exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

prevxhome.txt

Posted Dec 11, 2004

Authored by Tan Chew Keong | Site security.org.sg

Prevx Home's registry and buffer overflow protection features are implemented by hooking several native APIs in kernel-space by modifying entries within the SDT ServiceTable. This means that a malicious program with Administrator privilege can disable these features by restoring the running kernel's SDT ServiceTable with direct writes to \device\physicalmemory. Verified against Prevx Home Version 1.0 Build 2.1.0.0 on WinXP SP0, SP2.

tags | advisory, overflow, kernel, registry

systems | windows

SHA-256 | cdbe8aa011cc24d5f6c3a5f694ae3235e1744f064bd8ed4e13f8f9f7a62e832f

Download | Favorite | View

Related Files

No related files