Pleaee tell us the name of your company or what you are going to publish
this crap under, so we can all be sure to avoid it, and let our friend and
customers know to do the same.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply
wrote in message news:xxxxx@ntdev…
>>>So why is it none of the various hooking examples on the net do much in
>>>the way at all with validation?
> This trick is good but very hard - I want over IAT hooking \ Inline
> hooking - and I saw witch one is
> easier to crack.
>
>>>The one you pointed out had on an initial review at least 20 attacks I
>>>could do to crash the system.
> My program don’t protect the system from attacks…
> He just need to have control - To run program or not (And to put a thread
> inside)…
> If you thinking about a better solution for doing this I will be happy to
> listen
>
> BTW
> I checked if there is a function PsSetXXX, There is a function like this,
> but… He don’t let me to control the new process
>
>>>If the virus is in the kernel, you are doomed…
> My program is a secret until I will publish it, it’s not a AntiVirus!!!
>
>>>Second, using a file system filter is not hooking.
> The idea of hooking is the same as filter (the way is different - the
> idea is the same).
>