​

Bazang didn’t have access to the source code, but that didn’t stop him. Like Poirot, he trusted the order of events, hidden patterns, and the psychology of the bug.

“The rules don’t vanish by magic,” he said. “They vanish because something — or someone — rewrites them without backup. If the system doesn’t protect them, the culprit lies in the design itself.”

The others scoffed. “You have no proof!” shouted Trident. “That’s just speculation!” said Divergent. But Bazang simply smiled. “Truth needs no defense. Only time.”

Chapter 4: The Final Twist​

When Andy Ful proposed a solution inspired by Xcitium, Bazang raised an eyebrow. “Interesting,” he said. “But if the problem lies in many places, how can it be solved with a single function?”

Silence fell over the thread.

Bazang rose from his virtual armchair, adjusted his avatar, and delivered the final blow:

“The bug isn’t technical. It’s philosophical. And unless the logic is rewritten, the rules will keep disappearing.”

Everyone was stunned. Trident stopped typing. Divergent closed his Chromebook. Andy Ful nodded slowly.

Epilogue: The Forum Remembers​

From that day on, whenever someone mentions Comodo’s HIPS bug, someone whispers, “Bazang said it first.” And in the corner of the thread, his avatar remains — like Poirot’s portrait in the hall of solved mysteries.

 

[oldschool]

From that day on, whenever someone mentions Comodo’s HIPS bug, someone whispers, “Bazang said it first.” And in the corner of the thread, his avatar remains — like Poirot’s portrait in the hall of solved mysteries.

"The end".

Or not ... There are still dozens of thread pages to be written.

 

[Trident]

"The end".

Or not ... There are still dozens of thread pages to be written.

They will be written.
The Comodo HIPS wipeout saga is only getting started

 

[Andy Ful]

Comodo can also perform verification whether or not the rules were actually written. Since you are suggesting “one by one” you probably think that Comodo deletes all rules, then rewrites them and fails at the second step.

I do not assume anything about CIS HIPS rewriting (except using one function). We know that it does not work, and the Xcitium way of storing the HIPS settings works. The fix is easier because I use the improvements in storing settings already created by Xcitium. Making a simple driver also should not be a problem.
The method posted by me is a standard fix + driver. It is doable, with some work. And this is my answer to the question in the OP. It does not need complete source code rewriting.

Of course, I do not exclude other methods.

 

[Trident]

I do not assume anything about CIS HIPS rewriting (except using one function). We know that it does not work, and the Xcitium way of storing the HIPS settings works. The fix is easier because I use the improvements in storing settings already created by Xcitium. Making a simple driver also should not be a problem.
The method posted by me is a standard fix + driver. It is doable, with some work. And this is my answer to the question in the OP. It does not need complete source code rewriting.

Of course, I do not exclude other methods.

Yeah, it is a smart fix. I personally would try a few, one will work. One of our suggestions is probably the Xcitium fix.

 

[Pico]

but additionally, all those settings will be stored one by one in different registry values without rewriting (as a backup).

How would you prevent the termination of this one-by-one backup creation when Windows on shutdown forcibly kills it?

Furthermore it could be the case that all rules are deleted first and than all rules are rewritten when only one new rule needs to be added.
When one manually adds a new HIPS rule in CIS and the HIPS rules list is (very) long it takes pretty much time before the new rule is added before the HIPS rules window closes.