Hacker News Reader

It would make it a lot harder, either way - depending on the struct, you could possibly use heuristics to guess where you have to look. Either way, I don't think this would ever be possible for Windows. A surprising amount of legitimate software actually depends on these being the way they are (mostly Antivirus software that you don't want on your system in the first place, but they exist nonetheless).

View on HN

I thought with x64 the days of AV hooking up random places of the kernel were over?

They aren't. AV and AC software continue hooking system functions to this day. PatchGuard doesn't cover every .data ptr and procedure.

You can do things with IoAllocateMdl, MmProbeAndLockProcessPages, MmMapLockedPagesSpecifyCache, MmProtectMdlSystemAddress to achieve such tasks.

They don't even need to be public, you can just walk the exports of ntoskrnl.exe etc.

You can even do insane shit like changing the PML4 of a process to the PML4 of another and have them point to the same memory. Or change the Win32Thread of your KTHREAD structure to that of explorer.exe and draw on the screen from kernel with GDI commands.

Reply on news.ycombinator.com